class Kubeclient::ExecCredentials

An exec-based client auth provide kubernetes.io/docs/reference/access-authn-authz/authentication/#configuration Inspired by github.com/kubernetes/client-go/blob/master/plugin/pkg/client/auth/exec/exec.go

Public Class Methods

run(opts) click to toggle source
# File lib/kubeclient/exec_credentials.rb, line 9
def run(opts)
  require 'open3'
  require 'json'

  raise ArgumentError, 'exec options are required' if opts.nil?

  cmd = opts['command']
  args = opts['args']
  env = map_env(opts['env'])

  # Validate exec options
  validate_opts(opts)

  out, err, st = Open3.capture3(env, cmd, *args)

  raise "exec command failed: #{err}" unless st.success?

  creds = JSON.parse(out)
  validate_credentials(opts, creds)
  creds['status']
end

Private Class Methods

map_env(env) click to toggle source

Transform name/value pairs to hash

# File lib/kubeclient/exec_credentials.rb, line 82
def map_env(env)
  return {} unless env

  Hash[env.map { |e| [e['name'], e['value']] }]
end
validate_client_credentials_status(status) click to toggle source
# File lib/kubeclient/exec_credentials.rb, line 37
def validate_client_credentials_status(status)
  has_client_cert_data = status.key?('clientCertificateData')
  has_client_key_data = status.key?('clientKeyData')

  if has_client_cert_data && !has_client_key_data
    raise 'exec plugin didn\'t return client key data'
  end

  if !has_client_cert_data && has_client_key_data
    raise 'exec plugin didn\'t return client certificate data'
  end

  has_client_cert_data && has_client_key_data
end
validate_credentials(opts, creds) click to toggle source
# File lib/kubeclient/exec_credentials.rb, line 67
def validate_credentials(opts, creds)
  # out should have ExecCredential structure
  raise 'invalid credentials' if creds.nil?

  # Verify apiVersion?
  api_version = opts['apiVersion']
  if api_version && api_version != creds['apiVersion']
    raise "exec plugin is configured to use API version #{api_version}, " \
      "plugin returned version #{creds['apiVersion']}"
  end

  validate_credentials_status(creds['status'])
end
validate_credentials_status(status) click to toggle source
# File lib/kubeclient/exec_credentials.rb, line 52
def validate_credentials_status(status)
  raise 'exec plugin didn\'t return a status field' if status.nil?

  has_client_credentials = validate_client_credentials_status(status)
  has_token = status.key?('token')

  if has_client_credentials && has_token
    raise 'exec plugin returned both token and client data'
  end

  return if has_client_credentials || has_token

  raise 'exec plugin didn\'t return a token or client data' unless has_token
end
validate_opts(opts) click to toggle source
# File lib/kubeclient/exec_credentials.rb, line 33
def validate_opts(opts)
  raise KeyError, 'exec command is required' unless opts['command']
end