mirror of
https://github.com/siderolabs/talos.git
synced 2025-08-23 07:31:13 +02:00
bbe2c53d29
This extracts admin kubeconfig generation out of bootkube, now based on Talos x509 library. On each API request for `kubeconfig`, config is generated on the fly and sent back on the wire. This fixes two issues: * any master node can now generate `kubeconfig` (worker nodes can do that too, but that should probably change in the future) * after upgrade-and-wipe the disk scenario, `osctl kubeconfig` still works Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
69 lines
1.5 KiB
Go
69 lines
1.5 KiB
Go
// This Source Code Form is subject to the terms of the Mozilla Public
|
|
// License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
|
|
package kubeconfig_test
|
|
|
|
import (
|
|
"bytes"
|
|
"fmt"
|
|
"net/url"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/suite"
|
|
"k8s.io/client-go/tools/clientcmd"
|
|
|
|
"github.com/talos-systems/talos/internal/pkg/kubeconfig"
|
|
"github.com/talos-systems/talos/pkg/crypto/x509"
|
|
)
|
|
|
|
type mockClusterConfig struct {
|
|
name string
|
|
ca *x509.PEMEncodedCertificateAndKey
|
|
}
|
|
|
|
func (c mockClusterConfig) Name() string {
|
|
return c.name
|
|
}
|
|
|
|
func (c mockClusterConfig) CA() *x509.PEMEncodedCertificateAndKey {
|
|
return c.ca
|
|
}
|
|
|
|
func (c mockClusterConfig) Endpoint() *url.URL {
|
|
u, _ := url.Parse("http://localhost:6443/api/") //nolint: errcheck
|
|
|
|
return u
|
|
}
|
|
|
|
type AdminSuite struct {
|
|
suite.Suite
|
|
}
|
|
|
|
func (suite *AdminSuite) TestGenerate() {
|
|
ca, err := x509.NewSelfSignedCertificateAuthority(x509.RSA(true))
|
|
suite.Require().NoError(err)
|
|
|
|
cfg := mockClusterConfig{
|
|
name: "talos1",
|
|
ca: &x509.PEMEncodedCertificateAndKey{
|
|
Crt: ca.CrtPEM,
|
|
Key: ca.KeyPEM,
|
|
},
|
|
}
|
|
|
|
var buf bytes.Buffer
|
|
|
|
suite.Require().NoError(kubeconfig.GenerateAdmin(cfg, &buf))
|
|
|
|
// verify config via k8s client
|
|
config, err := clientcmd.Load(buf.Bytes())
|
|
suite.Require().NoError(err)
|
|
|
|
suite.Assert().NoError(clientcmd.ConfirmUsable(*config, fmt.Sprintf("admin@%s", cfg.name)))
|
|
}
|
|
|
|
func TestAdminSuite(t *testing.T) {
|
|
suite.Run(t, new(AdminSuite))
|
|
}
|