Revert "Setup a kubelet TLS configuration (#1073)" (#1103)

This reverts commit 924c24f.

.gitignore

@@ -30,6 +30,3 @@ dogstatsd.yaml
 
 # Ignore debs from the root of the project.
 datadog-agent*_amd64.deb
-
-# Ignore pem created during the tests
-*.pem

pkg/config/config.go

@@ -142,13 +142,6 @@ func init() {
 	Datadog.SetDefault("kubernetes_http_kubelet_port", 10255)
 	Datadog.SetDefault("kubernetes_https_kubelet_port", 10250)
 
-	Datadog.SetDefault("kubelet_tls_verify", true)
-	Datadog.SetDefault("kubelet_client_ca", "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt")
-
-	Datadog.SetDefault("kubelet_auth_token_path", "")
-	Datadog.SetDefault("kubelet_client_crt", "")
-	Datadog.SetDefault("kubelet_client_key", "")
-
 	// Kube ApiServer
 	Datadog.SetDefault("kubernetes_kubeconfig_path", "")
 
@@ -198,8 +191,6 @@ func init() {
 	Datadog.BindEnv("kubernetes_kubelet_host")
 	Datadog.BindEnv("kubernetes_http_kubelet_port")
 	Datadog.BindEnv("kubernetes_https_kubelet_port")
-	Datadog.BindEnv("kubelet_client_crt")
-	Datadog.BindEnv("kubelet_client_key")
 
 	Datadog.BindEnv("forwarder_timeout")
 	Datadog.BindEnv("forwarder_retry_queue_max_size")

pkg/util/docker/docker_util.go

@@ -39,9 +39,7 @@ func (d *DockerUtil) ContainerList(ctx context.Context, options types.ContainerL
 
 // DockerUtil wraps interactions with a local docker API.
 type DockerUtil struct {
-	// used to setup the DockerUtil
-	initRetry retry.Retrier
-
+	retry.Retrier
 	sync.Mutex
 	cfg *Config
 	cli *client.Client

pkg/util/docker/global.go

@@ -37,15 +37,15 @@ var (
 func GetDockerUtil() (*DockerUtil, error) {
 	if globalDockerUtil == nil {
 		globalDockerUtil = &DockerUtil{}
-		globalDockerUtil.initRetry.SetupRetrier(&retry.Config{
+		globalDockerUtil.SetupRetrier(&retry.Config{
 			Name:          "dockerutil",
 			AttemptMethod: globalDockerUtil.init,
 			Strategy:      retry.RetryCount,
 			RetryCount:    10,
 			RetryDelay:    30 * time.Second,
 		})
 	}
-	err := globalDockerUtil.initRetry.TriggerRetry()
+	err := globalDockerUtil.TriggerRetry()
 	if err != nil {
 		log.Debugf("init error: %s", err)
 		return nil, err
@@ -58,7 +58,7 @@ func GetDockerUtil() (*DockerUtil, error) {
 // calls to the docker server will result in nil pointer exceptions.
 func EnableTestingMode() {
 	globalDockerUtil = &DockerUtil{}
-	globalDockerUtil.initRetry.SetupRetrier(&retry.Config{
+	globalDockerUtil.SetupRetrier(&retry.Config{
 		Name:     "dockerutil",
 		Strategy: retry.JustTesting,
 	})

pkg/util/kubernetes/apiserver/apiserver.go

@@ -37,9 +37,7 @@ const (
 // ApiClient provides authenticated access to the
 // apiserver endpoints. Use the shared instance via GetApiClient.
 type APIClient struct {
-	// used to setup the APIClient
-	initRetry retry.Retrier
-
+	retry.Retrier
 	client  *k8s.Client
 	timeout time.Duration
 }
@@ -51,15 +49,15 @@ func GetAPIClient() (*APIClient, error) {
 			// TODO: make it configurable if requested
 			timeout: 5 * time.Second,
 		}
-		globalApiClient.initRetry.SetupRetrier(&retry.Config{
+		globalApiClient.SetupRetrier(&retry.Config{
 			Name:          "apiserver",
 			AttemptMethod: globalApiClient.connect,
 			Strategy:      retry.RetryCount,
 			RetryCount:    10,
 			RetryDelay:    30 * time.Second,
 		})
 	}
-	err := globalApiClient.initRetry.TriggerRetry()
+	err := globalApiClient.TriggerRetry()
 	if err != nil {
 		log.Debugf("init error: %s", err)
 		return nil, err

pkg/util/kubernetes/auth.go

@@ -6,54 +6,22 @@
 package kubernetes
 
 import (
-	"crypto/tls"
-	"crypto/x509"
-	"fmt"
 	"io/ioutil"
-	"os"
+
+	log "github.com/cihub/seelog"
 )
 
-// Kubernetes constants
+// Kubelet constants
 const (
-	ServiceAccountPath      = "/var/run/secrets/kubernetes.io/serviceaccount"
-	ServiceAccountTokenPath = ServiceAccountPath + "/token"
+	AuthTokenPath = "/var/run/secrets/kubernetes.io/serviceaccount/token"
 )
 
-// IsServiceAccountTokenAvailable returns if a service account token is available on disk
-func IsServiceAccountTokenAvailable() bool {
-	_, err := os.Stat(ServiceAccountTokenPath)
-	return err == nil
-}
-
-// GetBearerToken reads the serviceaccount token
-func GetBearerToken(authTokenPath string) (string, error) {
-	token, err := ioutil.ReadFile(authTokenPath)
-	if err != nil {
-		return "", fmt.Errorf("could not read token from %s: %s", authTokenPath, err)
-	}
-	return fmt.Sprintf("bearer %s", token), nil
-}
-
-// GetCertificates loads the certificate and the private key
-func GetCertificates(certFilePath, keyFilePath string) ([]tls.Certificate, error) {
-	var certs []tls.Certificate
-	cert, err := tls.LoadX509KeyPair(certFilePath, keyFilePath)
-	if err != nil {
-		return certs, err
-	}
-	return append(certs, cert), nil
-}
-
-// GetCertificateAuthority loads the issuing certificate authority
-func GetCertificateAuthority(certPath string) (*x509.CertPool, error) {
-	caCert, err := ioutil.ReadFile(certPath)
+// GetAuthToken reads the serviceaccount token
+func GetAuthToken() string {
+	token, err := ioutil.ReadFile(AuthTokenPath)
 	if err != nil {
-		return nil, err
-	}
-	caCertPool := x509.NewCertPool()
-	ok := caCertPool.AppendCertsFromPEM(caCert)
-	if ok == false {
-		return caCertPool, fmt.Errorf("fail to load certificate authority: %s", certPath)
+		log.Errorf("Could not read token from %s: %s", AuthTokenPath, err)
+		return ""
 	}
-	return caCertPool, nil
+	return string(token)
 }