Skip to content

Commit 807db9d

Browse files
mlguerrero12mlguerrero12
authored
Merge pull request #577 from lubronzhan/topic/lubron/refresh_token
Run token-watcher.sh in the background to refresh kubeconfig
2 parents 5cf861c + 47db6d8 commit 807db9d

File tree

7 files changed

+154
-132
lines changed

7 files changed

+154
-132
lines changed

‎Dockerfile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,6 @@ COPY --from=0 /go/src/github.com/k8snetworkplumbingwg/whereabouts/bin/whereabout
1111
COPY --from=0 /go/src/github.com/k8snetworkplumbingwg/whereabouts/bin/ip-control-loop .
1212
COPY --from=0 /go/src/github.com/k8snetworkplumbingwg/whereabouts/bin/node-slice-controller .
1313
COPY script/install-cni.sh .
14+
COPY script/lib.sh .
15+
COPY script/token-watcher.sh .
1416
CMD ["/install-cni.sh"]

‎Dockerfile.arm64‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,6 @@ LABEL org.opencontainers.image.source=https://github.com/k8snetworkplumbingwg/wh
1414
COPY --from=0 /go/src/github.com/k8snetworkplumbingwg/whereabouts/bin/whereabouts .
1515
COPY --from=0 /go/src/github.com/k8snetworkplumbingwg/whereabouts/bin/ip-control-loop .
1616
COPY script/install-cni.sh .
17+
COPY script/lib.sh .
18+
COPY script/token-watcher.sh .
1719
CMD ["/install-cni.sh"]

‎Dockerfile.openshift‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,6 @@ COPY --from=builder /go/src/github.com/k8snetworkplumbingwg/whereabouts/bin/ip-c
1616

1717
LABEL org.opencontainers.image.source=https://github.com/k8snetworkplumbingwg/whereabouts
1818
LABEL io.k8s.display-name="Whereabouts CNI" \
19-
io.k8s.description="This is a component of OpenShift Container Platform and provides a cluster-wide IPAM CNI plugin." \
20-
io.openshift.tags="openshift" \
21-
maintainer="CTO Networking <[email protected]>"
19+
io.k8s.description="This is a component of OpenShift Container Platform and provides a cluster-wide IPAM CNI plugin." \
20+
io.openshift.tags="openshift" \
21+
maintainer="CTO Networking <[email protected]>"

‎doc/crds/daemonset-install.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -118,8 +118,9 @@ spec:
118118
command: [ "/bin/sh" ]
119119
args:
120120
- -c
121-
- >
122-
SLEEP=false /install-cni.sh &&
121+
- |
122+
SLEEP=false source /install-cni.sh
123+
/token-watcher.sh &
123124
/ip-control-loop -log-level debug
124125
image: ghcr.io/k8snetworkplumbingwg/whereabouts:latest
125126
env:

‎script/install-cni.sh‎

Lines changed: 4 additions & 127 deletions
Original file line numberDiff line numberDiff line change
@@ -10,150 +10,27 @@ set -u -e
1010
#
1111
#SPDX-License-Identifier: Apache-2.0
1212

13-
CNI_BIN_DIR=${CNI_BIN_DIR:-"/host/opt/cni/bin/"}
14-
WHEREABOUTS_KUBECONFIG_FILE_HOST=${WHEREABOUTS_KUBECONFIG_FILE_HOST:-"/etc/cni/net.d/whereabouts.d/whereabouts.kubeconfig"}
15-
CNI_CONF_DIR=${CNI_CONF_DIR:-"/host/etc/cni/net.d"}
16-
WHEREABOUTS_RECONCILER_CRON=${WHEREABOUTS_RECONCILER_CRON:-30 4 * * *}
17-
18-
# Make a whereabouts.d directory (for our kubeconfig)
19-
20-
mkdir -p $CNI_CONF_DIR/whereabouts.d
21-
WHEREABOUTS_KUBECONFIG=$CNI_CONF_DIR/whereabouts.d/whereabouts.kubeconfig
22-
WHEREABOUTS_CONF_FILE=$CNI_CONF_DIR/whereabouts.d/whereabouts.conf
23-
WHEREABOUTS_KUBECONFIG_LITERAL=$(echo "$WHEREABOUTS_KUBECONFIG" | sed -e s'|/host||')
24-
25-
# ------------------------------- Generate a "kube-config"
26-
SERVICE_ACCOUNT_PATH=/var/run/secrets/kubernetes.io/serviceaccount
27-
KUBE_CA_FILE=${KUBE_CA_FILE:-$SERVICE_ACCOUNT_PATH/ca.crt}
28-
SERVICE_ACCOUNT_TOKEN=$(cat $SERVICE_ACCOUNT_PATH/token)
29-
SERVICE_ACCOUNT_TOKEN_PATH=$SERVICE_ACCOUNT_PATH/token
30-
SKIP_TLS_VERIFY=${SKIP_TLS_VERIFY:-false}
31-
32-
LAST_SERVICEACCOUNT_MD5SUM=""
33-
LAST_KUBE_CA_FILE_MD5SUM=""
13+
source lib.sh
3414

3515
# Setup our logging routines
3616

37-
function log()
38-
{
39-
echo "$(date --iso-8601=seconds) ${1}"
40-
}
41-
42-
function error()
43-
{
44-
log "ERR: {$1}"
45-
}
46-
47-
function warn()
48-
{
49-
log "WARN: {$1}"
50-
}
51-
52-
53-
function generateKubeConfig {
54-
# Check if we're running as a k8s pod.
55-
if [ -f "$SERVICE_ACCOUNT_PATH/token" ]; then
56-
# We're running as a k8d pod - expect some variables.
57-
if [ -z ${KUBERNETES_SERVICE_HOST} ]; then
58-
error "KUBERNETES_SERVICE_HOST not set"; exit 1;
59-
fi
60-
if [ -z ${KUBERNETES_SERVICE_PORT} ]; then
61-
error "KUBERNETES_SERVICE_PORT not set"; exit 1;
62-
fi
63-
64-
if [ "$SKIP_TLS_VERIFY" == "true" ]; then
65-
TLS_CFG="insecure-skip-tls-verify: true"
66-
elif [ -f "$KUBE_CA_FILE" ]; then
67-
TLS_CFG="certificate-authority-data: $(cat $KUBE_CA_FILE | base64 | tr -d '\n')"
68-
fi
69-
70-
# Kubernetes service address must be wrapped if it is IPv6 address
71-
KUBERNETES_SERVICE_HOST_WRAP=$KUBERNETES_SERVICE_HOST
72-
if [ "$KUBERNETES_SERVICE_HOST_WRAP" != "${KUBERNETES_SERVICE_HOST_WRAP#*:[0-9a-fA-F]}" ]; then
73-
KUBERNETES_SERVICE_HOST_WRAP=\[$KUBERNETES_SERVICE_HOST_WRAP\]
74-
fi
75-
76-
# Write a kubeconfig file for the CNI plugin. Do this
77-
# to skip TLS verification for now. We should eventually support
78-
# writing more complete kubeconfig files. This is only used
79-
# if the provided CNI network config references it.
80-
touch $WHEREABOUTS_KUBECONFIG
81-
chmod ${KUBECONFIG_MODE:-600} $WHEREABOUTS_KUBECONFIG
82-
cat > $WHEREABOUTS_KUBECONFIG <<EOF
83-
# Kubeconfig file for the Whereabouts CNI plugin.
84-
apiVersion: v1
85-
kind: Config
86-
clusters:
87-
- name: local
88-
cluster:
89-
server: ${KUBERNETES_SERVICE_PROTOCOL:-https}://${KUBERNETES_SERVICE_HOST_WRAP}:${KUBERNETES_SERVICE_PORT}
90-
$TLS_CFG
91-
users:
92-
- name: whereabouts
93-
user:
94-
token: "${SERVICE_ACCOUNT_TOKEN}"
95-
contexts:
96-
- name: whereabouts-context
97-
context:
98-
cluster: local
99-
user: whereabouts
100-
namespace: ${WHEREABOUTS_NAMESPACE}
101-
current-context: whereabouts-context
102-
EOF
103-
104-
else
105-
warn "Doesn't look like we're running in a kubernetes environment (no serviceaccount token)"
106-
fi
107-
108-
}
10917

18+
# -------------------Generate a "kube-config"
11019
generateKubeConfig
111-
20+
export LAST_SERVICEACCOUNT_MD5SUM="$(get_token_md5sum)"
21+
export LAST_KUBE_CA_FILE_MD5SUM="$(get_ca_file_md5sum)"
11222
# ------------------ end Generate a "kube-config"
11323

11424
# ----------------- Generate a whereabouts conf
115-
116-
function generateWhereaboutsConf {
117-
118-
touch $WHEREABOUTS_CONF_FILE
119-
chmod ${KUBECONFIG_MODE:-600} $WHEREABOUTS_CONF_FILE
120-
cat > $WHEREABOUTS_CONF_FILE <<EOF
121-
{
122-
"datastore": "kubernetes",
123-
"kubernetes": {
124-
"kubeconfig": "${WHEREABOUTS_KUBECONFIG_LITERAL}"
125-
},
126-
"reconciler_cron_expression": "${WHEREABOUTS_RECONCILER_CRON}"
127-
}
128-
EOF
129-
130-
}
131-
13225
generateWhereaboutsConf
133-
13426
# ---------------- End generate a whereabouts conf
13527

13628

137-
13829
# copy whereabouts to the cni bin dir
13930
cp -f /whereabouts $CNI_BIN_DIR
14031

14132
# ---------------------- end generate a "kube-config".
14233

143-
# enter sleep/watch loop
144-
145-
while true; do
146-
# Check the md5sum of the service account token and ca.
147-
svcaccountsum=$(md5sum $SERVICE_ACCOUNT_TOKEN_PATH | awk '{print $1}')
148-
casum=$(md5sum $KUBE_CA_FILE | awk '{print $1}')
149-
if [ "$svcaccountsum" != "$LAST_SERVICEACCOUNT_MD5SUM" ] || [ "$casum" != "$LAST_KUBE_CA_FILE_MD5SUM" ]; then
150-
# log "Detected service account or CA file change, regenerating kubeconfig..."
151-
generateKubeConfig
152-
fi
153-
154-
sleep 1
155-
done
156-
15734
# Unless told otherwise, sleep forever.
15835
# This prevents Kubernetes from restarting the pod repeatedly.
15936
should_sleep=${SLEEP:-"true"}

‎script/lib.sh‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
CNI_BIN_DIR=${CNI_BIN_DIR:-"/host/opt/cni/bin/"}
2+
WHEREABOUTS_KUBECONFIG_FILE_HOST=${WHEREABOUTS_KUBECONFIG_FILE_HOST:-"/etc/cni/net.d/whereabouts.d/whereabouts.kubeconfig"}
3+
CNI_CONF_DIR=${CNI_CONF_DIR:-"/host/etc/cni/net.d"}
4+
WHEREABOUTS_RECONCILER_CRON=${WHEREABOUTS_RECONCILER_CRON:-30 4 * * *}
5+
6+
# Make a whereabouts.d directory (for our kubeconfig)
7+
8+
mkdir -p $CNI_CONF_DIR/whereabouts.d
9+
WHEREABOUTS_KUBECONFIG=$CNI_CONF_DIR/whereabouts.d/whereabouts.kubeconfig
10+
WHEREABOUTS_CONF_FILE=$CNI_CONF_DIR/whereabouts.d/whereabouts.conf
11+
WHEREABOUTS_KUBECONFIG_LITERAL=$(echo "$WHEREABOUTS_KUBECONFIG" | sed -e s'|/host||')
12+
13+
SERVICE_ACCOUNT_PATH=/var/run/secrets/kubernetes.io/serviceaccount
14+
KUBE_CA_FILE=${KUBE_CA_FILE:-$SERVICE_ACCOUNT_PATH/ca.crt}
15+
SERVICE_ACCOUNT_TOKEN=$(cat $SERVICE_ACCOUNT_PATH/token)
16+
SERVICE_ACCOUNT_TOKEN_PATH=$SERVICE_ACCOUNT_PATH/token
17+
SKIP_TLS_VERIFY=${SKIP_TLS_VERIFY:-false}
18+
19+
20+
function log()
21+
{
22+
echo "$(date -Iseconds) ${1}"
23+
}
24+
25+
function error()
26+
{
27+
log "ERR: {$1}"
28+
}
29+
30+
function warn()
31+
{
32+
log "WARN: {$1}"
33+
}
34+
35+
36+
function generateKubeConfig {
37+
# Check if we're running as a k8s pod.
38+
if [ -f "$SERVICE_ACCOUNT_PATH/token" ]; then
39+
# We're running as a k8d pod - expect some variables.
40+
if [ -z ${KUBERNETES_SERVICE_HOST} ]; then
41+
error "KUBERNETES_SERVICE_HOST not set"; exit 1;
42+
fi
43+
if [ -z ${KUBERNETES_SERVICE_PORT} ]; then
44+
error "KUBERNETES_SERVICE_PORT not set"; exit 1;
45+
fi
46+
47+
if [ "$SKIP_TLS_VERIFY" == "true" ]; then
48+
TLS_CFG="insecure-skip-tls-verify: true"
49+
elif [ -f "$KUBE_CA_FILE" ]; then
50+
TLS_CFG="certificate-authority-data: $(cat $KUBE_CA_FILE | base64 | tr -d '\n')"
51+
fi
52+
53+
# Kubernetes service address must be wrapped if it is IPv6 address
54+
KUBERNETES_SERVICE_HOST_WRAP=$KUBERNETES_SERVICE_HOST
55+
if [ "$KUBERNETES_SERVICE_HOST_WRAP" != "${KUBERNETES_SERVICE_HOST_WRAP#*:[0-9a-fA-F]}" ]; then
56+
KUBERNETES_SERVICE_HOST_WRAP=\[$KUBERNETES_SERVICE_HOST_WRAP\]
57+
fi
58+
59+
# Write a kubeconfig file for the CNI plugin. Do this
60+
# to skip TLS verification for now. We should eventually support
61+
# writing more complete kubeconfig files. This is only used
62+
# if the provided CNI network config references it.
63+
touch $WHEREABOUTS_KUBECONFIG
64+
chmod ${KUBECONFIG_MODE:-600} $WHEREABOUTS_KUBECONFIG
65+
cat > $WHEREABOUTS_KUBECONFIG <<EOF
66+
# Kubeconfig file for the Whereabouts CNI plugin.
67+
apiVersion: v1
68+
kind: Config
69+
clusters:
70+
- name: local
71+
cluster:
72+
server: ${KUBERNETES_SERVICE_PROTOCOL:-https}://${KUBERNETES_SERVICE_HOST_WRAP}:${KUBERNETES_SERVICE_PORT}
73+
$TLS_CFG
74+
users:
75+
- name: whereabouts
76+
user:
77+
token: "${SERVICE_ACCOUNT_TOKEN}"
78+
contexts:
79+
- name: whereabouts-context
80+
context:
81+
cluster: local
82+
user: whereabouts
83+
namespace: ${WHEREABOUTS_NAMESPACE}
84+
current-context: whereabouts-context
85+
EOF
86+
87+
else
88+
warn "Doesn't look like we're running in a kubernetes environment (no serviceaccount token)"
89+
fi
90+
91+
}
92+
93+
function generateWhereaboutsConf {
94+
95+
touch $WHEREABOUTS_CONF_FILE
96+
chmod ${KUBECONFIG_MODE:-600} $WHEREABOUTS_CONF_FILE
97+
cat > $WHEREABOUTS_CONF_FILE <<EOF
98+
{
99+
"datastore": "kubernetes",
100+
"kubernetes": {
101+
"kubeconfig": "${WHEREABOUTS_KUBECONFIG_LITERAL}"
102+
},
103+
"reconciler_cron_expression": "${WHEREABOUTS_RECONCILER_CRON}"
104+
}
105+
EOF
106+
107+
}
108+
109+
function get_token_md5sum {
110+
md5sum "$SERVICE_ACCOUNT_TOKEN_PATH" | awk '{print $1}'
111+
}
112+
113+
function get_ca_file_md5sum {
114+
if [ ! -f "$KUBE_CA_FILE" ]; then
115+
echo ""
116+
return
117+
fi
118+
md5sum "$KUBE_CA_FILE" | awk '{print $1}'
119+
}

‎script/token-watcher.sh‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/bin/sh
2+
3+
set -u -e
4+
5+
source lib.sh
6+
7+
echo "Sleep and Watching for service account token and CA file changes..."
8+
# enter sleep/watch loop
9+
while true; do
10+
# Check the md5sum of the service account token and ca.
11+
svcaccountsum="$(get_token_md5sum)"
12+
casum="$(get_ca_file_md5sum)"
13+
if [ "$svcaccountsum" != "$LAST_SERVICEACCOUNT_MD5SUM" ] || ! [ "$SKIP_TLS_VERIFY" == "true" ] && [ "$casum" != "$LAST_KUBE_CA_FILE_MD5SUM" ]; then
14+
log "Detected service account or CA file change, regenerating kubeconfig..."
15+
generateKubeConfig
16+
LAST_SERVICEACCOUNT_MD5SUM="$svcaccountsum"
17+
LAST_KUBE_CA_FILE_MD5SUM="$casum"
18+
fi
19+
20+
sleep 1s
21+
done

0 commit comments

Comments
 (0)