Adding configs to allow you to run from local

**Why:**

* This makes development much easier allowing you to pass `--kubeconfig`
  to a local directory and have it listen to the remote apiserver
* Caveat! This needs to also be configured with the auth webhook so
  development requires an addressable server

cmd/aws-iam-authenticator/init.go

@@ -22,6 +22,7 @@ import (
 
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
 )
 
 var initCmd = &cobra.Command{
@@ -53,5 +54,18 @@ var initCmd = &cobra.Command{
 }
 
 func init() {
+	initCmd.Flags().String(
+		"hostname",
+		"localhost",
+		"Hostname that should be used for writing into the selfsigned certificates")
+	viper.BindPFlag("server.hostname", initCmd.Flags().Lookup("hostname"))
+
+	initCmd.Flags().StringP(
+		"bind",
+		"b",
+		"127.0.0.1",
+		"IP Address to bind the server to listen to. (should be a 127.0.0.1 or 0.0.0.0)")
+	viper.BindPFlag("server.bind", initCmd.Flags().Lookup("bind"))
+
 	rootCmd.AddCommand(initCmd)
 }

cmd/aws-iam-authenticator/root.go

@@ -80,9 +80,11 @@ func getConfig() (config.Config, error) {
 		ClusterID:                         viper.GetString("clusterID"),
 		ServerEC2DescribeInstancesRoleARN: viper.GetString("server.ec2DescribeInstancesRoleARN"),
 		LocalhostPort:                     viper.GetInt("server.port"),
+		Localhostname:                     viper.GetString("server.hostname"),
 		GenerateKubeconfigPath:            viper.GetString("server.generateKubeconfig"),
 		KubeconfigPregenerated:            viper.GetBool("server.kubeconfigPregenerated"),
 		StateDir:                          viper.GetString("server.stateDir"),
+		Bind:                              viper.GetString("server.bind"),
 	}
 	if err := viper.UnmarshalKey("server.mapRoles", &config.RoleMappings); err != nil {
 		return config, fmt.Errorf("invalid server role mappings: %v", err)

cmd/aws-iam-authenticator/server.go

@@ -61,5 +61,12 @@ func init() {
 		"State `directory` for generated certificate and private key (should be a hostPath mount).")
 	viper.BindPFlag("server.stateDir", serverCmd.Flags().Lookup("state-dir"))
 
+	serverCmd.Flags().StringP(
+		"bind",
+		"b",
+		"127.0.0.1",
+		"IP Address to bind the server to listen to. (should be a 127.0.0.1 or 0.0.0.0)")
+	viper.BindPFlag("server.bind", serverCmd.Flags().Lookup("bind"))
+
 	rootCmd.AddCommand(serverCmd)
 }

pkg/config/certs.go

@@ -41,6 +41,7 @@ func (c *Config) keyPath() string {
 	return filepath.Join(c.StateDir, keyFilename)
 }
 
+// GetOrCreateCertificate will create a certificate if it cannot find one based on the config
 func (c *Config) GetOrCreateCertificate() (*tls.Certificate, error) {
 	// first try to load the existing keypair
 	cert, err := c.LoadExistingCertificate()
@@ -53,7 +54,7 @@ func (c *Config) GetOrCreateCertificate() (*tls.Certificate, error) {
 	}
 
 	// generate a self-signed certificate and write out the certificate and private key
-	certBytes, keyBytes, err := selfSignCertificate()
+	certBytes, keyBytes, err := c.selfSignCertificate()
 	if err != nil {
 		return nil, err
 	}
@@ -76,6 +77,7 @@ func (c *Config) GetOrCreateCertificate() (*tls.Certificate, error) {
 	return &newCert, err
 }
 
+// LoadExistingCertificate will load certificates from a local path
 func (c *Config) LoadExistingCertificate() (*tls.Certificate, error) {
 
 	// if either file does not exist, we'll consider that not an error but
@@ -107,7 +109,7 @@ func dumpPEM(filename string, mode os.FileMode, blockType string, bytes []byte)
 	return pem.Encode(f, &pem.Block{Type: blockType, Bytes: bytes})
 }
 
-func selfSignCertificate() ([]byte, []byte, error) {
+func (c *Config) selfSignCertificate() ([]byte, []byte, error) {
 
 	// generate a new RSA-2048 keypair
 	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
@@ -137,8 +139,8 @@ func selfSignCertificate() ([]byte, []byte, error) {
 		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
 		BasicConstraintsValid: true,
 		IsCA:        true,
-		DNSNames:    []string{"localhost"},
-		IPAddresses: []net.IP{net.ParseIP("127.0.0.1")},
+		DNSNames:    []string{c.Localhostname},
+		IPAddresses: []net.IP{net.ParseIP(c.Bind)},
 	}
 
 	certBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &privateKey.PublicKey, privateKey)

pkg/config/types.go

@@ -71,6 +71,9 @@ type Config struct {
 	// (on localhost).
 	LocalhostPort int
 
+	// Localhostname is the hostname that the server will respond to.
+	Localhostname string
+
 	// GenerateKubeconfigPath is the output path where a generated webhook
 	// kubeconfig (for `--authentication-token-webhook-config-file`) will be
 	// stored.
@@ -98,4 +101,8 @@ type Config struct {
 	// If nil, defaults to using the IAM Role attached to the instance where aws-iam-authenticator is
 	// running.
 	ServerEC2DescribeInstancesRoleARN string
+
+	// Bind defines the hostname or IP Address to bind the HTTPS server to listen to. This is useful when creating
+	// a local server to handle the authentication request for development.
+	Bind string
 }

pkg/server/server.go

@@ -118,7 +118,7 @@ func (c *Server) Run() {
 	}
 
 	// we always listen on localhost (and run with host networking)
-	listenAddr := fmt.Sprintf("127.0.0.1:%d", c.LocalhostPort)
+	listenAddr := fmt.Sprintf("%s:%d", c.Bind, c.LocalhostPort)
 	listenURL := fmt.Sprintf("https://%s/authenticate", listenAddr)
 
 	cert, err := c.GetOrCreateCertificate()
@@ -342,6 +342,7 @@ func (h *handler) renderTemplate(template string, identity *token.Identity) (str
 	return template, nil
 }
 
+// EC2Provider configures a DNS resolving function for nodes
 type EC2Provider interface {
 	// Get a node name from instance ID
 	getPrivateDNSName(string) (string, error)