Class: Kubernetes::InClusterConfig

Inherits:
Object
  • Object
show all
Defined in:
lib/kubernetes/config/incluster_config.rb

Overview

The InClusterConfig class represents configuration for authn/authz in a Kubernetes cluster.

Constant Summary collapse

SERVICE_HOST_ENV_NAME =

rubocop:disable Metrics/LineLength

'KUBERNETES_SERVICE_HOST'.freeze
SERVICE_PORT_ENV_NAME = 
'KUBERNETES_SERVICE_PORT'.freeze
SERVICE_TOKEN_FILENAME = 
'/var/run/secrets/kubernetes.io/serviceaccount/token'.freeze
SERVICE_CA_CERT_FILENAME = 
'/var/run/secrets/kubernetes.io/serviceaccount/ca.crt'.freeze
TOKEN_REFRESH_PERIOD =

1 minute

60

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Instance Attribute Details

#host ⇒ Object

rubocop:enable Metrics/LineLength



31
32
33
 
# File 'lib/kubernetes/config/incluster_config.rb', line 31

def host
  @host
end

#port ⇒ Object

Returns the value of attribute port.



32
33
34
 
# File 'lib/kubernetes/config/incluster_config.rb', line 32

def port
  @port
end

#token ⇒ Object

Returns the value of attribute token.



33
34
35
 
# File 'lib/kubernetes/config/incluster_config.rb', line 33

def token
  @token
end

#token_expires_at ⇒ Object

Returns the value of attribute token_expires_at.



34
35
36
 
# File 'lib/kubernetes/config/incluster_config.rb', line 34

def token_expires_at
  @token_expires_at
end

Class Method Details

.in_cluster? ⇒ Boolean

Returns:

  • (Boolean) 


48
49
50
51
 
# File 'lib/kubernetes/config/incluster_config.rb', line 48

def self.in_cluster?
  File.exist?(SERVICE_TOKEN_FILENAME) &&
    File.exist?(SERVICE_CA_CERT_FILENAME)
end

Instance Method Details

#ca_cert ⇒ Object 



58
59
60
61
 
# File 'lib/kubernetes/config/incluster_config.rb', line 58

def ca_cert
  @ca_cert ||= SERVICE_CA_CERT_FILENAME
  @ca_cert
end

#configure(configuration, try_refresh_token: true) ⇒ Object

rubocop:disable Metrics/AbcSize



81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
 
# File 'lib/kubernetes/config/incluster_config.rb', line 81

def configure(configuration, try_refresh_token: true)
  validate
  load_token
  configuration.api_key['authorization'] = "Bearer #{token}"
  configuration.scheme = 'https'
  configuration.host = "#{host}:#{port}"
  configuration.ssl_ca_cert = ca_cert
  return unless try_refresh_token

  Configuration.instance_variable_set(:@in_cluster_config, self)
  Configuration.prepend(Module.new do
    # rubocop:disable Metrics/LineLength
    def api_key_with_prefix(identifier)
      in_cluster_config = self.class.instance_variable_get(:@in_cluster_config)
      if identifier == 'authorization' && @api_key.key?(identifier) && in_cluster_config.token_expires_at <= Time.now
        in_cluster_config.load_token
        @api_key[identifier] = 'Bearer ' + in_cluster_config.token
      end
      super identifier
    end
    # rubocop:enable Metrics/LineLength
  end)
end

#env ⇒ Object 



53
54
55
56
 
# File 'lib/kubernetes/config/incluster_config.rb', line 53

def env
  @env ||= ENV
  @env
end

#load_token ⇒ Object 



73
74
75
76
77
78
 
# File 'lib/kubernetes/config/incluster_config.rb', line 73

def load_token
  File.open(token_file) do |io|
    self.token = io.read.chomp
    self.token_expires_at = Time.now + token_refresh_period
  end
end

#token_file ⇒ Object 



63
64
65
66
 
# File 'lib/kubernetes/config/incluster_config.rb', line 63

def token_file
  @token_file ||= SERVICE_TOKEN_FILENAME
  @token_file
end

#token_refresh_period ⇒ Object 



68
69
70
71
 
# File 'lib/kubernetes/config/incluster_config.rb', line 68

def token_refresh_period
  @token_refresh_period ||= TOKEN_REFRESH_PERIOD
  @token_refresh_period
end

#validate ⇒ Object

Raises:



36
37
38
39
40
41
42
43
44
45
46
 
# File 'lib/kubernetes/config/incluster_config.rb', line 36

def validate
  unless (self.host = env[SERVICE_HOST_ENV_NAME]) &&
         (self.port = env[SERVICE_PORT_ENV_NAME])
    raise ConfigError, 'Service host/port is not set'
  end

  # rubocop:disable Metrics/LineLength
  raise ConfigError, 'Service token file does not exists' unless File.file?(token_file)
  raise ConfigError, 'Service token file does not exists' unless File.file?(ca_cert)
  # rubocop:enable Metrics/LineLength
end