Skip to content

Commit d6af17e

Browse files
matheuscscpmatheuscscp
authored
Merge pull request #1071 from fluxcd/fix-flux2-5677
auth: remove cluster host matching requirement
2 parents 2f71d01 + 1e27082 commit d6af17e

File tree

6 files changed

+41
-43
lines changed

6 files changed

+41
-43
lines changed

‎auth/aws/provider.go‎

Lines changed: 3 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -345,24 +345,10 @@ func (p Provider) NewRESTConfig(ctx context.Context, accessTokens []auth.Token,
345345
return nil, fmt.Errorf("failed to describe EKS cluster '%s': %w", cluster, err)
346346
}
347347

348-
// Compare specified address and address from the cluster resource.
349-
endpoint := *clusterResource.Cluster.Endpoint
350-
if host != "" {
351-
canonicalAddress, err := auth.ParseClusterAddress(host)
352-
if err != nil {
353-
return nil, fmt.Errorf("failed to parse specified cluster address '%s': %w", host, err)
354-
}
355-
canonicalEndpoint, err := auth.ParseClusterAddress(endpoint)
356-
if err != nil {
357-
return nil, fmt.Errorf("failed to parse EKS endpoint '%s': %w", endpoint, err)
358-
}
359-
if canonicalAddress != canonicalEndpoint {
360-
return nil, fmt.Errorf("EKS endpoint '%s' does not match specified address: '%s'", endpoint, host)
361-
}
362-
}
363-
364348
// Update host and CA with cluster details.
365-
host = endpoint
349+
if host == "" {
350+
host = *clusterResource.Cluster.Endpoint
351+
}
366352
if len(caData) == 0 {
367353
caData, err = base64.StdEncoding.DecodeString(*clusterResource.Cluster.CertificateAuthority.Data)
368354
if err != nil {

‎auth/aws/provider_test.go‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -421,10 +421,9 @@ func TestProvider_NewRESTConfig(t *testing.T) {
421421
err: `invalid EKS cluster ARN: ''. must match ^arn:aws[\w-]*:eks:([^:]{1,100}):[0-9]{1,30}:cluster/(.{1,200})$`,
422422
},
423423
{
424-
name: "cluster address mismatch",
424+
name: "valid EKS cluster with address override",
425425
cluster: "arn:aws:eks:us-east-1:123456789012:cluster/test-cluster",
426426
clusterAddress: "https://different-endpoint.eks.amazonaws.com:443",
427-
err: "EKS endpoint 'https://EXAMPLE1234567890123456789012345678.gr7.us-east-1.eks.amazonaws.com' does not match specified address: 'https://different-endpoint.eks.amazonaws.com:443'",
428427
},
429428
{
430429
name: "valid EKS cluster with custom STS endpoint",
@@ -486,7 +485,11 @@ func TestProvider_NewRESTConfig(t *testing.T) {
486485
if tt.err == "" {
487486
g.Expect(err).NotTo(HaveOccurred())
488487
g.Expect(restConfig).NotTo(BeNil())
489-
g.Expect(restConfig.Host).To(Equal("https://EXAMPLE1234567890123456789012345678.gr7.us-east-1.eks.amazonaws.com"))
488+
expectedHost := "https://EXAMPLE1234567890123456789012345678.gr7.us-east-1.eks.amazonaws.com"
489+
if tt.clusterAddress != "" {
490+
expectedHost = tt.clusterAddress
491+
}
492+
g.Expect(restConfig.Host).To(Equal(expectedHost))
490493
g.Expect(restConfig.BearerToken).To(Equal("k8s-aws-v1.aHR0cHM6Ly9zdHMudXMtZWFzdC0xLmFtYXpvbmF3cy5jb20vP0FjdGlvbj1HZXRDYWxsZXJJZGVudGl0eSZWZXJzaW9uPTIwMTEtMDYtMTUmWC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTY"))
491494
g.Expect(restConfig.CAData).To(Equal([]byte("-----BEGIN CERTIFICATE-----")))
492495
g.Expect(restConfig.ExpiresAt).To(BeTemporally(">", time.Now().Add(14*time.Minute)))

‎auth/azure/provider.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -365,12 +365,14 @@ func (p Provider) NewRESTConfig(ctx context.Context, accessTokens []auth.Token,
365365
if canonicalHost == "" {
366366
return nil, fmt.Errorf("no kubeconfig found for AKS cluster %s", cluster)
367367
}
368-
return nil, fmt.Errorf("AKS cluster %s does not match specified address '%s'. cluster addresses: [%s]",
368+
return nil, fmt.Errorf("no kubeconfig found for AKS cluster %s matching the specified address '%s'. cluster addresses: [%s]",
369369
cluster, o.ClusterAddress, strings.Join(addresses, ", "))
370370
}
371371

372372
// Update host and CA with cluster details.
373-
host = restConfig.Host
373+
if host == "" {
374+
host = restConfig.Host
375+
}
374376
if len(caData) == 0 {
375377
caData = restConfig.CAData
376378
}

‎auth/azure/provider_test.go‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -476,6 +476,24 @@ func TestProvider_NewRESTConfig(t *testing.T) {
476476
},
477477
},
478478
},
479+
{
480+
name: "valid AKS cluster with address override",
481+
cluster: "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/test-rg/providers/Microsoft.ContainerService/managedClusters/test-cluster",
482+
clusterAddress: "https://test-cluster-secondary-87654321.hcp.westus.azmk8s.io", // without :443, should still match and be preserved
483+
aadProfile: &armcontainerservice.ManagedClusterAADProfile{
484+
Managed: &[]bool{true}[0],
485+
},
486+
kubeconfigs: []*armcontainerservice.CredentialResult{
487+
{
488+
Name: &[]string{"clusterUser"}[0],
489+
Value: createKubeconfig("test-cluster", "https://test-cluster-12345678.hcp.eastus.azmk8s.io:443"),
490+
},
491+
{
492+
Name: &[]string{"clusterUser-secondary"}[0],
493+
Value: createKubeconfig("test-cluster-secondary", "https://test-cluster-secondary-87654321.hcp.westus.azmk8s.io:443"),
494+
},
495+
},
496+
},
479497
{
480498
name: "valid AKS cluster with CA",
481499
cluster: "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/test-rg/providers/Microsoft.ContainerService/managedClusters/test-cluster",
@@ -525,7 +543,7 @@ func TestProvider_NewRESTConfig(t *testing.T) {
525543
Value: createKubeconfig("test-cluster", "https://test-cluster-12345678.hcp.eastus.azmk8s.io:443"),
526544
},
527545
},
528-
err: "AKS cluster /subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/test-rg/providers/Microsoft.ContainerService/managedClusters/test-cluster does not match specified address 'https://different-cluster.hcp.eastus.azmk8s.io:443'. cluster addresses: ['https://test-cluster-12345678.hcp.eastus.azmk8s.io:443']",
546+
err: "no kubeconfig found for AKS cluster /subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/test-rg/providers/Microsoft.ContainerService/managedClusters/test-cluster matching the specified address 'https://different-cluster.hcp.eastus.azmk8s.io:443'. cluster addresses: ['https://test-cluster-12345678.hcp.eastus.azmk8s.io:443']",
529547
},
530548
{
531549
name: "cluster without AAD integration",

‎auth/gcp/provider.go‎

Lines changed: 3 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -243,24 +243,10 @@ func (p Provider) NewRESTConfig(ctx context.Context, accessTokens []auth.Token,
243243
return nil, fmt.Errorf("failed to describe GKE cluster '%s': %w", cluster, err)
244244
}
245245

246-
// Compare specified address and address from the cluster resource.
247-
endpoint := clusterResource.Endpoint
248-
if host != "" {
249-
canonicalAddress, err := auth.ParseClusterAddress(host)
250-
if err != nil {
251-
return nil, fmt.Errorf("failed to parse specified cluster address '%s': %w", host, err)
252-
}
253-
canonicalEndpoint, err := auth.ParseClusterAddress(endpoint)
254-
if err != nil {
255-
return nil, fmt.Errorf("failed to parse GKE endpoint '%s': %w", endpoint, err)
256-
}
257-
if canonicalAddress != canonicalEndpoint {
258-
return nil, fmt.Errorf("GKE endpoint '%s' does not match specified address: '%s'", endpoint, host)
259-
}
260-
}
261-
262246
// Update host and CA with cluster details.
263-
host = endpoint
247+
if host == "" {
248+
host = clusterResource.Endpoint
249+
}
264250
if len(caData) == 0 {
265251
caData, err = base64.StdEncoding.DecodeString(clusterResource.MasterAuth.ClusterCaCertificate)
266252
if err != nil {

‎auth/gcp/provider_test.go‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -371,14 +371,13 @@ func TestProvider_NewRESTConfig(t *testing.T) {
371371
endpoint: "https://203.0.113.10",
372372
},
373373
{
374-
name: "cluster address mismatch",
374+
name: "valid GKE cluster with address override",
375375
cluster: "projects/test-project/locations/us-central1/clusters/test-cluster",
376376
clusterAddress: "https://198.51.100.10:443",
377377
masterAuth: &container.MasterAuth{
378378
ClusterCaCertificate: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t",
379379
},
380380
endpoint: "https://203.0.113.10",
381-
err: "GKE endpoint 'https://203.0.113.10' does not match specified address: 'https://198.51.100.10:443'",
382381
},
383382
{
384383
name: "invalid cluster ID",
@@ -427,7 +426,11 @@ func TestProvider_NewRESTConfig(t *testing.T) {
427426
if tt.err == "" {
428427
g.Expect(err).NotTo(HaveOccurred())
429428
g.Expect(restConfig).NotTo(BeNil())
430-
g.Expect(restConfig.Host).To(Equal(tt.endpoint))
429+
expectedHost := tt.endpoint
430+
if tt.clusterAddress != "" {
431+
expectedHost = tt.clusterAddress
432+
}
433+
g.Expect(restConfig.Host).To(Equal(expectedHost))
431434
g.Expect(restConfig.BearerToken).To(Equal("access-token"))
432435
g.Expect(restConfig.CAData).To(Equal([]byte("-----BEGIN CERTIFICATE-----")))
433436
g.Expect(restConfig.ExpiresAt).To(Equal(tokenExpiry))

0 commit comments

Comments
 (0)