1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
package gatewayapi
import (
"context"
"encoding/json"
"fmt"
"os"
"time"
"k8s.io/client-go/rest"
"github.com/johnandersen777/socialweb-computer-kcp/internal/clientcert"
"github.com/johnandersen777/socialweb-computer-kcp/internal/clusterkcp"
"github.com/johnandersen777/socialweb-computer-kcp/internal/clusterprovider"
"github.com/johnandersen777/socialweb-computer-kcp/internal/contract/clusterhome"
"github.com/johnandersen777/socialweb-computer-kcp/internal/gateway"
"github.com/johnandersen777/socialweb-computer-kcp/internal/tenantapply"
)
const ownerCredentialValidity = 10 * time.Minute
func newTenantAPI(stateDir string) (gateway.TenantAPI, error) {
if stateDir == "" {
return nil, nil
}
return tenantapply.New(ownerCredentials(stateDir))
}
func ownerCredentials(stateDir string) func(context.Context, string, string) (*rest.Config, error) {
return func(_ context.Context, did, cluster string) (*rest.Config, error) {
if did == "" || cluster == "" {
return nil, fmt.Errorf("an owner credential is for one cluster of one account, and this lookup names account %q and cluster %q", did, cluster)
}
dir, err := clientcert.DataDir(stateDir, did, cluster)
if err != nil {
return nil, err
}
raw, err := os.ReadFile(clusterprovider.FrontStatePath(dir))
if err != nil {
return nil, fmt.Errorf("the apiserver front of cluster %q is not reporting an address: %w", cluster, err)
}
var front struct {
Address string `json:"address"`
}
if err := json.Unmarshal(raw, &front); err != nil || front.Address == "" {
return nil, fmt.Errorf("the apiserver front of cluster %q reports no address", cluster)
}
return clusterkcp.MintTenantCredentialForDataDirAs(dir, "https://"+front.Address, did,
[]string{clusterhome.OwnersGroup}, ownerCredentialValidity)
}
}
