Secrets mount

cmd/kubectl-k8ssandra/k8ssandra/k8ssandra.go

@@ -9,6 +9,7 @@ import (
  // "github.com/k8ssandra/k8ssandra-client/cmd/kubectl-k8ssandra/migrate"
  // "github.com/k8ssandra/k8ssandra-client/cmd/kubectl-k8ssandra/nodetool"
  "github.com/k8ssandra/k8ssandra-client/cmd/kubectl-k8ssandra/operate"
+ "github.com/k8ssandra/k8ssandra-client/cmd/kubectl-k8ssandra/secrets"
  "github.com/k8ssandra/k8ssandra-client/cmd/kubectl-k8ssandra/users"
 
  "github.com/spf13/cobra"
@@ -49,6 +50,7 @@ func NewCmd(streams genericclioptions.IOStreams) *cobra.Command {
  // cmd.AddCommand(migrate.NewCmd(streams))
  cmd.AddCommand(users.NewCmd(streams))
  // cmd.AddCommand(migrate.NewInstallCmd(streams))
+ cmd.AddCommand(secrets.NewMountCmd(streams))
 
  // cmd.Flags().BoolVar(&o.listNamespaces, "list", o.listNamespaces, "if true, print the list of all namespaces in the current KUBECONFIG")
  o.configFlags.AddFlags(cmd.Flags())

cmd/kubectl-k8ssandra/secrets/mount.go

@@ -0,0 +1,127 @@
+package secrets
+
+import (
+ "context"
+ "encoding/json"
+ "fmt"
+
+ "github.com/k8ssandra/k8ssandra-client/pkg/kubernetes"
+ "github.com/k8ssandra/k8ssandra-client/pkg/secrets"
+ secrets_webhook "github.com/k8ssandra/k8ssandra-operator/controllers/secrets-webhook"
+ "github.com/spf13/cobra"
+ corev1 "k8s.io/api/core/v1"
+ "k8s.io/apimachinery/pkg/types"
+ "k8s.io/cli-runtime/pkg/genericclioptions"
+)
+
+var (
+ mountExample = `
+ # mount k8s secrets to the local file system where <injections>
+ # takes the following format:
+ # '[{ "secretName": "<secret-name>", "path": "</path/to/secret>" }]'
+ %[1]s mount <injections>
+ `
+
+ errNoInjectionsDefined = fmt.Errorf("no injection string provided")
+)
+
+type options struct {
+ configFlags *genericclioptions.ConfigFlags
+ genericclioptions.IOStreams
+ injections string
+ inject []secrets_webhook.SecretInjection
+ namespace string
+ client kubernetes.NamespacedClient
+}
+
+func newOptions(streams genericclioptions.IOStreams) *options {
+ return &options{
+ configFlags: genericclioptions.NewConfigFlags(true),
+ IOStreams: streams,
+ }
+}
+
+func NewMountCmd(streams genericclioptions.IOStreams) *cobra.Command {
+ o := newOptions(streams)
+
+ cmd := &cobra.Command{
+ Use: "mount [injections]",
+ Short: "mount secrets to the local file system",
+ Example: fmt.Sprintf(mountExample, "kubectl k8ssandra"),
+ SilenceUsage: true,
+ RunE: func(c *cobra.Command, args []string) error {
+ if err := o.Complete(c, args); err != nil {
+ return err
+ }
+ if err := o.Validate(args); err != nil {
+ return err
+ }
+ if err := o.Run(); err != nil {
+ return err
+ }
+
+ return nil
+ },
+ }
+
+ flags := cmd.Flags()
+ flags.StringVarP(&o.injections, "injections", "i", "", "secrets to inject into filesystem")
+ o.configFlags.AddFlags(flags)
+ return cmd
+}
+
+// Complete parses the arguments and necessary flags to options
+func (c *options) Complete(cmd *cobra.Command, args []string) error {
+ var err error
+
+ c.namespace, _, err = c.configFlags.ToRawKubeConfigLoader().Namespace()
+ if err != nil {
+ return err
+ }
+
+ restConfig, err := c.configFlags.ToRESTConfig()
+ if err != nil {
+ return err
+ }
+
+ c.client, err = kubernetes.GetClientInNamespace(restConfig, c.namespace)
+ return err
+}
+
+// Validate ensures that all required arguments are provided and in the proper format
+func (c *options) Validate(args []string) error {
+ if len(args) < 1 {
+ return errNoInjectionsDefined
+ }
+
+ var si []secrets_webhook.SecretInjection
+ if err := json.Unmarshal([]byte(args[0]), &si); err != nil {
+ return err
+ }
+ c.inject = si
+ return nil
+}
+
+// Run mount retrieves the k8s secrets and writes the key/values to the local filesystem
+func (c *options) Run() error {
+ for _, injection := range c.inject {
+ secret := &corev1.Secret{}
+ err := c.client.Get(context.Background(), types.NamespacedName{Name: injection.SecretName}, secret)
+ if err != nil {
+ return err
+ }
+
+ err = secrets.CreateSecretsDirectory(injection.Path, injection.SecretName)
+ if err != nil {
+ return err
+ }
+
+ for k, v := range secret.Data {
+ err = secrets.WriteSecretsKeyValue(injection.Path, injection.SecretName, k, string(v))
+ if err != nil {
+ return err
+ }
+ }
+ }
+ return nil
+}

go.mod

@@ -6,19 +6,20 @@ require (
  github.com/charmbracelet/bubbles v0.14.0
  github.com/charmbracelet/bubbletea v0.23.1
  github.com/charmbracelet/lipgloss v0.5.0
- github.com/google/uuid v1.2.0
- github.com/k8ssandra/cass-operator v1.13.1
+ github.com/google/uuid v1.3.0
+ github.com/k8ssandra/cass-operator v1.15.0
+ github.com/k8ssandra/k8ssandra-operator v1.6.1
  github.com/spf13/cobra v1.4.0
  github.com/spf13/pflag v1.0.5
- github.com/stretchr/testify v1.7.2
+ github.com/stretchr/testify v1.8.0
  gopkg.in/yaml.v3 v3.0.1
  helm.sh/helm/v3 v3.9.4
- k8s.io/api v0.24.2
- k8s.io/apimachinery v0.24.2
+ k8s.io/api v0.25.3
+ k8s.io/apimachinery v0.25.3
  k8s.io/cli-runtime v0.24.2
- k8s.io/client-go v0.24.2
+ k8s.io/client-go v0.25.3
  k8s.io/kubectl v0.24.2
- sigs.k8s.io/controller-runtime v0.12.3
+ sigs.k8s.io/controller-runtime v0.13.0
 )
 
 require (
@@ -31,7 +32,7 @@ require (
  github.com/Azure/go-autorest/logger v0.2.1 // indirect
  github.com/Azure/go-autorest/tracing v0.6.0 // indirect
  github.com/BurntSushi/toml v1.0.0 // indirect
- github.com/Jeffail/gabs v1.4.0 // indirect
+ github.com/Jeffail/gabs/v2 v2.6.1 // indirect
  github.com/MakeNowJust/heredoc v0.0.0-20170808103936-bb23615498cd // indirect
  github.com/Masterminds/goutils v1.1.1 // indirect
  github.com/Masterminds/semver/v3 v3.1.1 // indirect
@@ -58,10 +59,11 @@ require (
  github.com/docker/go-units v0.4.0 // indirect
  github.com/emicklei/go-restful/v3 v3.8.0 // indirect
  github.com/evanphx/json-patch v4.12.0+incompatible // indirect
+ github.com/evanphx/json-patch/v5 v5.6.0 // indirect
  github.com/exponent-io/jsonpath v0.0.0-20151013193312-d6023ce2651d // indirect
  github.com/fatih/camelcase v1.0.0 // indirect
  github.com/fatih/color v1.13.0 // indirect
- github.com/fsnotify/fsnotify v1.5.1 // indirect
+ github.com/fsnotify/fsnotify v1.5.4 // indirect
  github.com/fvbommel/sortorder v1.0.1 // indirect
  github.com/go-errors/errors v1.0.1 // indirect
  github.com/go-gorp/gorp/v3 v3.0.2 // indirect
@@ -120,7 +122,7 @@ require (
  github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
  github.com/pkg/errors v0.9.1 // indirect
  github.com/pmezard/go-difflib v1.0.0 // indirect
- github.com/prometheus/client_golang v1.12.1 // indirect
+ github.com/prometheus/client_golang v1.12.2 // indirect
  github.com/prometheus/client_model v0.2.0 // indirect
  github.com/prometheus/common v0.32.1 // indirect
  github.com/prometheus/procfs v0.7.3 // indirect
@@ -136,23 +138,23 @@ require (
  github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca // indirect
  go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect
  golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e // indirect
- golang.org/x/net v0.0.0-20220722155237-a158d28d115b // indirect
+ golang.org/x/net v0.7.0 // indirect
  golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8 // indirect
- golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f // indirect
- golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab // indirect
- golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect
- golang.org/x/text v0.3.7 // indirect
- golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
+ golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4 // indirect
+ golang.org/x/sys v0.5.0 // indirect
+ golang.org/x/term v0.5.0 // indirect
+ golang.org/x/text v0.7.0 // indirect
+ golang.org/x/time v0.0.0-20220609170525-579cf78fd858 // indirect
  gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
  google.golang.org/appengine v1.6.7 // indirect
- google.golang.org/genproto v0.0.0-20220107163113-42d7afdf6368 // indirect
- google.golang.org/grpc v1.43.0 // indirect
+ google.golang.org/genproto v0.0.0-20220502173005-c8bf987b8c21 // indirect
+ google.golang.org/grpc v1.47.0 // indirect
  google.golang.org/protobuf v1.28.0 // indirect
  gopkg.in/inf.v0 v0.9.1 // indirect
  gopkg.in/yaml.v2 v2.4.0 // indirect
- k8s.io/apiextensions-apiserver v0.24.2 // indirect
- k8s.io/apiserver v0.24.2 // indirect
- k8s.io/component-base v0.24.2 // indirect
+ k8s.io/apiextensions-apiserver v0.25.3 // indirect
+ k8s.io/apiserver v0.25.3 // indirect
+ k8s.io/component-base v0.25.3 // indirect
  k8s.io/klog/v2 v2.70.1 // indirect
  k8s.io/kube-openapi v0.0.0-20220803162953-67bda5d908f1 // indirect
  k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed // indirect