mirror of
https://github.com/hanzoai/kms-operator.git
synced 2026-10-30 18:32:57 +00:00
zeekay
893119b82a
The six kinds (KMSSecret, KMSDynamicSecret, KMSPushSecret, ClusterGenerator, Password, UUID) move from v1alpha1 to v1. One package of Go types, renamed api/v1alpha1 -> api/v1, so there is one definition of each kind rather than a copy per version. The CRDs declare conversion: None, so the API server relabels apiVersion and returns the same bytes. The operator therefore needs to watch only the version the CRD serves; a second Go package would add drift and buy nothing. The v1 schema is v1alpha1's, unchanged -- controller-gen's output moves by exactly one line per CRD, the version name. Call sites import the package as secretsv1 because packages/controllerhelpers already binds bare v1 to k8s.io/api/apps/v1. RBAC is group- and resource-scoped, so it is unaffected.
93 lines
2.9 KiB
Go
93 lines
2.9 KiB
Go
package util
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
secretsv1 "github.com/hanzoai/kms-operator/api/v1"
|
|
"github.com/hanzoai/kms-operator/packages/model"
|
|
corev1 "k8s.io/api/core/v1"
|
|
k8Errors "k8s.io/apimachinery/pkg/api/errors"
|
|
"k8s.io/apimachinery/pkg/types"
|
|
"k8s.io/client-go/kubernetes"
|
|
"k8s.io/client-go/rest"
|
|
"k8s.io/client-go/tools/clientcmd"
|
|
"sigs.k8s.io/controller-runtime/pkg/client"
|
|
)
|
|
|
|
const KMS_MACHINE_IDENTITY_CLIENT_ID = "clientId"
|
|
const KMS_MACHINE_IDENTITY_CLIENT_SECRET = "clientSecret"
|
|
|
|
func GetKubeSecretByNamespacedName(ctx context.Context, reconcilerClient client.Client, namespacedName types.NamespacedName) (*corev1.Secret, error) {
|
|
kubeSecret := &corev1.Secret{}
|
|
err := reconcilerClient.Get(ctx, namespacedName, kubeSecret)
|
|
if err != nil {
|
|
kubeSecret = nil
|
|
}
|
|
|
|
return kubeSecret, err
|
|
}
|
|
|
|
func GetKubeConfigMapByNamespacedName(ctx context.Context, reconcilerClient client.Client, namespacedName types.NamespacedName) (*corev1.ConfigMap, error) {
|
|
kubeConfigMap := &corev1.ConfigMap{}
|
|
err := reconcilerClient.Get(ctx, namespacedName, kubeConfigMap)
|
|
if err != nil {
|
|
kubeConfigMap = nil
|
|
}
|
|
|
|
return kubeConfigMap, err
|
|
}
|
|
|
|
func GetKMSUniversalAuthFromKubeSecret(ctx context.Context, reconcilerClient client.Client, universalAuthRef secretsv1.KubeSecretReference) (machineIdentityDetails model.MachineIdentityDetails, err error) {
|
|
|
|
universalAuthCredsFromKubeSecret, err := GetKubeSecretByNamespacedName(ctx, reconcilerClient, types.NamespacedName{
|
|
Namespace: universalAuthRef.SecretNamespace,
|
|
Name: universalAuthRef.SecretName,
|
|
// Namespace: kmsSecret.Spec.Authentication.UniversalAuth.CredentialsRef.SecretNamespace,
|
|
// Name: kmsSecret.Spec.Authentication.UniversalAuth.CredentialsRef.SecretName,
|
|
})
|
|
|
|
if k8Errors.IsNotFound(err) {
|
|
return model.MachineIdentityDetails{}, nil
|
|
}
|
|
|
|
if err != nil {
|
|
return model.MachineIdentityDetails{}, fmt.Errorf("something went wrong when fetching your machine identity credentials [err=%s]", err)
|
|
}
|
|
|
|
clientIdFromSecret := universalAuthCredsFromKubeSecret.Data[KMS_MACHINE_IDENTITY_CLIENT_ID]
|
|
clientSecretFromSecret := universalAuthCredsFromKubeSecret.Data[KMS_MACHINE_IDENTITY_CLIENT_SECRET]
|
|
|
|
return model.MachineIdentityDetails{ClientId: string(clientIdFromSecret), ClientSecret: string(clientSecretFromSecret)}, nil
|
|
|
|
}
|
|
|
|
func getKubeClusterConfig() (*rest.Config, error) {
|
|
config, err := rest.InClusterConfig()
|
|
if err != nil {
|
|
|
|
loadingRules := clientcmd.NewDefaultClientConfigLoadingRules()
|
|
configOverrides := &clientcmd.ConfigOverrides{}
|
|
kubeConfig := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(loadingRules, configOverrides)
|
|
return kubeConfig.ClientConfig()
|
|
}
|
|
|
|
return config, nil
|
|
}
|
|
|
|
func GetRestClientFromClient() (rest.Interface, error) {
|
|
|
|
config, err := getKubeClusterConfig()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
clientset, err := kubernetes.NewForConfig(config)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return clientset.CoreV1().RESTClient(), nil
|
|
|
|
}
|