| Sergiusz Bazanski | b13b7ff | 2019-08-29 20:12:24 +0200 | [diff] [blame] | 1 | package main |
| 2 | |
| 3 | import ( |
| 4 | "crypto/tls" |
| 5 | "crypto/x509" |
| 6 | "fmt" |
| 7 | "io/ioutil" |
| 8 | "os" |
| 9 | "os/exec" |
| 10 | "path" |
| 11 | "path/filepath" |
| 12 | "time" |
| 13 | |
| 14 | "github.com/golang/glog" |
| 15 | |
| 16 | pb "code.hackerspace.pl/hscloud/cluster/prodvider/proto" |
| 17 | ) |
| 18 | |
| 19 | func kubernetesPaths() (string, string, string) { |
| 20 | localRoot := os.Getenv("hscloud_root") |
| 21 | if localRoot == "" { |
| 22 | glog.Exitf("Please source env.sh") |
| 23 | } |
| 24 | |
| 25 | localKey := path.Join(localRoot, ".kubectl", fmt.Sprintf("%s.key", flagUsername)) |
| 26 | localCert := path.Join(localRoot, ".kubectl", fmt.Sprintf("%s.crt", flagUsername)) |
| 27 | localCA := path.Join(localRoot, ".kubectl", fmt.Sprintf("ca.crt")) |
| 28 | |
| 29 | return localKey, localCert, localCA |
| 30 | } |
| 31 | |
| 32 | func needKubernetesCreds() bool { |
| 33 | localKey, localCert, _ := kubernetesPaths() |
| 34 | |
| 35 | // Check for existence of cert/key. |
| 36 | if _, err := os.Stat(localKey); os.IsNotExist(err) { |
| 37 | return true |
| 38 | } |
| 39 | if _, err := os.Stat(localCert); os.IsNotExist(err) { |
| 40 | return true |
| 41 | } |
| 42 | |
| 43 | // Cert/key exist, try to load and parse. |
| 44 | creds, err := tls.LoadX509KeyPair(localCert, localKey) |
| 45 | if err != nil { |
| 46 | return true |
| 47 | } |
| 48 | if len(creds.Certificate) != 1 { |
| 49 | return true |
| 50 | } |
| 51 | cert, err := x509.ParseCertificate(creds.Certificate[0]) |
| 52 | if err != nil { |
| 53 | return true |
| 54 | } |
| 55 | creds.Leaf = cert |
| 56 | |
| 57 | // Check if certificate will still be valid in 2 hours. |
| 58 | target := time.Now().Add(2 * time.Hour) |
| 59 | if creds.Leaf.NotAfter.Before(target) { |
| 60 | return true |
| 61 | } |
| 62 | |
| 63 | return false |
| 64 | } |
| 65 | |
| 66 | func useKubernetesKeys(keys *pb.KubernetesKeys) { |
| 67 | localKey, localCert, localCA := kubernetesPaths() |
| 68 | |
| 69 | parent := filepath.Dir(localKey) |
| 70 | if _, err := os.Stat(parent); os.IsNotExist(err) { |
| 71 | os.MkdirAll(parent, 0700) |
| 72 | } |
| 73 | |
| 74 | if err := ioutil.WriteFile(localKey, keys.Key, 0600); err != nil { |
| 75 | glog.Exitf("WriteFile(%q): %v", localKey, err) |
| 76 | } |
| 77 | if err := ioutil.WriteFile(localCert, keys.Cert, 0600); err != nil { |
| 78 | glog.Exitf("WriteFile(%q): %v", localCert, err) |
| 79 | } |
| 80 | if err := ioutil.WriteFile(localCA, keys.Ca, 0600); err != nil { |
| 81 | glog.Exitf("WriteFile(%q): %v", localCA, err) |
| 82 | } |
| 83 | |
| 84 | kubectl := func(args ...string) { |
| 85 | cmd := exec.Command("kubectl", args...) |
| 86 | out, err := cmd.CombinedOutput() |
| 87 | if err != nil { |
| 88 | glog.Exitf("kubectl %v: %v: %v", args, err, string(out)) |
| 89 | } |
| 90 | } |
| 91 | |
| 92 | kubectl("config", |
| 93 | "set-cluster", keys.Cluster, |
| 94 | "--certificate-authority="+localCA, |
| 95 | "--embed-certs=true", |
| 96 | "--server=https://"+keys.Cluster+":4001") |
| 97 | |
| 98 | kubectl("config", |
| 99 | "set-credentials", flagUsername, |
| 100 | "--client-certificate="+localCert, |
| 101 | "--client-key="+localKey, |
| 102 | "--embed-certs=true") |
| 103 | |
| 104 | kubectl("config", |
| 105 | "set-context", keys.Cluster, |
| 106 | "--cluster="+keys.Cluster, |
| 107 | "--user="+flagUsername) |
| 108 | |
| 109 | kubectl("config", "use-context", keys.Cluster) |
| 110 | } |