class Kubeclient::Config
Kubernetes client configuration class
Public Class Methods
new(data, kcfg_path)
click to toggle source
data (Hash) - Parsed kubeconfig data. kcfg_path (string) - Base directory for resolving relative references to external files.
If set to nil, all external lookups & commands are disabled (even for absolute paths).
See also the more convenient Config.read
# File lib/kubeclient/config.rb, line 25 def initialize(data, kcfg_path) @kcfg = data @kcfg_path = kcfg_path raise 'Unknown kubeconfig version' if @kcfg['apiVersion'] != 'v1' end
read(filename)
click to toggle source
Builds Config
instance by parsing given file, with lookups relative to file's directory.
# File lib/kubeclient/config.rb, line 32 def self.read(filename) parsed = YAML.safe_load(File.read(filename), [Date, Time]) Config.new(parsed, File.dirname(filename)) end
Public Instance Methods
context(context_name = nil)
click to toggle source
# File lib/kubeclient/config.rb, line 41 def context(context_name = nil) cluster, user, namespace = fetch_context(context_name || @kcfg['current-context']) ca_cert_data = fetch_cluster_ca_data(cluster) client_cert_data = fetch_user_cert_data(user) client_key_data = fetch_user_key_data(user) auth_options = fetch_user_auth_options(user) ssl_options = {} if !ca_cert_data.nil? cert_store = OpenSSL::X509::Store.new cert_store.add_cert(OpenSSL::X509::Certificate.new(ca_cert_data)) ssl_options[:verify_ssl] = OpenSSL::SSL::VERIFY_PEER ssl_options[:cert_store] = cert_store else ssl_options[:verify_ssl] = OpenSSL::SSL::VERIFY_NONE end unless client_cert_data.nil? ssl_options[:client_cert] = OpenSSL::X509::Certificate.new(client_cert_data) end unless client_key_data.nil? ssl_options[:client_key] = OpenSSL::PKey.read(client_key_data) end Context.new(cluster['server'], @kcfg['apiVersion'], ssl_options, auth_options, namespace) end
contexts()
click to toggle source
# File lib/kubeclient/config.rb, line 37 def contexts @kcfg['contexts'].map { |x| x['name'] } end
Private Instance Methods
allow_external_lookups?()
click to toggle source
# File lib/kubeclient/config.rb, line 73 def allow_external_lookups? @kcfg_path != nil end
ext_command_path(path)
click to toggle source
# File lib/kubeclient/config.rb, line 84 def ext_command_path(path) unless allow_external_lookups? raise "Kubeclient::Config: external lookups disabled, can't execute '#{path}'" end # Like go client https://github.com/kubernetes/kubernetes/pull/59495#discussion_r171138995, # distinguish 3 cases: # - absolute (e.g. /path/to/foo) # - $PATH-based (e.g. curl) # - relative to config file's dir (e.g. ./foo) if Pathname(path).absolute? path elsif File.basename(path) == path path else File.join(@kcfg_path, path) end end
ext_file_path(path)
click to toggle source
# File lib/kubeclient/config.rb, line 77 def ext_file_path(path) unless allow_external_lookups? raise "Kubeclient::Config: external lookups disabled, can't load '#{path}'" end Pathname(path).absolute? ? path : File.join(@kcfg_path, path) end
fetch_cluster_ca_data(cluster)
click to toggle source
# File lib/kubeclient/config.rb, line 124 def fetch_cluster_ca_data(cluster) if cluster.key?('certificate-authority') File.read(ext_file_path(cluster['certificate-authority'])) elsif cluster.key?('certificate-authority-data') Base64.decode64(cluster['certificate-authority-data']) end end
fetch_context(context_name)
click to toggle source
# File lib/kubeclient/config.rb, line 102 def fetch_context(context_name) context = @kcfg['contexts'].detect do |x| break x['context'] if x['name'] == context_name end raise KeyError, "Unknown context #{context_name}" unless context cluster = @kcfg['clusters'].detect do |x| break x['cluster'] if x['name'] == context['cluster'] end raise KeyError, "Unknown cluster #{context['cluster']}" unless cluster user = @kcfg['users'].detect do |x| break x['user'] if x['name'] == context['user'] end || {} namespace = context['namespace'] [cluster, user, namespace] end
fetch_user_auth_options(user)
click to toggle source
# File lib/kubeclient/config.rb, line 148 def fetch_user_auth_options(user) options = {} if user.key?('token') options[:bearer_token] = user['token'] elsif user.key?('exec') exec_opts = user['exec'].dup exec_opts['command'] = ext_command_path(exec_opts['command']) if exec_opts['command'] options[:bearer_token] = Kubeclient::ExecCredentials.token(exec_opts) elsif user.key?('auth-provider') auth_provider = user['auth-provider'] options[:bearer_token] = case auth_provider['name'] when 'gcp' then Kubeclient::GoogleApplicationDefaultCredentials.token when 'oidc' then Kubeclient::OIDCAuthProvider.token(auth_provider['config']) end else %w[username password].each do |attr| options[attr.to_sym] = user[attr] if user.key?(attr) end end options end
fetch_user_cert_data(user)
click to toggle source
# File lib/kubeclient/config.rb, line 132 def fetch_user_cert_data(user) if user.key?('client-certificate') File.read(ext_file_path(user['client-certificate'])) elsif user.key?('client-certificate-data') Base64.decode64(user['client-certificate-data']) end end
fetch_user_key_data(user)
click to toggle source
# File lib/kubeclient/config.rb, line 140 def fetch_user_key_data(user) if user.key?('client-key') File.read(ext_file_path(user['client-key'])) elsif user.key?('client-key-data') Base64.decode64(user['client-key-data']) end end