@@ -13,18 +13,15 @@ import (
1313 "github.com/aws/aws-sdk-go-v2/config"
1414 "github.com/prometheus/client_golang/prometheus/promhttp"
1515 log "github.com/sirupsen/logrus"
16+ "github.com/szuecs/kube-static-egress-controller/auth"
1617 "github.com/szuecs/kube-static-egress-controller/controller"
1718 "github.com/szuecs/kube-static-egress-controller/kube"
1819 "github.com/szuecs/kube-static-egress-controller/provider"
1920 "github.com/szuecs/kube-static-egress-controller/provider/aws"
2021 "github.com/szuecs/kube-static-egress-controller/provider/noop"
21- "github.com/zalando-build/credentials-loader/platformiam"
22- "golang.org/x/oauth2"
2322 v1 "k8s.io/api/core/v1"
2423 "k8s.io/client-go/kubernetes"
25- "k8s.io/client-go/rest"
2624 "k8s.io/client-go/tools/clientcmd"
27- "k8s.io/client-go/transport"
2825)
2926
3027const (
@@ -59,6 +56,9 @@ type Config struct {
5956 Namespace string
6057 ResyncInterval time.Duration
6158 Address string
59+ // required by Platform credentials
60+ UsePlatformCredentials bool
61+ CredentialsDir string
6262}
6363
6464var defaultConfig = & Config {
@@ -124,6 +124,8 @@ Example:
124124 // Flags related to Kubernetes
125125 app .Flag ("master" , "The Kubernetes API server to connect to (default: auto-detect)" ).Default (defaultConfig .Master ).StringVar (& cfg .Master )
126126 app .Flag ("kubeconfig" , "Retrieve target cluster configuration from a Kubernetes configuration file (default: auto-detect)" ).Default (defaultConfig .KubeConfig ).StringVar (& cfg .KubeConfig )
127+ app .Flag ("use-platform-credentials" , "Use Platform credentials (default: disabled)" ).BoolVar (& cfg .UsePlatformCredentials )
128+ app .Flag ("credentials-dir" , "Directory where the Platform credentials are stored" ).Default (auth .DefaultCredentialsDir ).Envar (auth .CredentialsDirEnvar ).StringVar (& cfg .CredentialsDir )
127129 app .Flag ("provider" , "Provider implementing static egress <noop|aws> (default: auto-detect)" ).Default (defaultConfig .Provider ).StringVar (& cfg .Provider )
128130 app .Flag ("cluster-id" , "Cluster ID used define ownership of Egress stack." ).StringVar (& cfg .ClusterID )
129131 app .Flag ("cluster-id-tag-prefix" , "Prefix for the Cluster ID tag set on the Egress stack." ).Default (defaultConfig .ClusterIDTagPrefix ).StringVar (& cfg .ClusterIDTagPrefix )
@@ -173,7 +175,7 @@ func main() {
173175 }
174176
175177 configsChan := make (chan provider.EgressConfig )
176- cmWatcher , err := kube .NewConfigMapWatcher (newKubeClient (), cfg .Namespace , "egress=static" , configsChan )
178+ cmWatcher , err := kube .NewConfigMapWatcher (newKubeClient (cfg ), cfg .Namespace , "egress=static" , configsChan )
177179 if err != nil {
178180 log .Fatalf ("Failed to setup ConfigMap watcher: %v" , err )
179181 }
@@ -192,7 +194,7 @@ func main() {
192194}
193195
194196// newKubeClient returns a new Kubernetes client with the default config.
195- func newKubeClient () kubernetes.Interface {
197+ func newKubeClient (cfg * Config ) kubernetes.Interface {
196198 var kubeconfig string
197199 if _ , err := os .Stat (clientcmd .RecommendedHomeFile ); err == nil {
198200 kubeconfig = clientcmd .RecommendedHomeFile
@@ -203,12 +205,11 @@ func newKubeClient() kubernetes.Interface {
203205 log .Fatalf ("build config failed: %v" , err )
204206 }
205207
206- platformIAMTokenSource := platformiam .NewTokenSource ("kube-static-egress-controller" , DefaultCredentialsDir )
207-
208- platformIAMRestConfig := rest .AnonymousClientConfig (config )
209- platformIAMRestConfig .Wrap (TokenInjector (platformIAMTokenSource ))
208+ if cfg .UsePlatformCredentials {
209+ config .Wrap (auth .TokenInjector (auth .NewPlatformCredentialsTokenSource (name , cfg .CredentialsDir )))
210+ }
210211
211- client , err := kubernetes .NewForConfig (platformIAMRestConfig )
212+ client , err := kubernetes .NewForConfig (config )
212213 if err != nil {
213214 log .Fatalf ("initialize kubernetes client failed: %v" , err )
214215 }
@@ -247,33 +248,3 @@ func serve(ctx context.Context, address string, handler http.Handler) {
247248 }
248249 }
249250}
250-
251- const (
252- DefaultCredentialsDir = "/meta/credentials"
253-
254- // CredentialsDirEnvar = "CREDENTIALS_DIR"
255- )
256-
257- type kubeTokenInjector struct {
258- tokenSource oauth2.TokenSource
259- next http.RoundTripper
260- }
261-
262- func TokenInjector (tokenSource oauth2.TokenSource ) transport.WrapperFunc {
263- return func (rt http.RoundTripper ) http.RoundTripper {
264- return & kubeTokenInjector {
265- tokenSource : tokenSource ,
266- next : rt ,
267- }
268- }
269- }
270-
271- func (i * kubeTokenInjector ) RoundTrip (request * http.Request ) (* http.Response , error ) {
272- token , err := i .tokenSource .Token ()
273- if err != nil {
274- return nil , err
275- }
276-
277- request .Header .Set ("Authorization" , "Bearer " + token .AccessToken )
278- return i .next .RoundTrip (request )
279- }
0 commit comments