Skip to content
This repository has been archived by the owner on Nov 1, 2022. It is now read-only.

Honor KUBECONFIG env variable in fluxd #2741

Merged
merged 1 commit into from
Jan 14, 2020
Merged

Honor KUBECONFIG env variable in fluxd #2741

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 20 additions & 15 deletions cmd/fluxd/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,8 @@ const (
defaultGitSkipMessage = "\n\n[ci skip]"

RequireECR = "ecr"

k8sInClusterSecretsBaseDir = "/var/run/secrets/kubernetes.io"
)

var (
Expand Down Expand Up @@ -165,7 +167,7 @@ func main() {
registryRequire = fs.StringSlice("registry-require", nil, fmt.Sprintf(`exit with an error if auto-authentication with any of the given registries is not possible (possible values: {%s})`, strings.Join(RequireValues, ",")))

// k8s-secret backed ssh keyring configuration
k8sInCluster = fs.Bool("k8s-in-cluster", true, "set this to true if fluxd is deployed as a container inside Kubernetes")
_ = fs.Bool("k8s-in-cluster", true, "set this to true if fluxd is deployed as a container inside Kubernetes")
k8sSecretName = fs.String("k8s-secret-name", "flux-git-deploy", "name of the k8s secret used to store the private SSH key")
k8sSecretVolumeMountPath = fs.String("k8s-secret-volume-mount-path", "/etc/fluxd/ssh", "mount location of the k8s secret storing the private SSH key")
k8sSecretDataKey = fs.String("k8s-secret-data-key", "identity", "data key holding the private SSH key within the k8s secret")
Expand Down Expand Up @@ -197,6 +199,7 @@ func main() {
fs.MarkDeprecated("registry-cache-expiry", "no longer used; cache entries are expired adaptively according to how often they change")
fs.MarkDeprecated("k8s-namespace-whitelist", "changed to --k8s-allow-namespace, use that instead")
fs.MarkDeprecated("registry-poll-interval", "changed to --automation-interval, use that instead")
fs.MarkDeprecated("k8s-in-cluster", "no longer used")

var kubeConfig *string
{
Expand All @@ -207,6 +210,7 @@ func main() {
kubeConfig = fs.String("kube-config", "", "the absolute path of the k8s config file.")
}
}
fs.MarkDeprecated("kube-config", "please use the KUBECONFIG environment variable instead")

// Explicitly initialize klog to enable stderr logging,
// and parse our own flags.
Expand Down Expand Up @@ -385,20 +389,19 @@ func main() {

var restClientConfig *rest.Config
{
if *k8sInCluster {
logger.Log("msg", "using in cluster config to connect to the cluster")
restClientConfig, err = rest.InClusterConfig()
if err != nil {
logger.Log("err", err)
os.Exit(1)
}
} else {
var err error
if *kubeConfig != "" {
logger.Log("msg", fmt.Sprintf("using kube config: %q to connect to the cluster", *kubeConfig))
restClientConfig, err = clientcmd.BuildConfigFromFlags("", *kubeConfig)
if err != nil {
logger.Log("err", err)
os.Exit(1)
}
} else {
restClientConfig, err = clientcmd.NewNonInteractiveDeferredLoadingClientConfig(
clientcmd.NewDefaultClientConfigLoadingRules(),
&clientcmd.ConfigOverrides{},
).ClientConfig()
}
if err != nil {
logger.Log("err", err)
os.Exit(1)
}
restClientConfig.QPS = 50.0
restClientConfig.Burst = 100
Expand Down Expand Up @@ -447,8 +450,10 @@ func main() {
}
clusterVersion = "kubernetes-" + serverVersion.GitVersion

if *k8sInCluster && !httpGitURL {
namespace, err := ioutil.ReadFile("/var/run/secrets/kubernetes.io/serviceaccount/namespace")
fileinfo, err := os.Stat(k8sInClusterSecretsBaseDir)
isInCluster := err != nil && fileinfo.IsDir()
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think you meant isInCluster := err == nil && fileinfo.IsDir() ... curious how a change so broken could make it to master ?

Copy link
Contributor Author

@2opremio 2opremio Jan 17, 2020 •
edited by hiddeco
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Because you didn't take part in the review :)

Now seriously, my bad. This didn't get caught by the end to end tests because we generate our own ssh key there.. we should add one covering ssh key generation.

Thanks for reporting it and sorry for the inconvenience.

if isInCluster && !httpGitURL {
namespace, err := ioutil.ReadFile(filepath.Join(k8sInClusterSecretsBaseDir, "serviceaccount/namespace"))
if err != nil {
logger.Log("err", err)
os.Exit(1)
Expand Down