Create a service account and token for use in ~/.kube/config

lib/pharos/cluster_manager.rb

@@ -97,6 +97,7 @@ def apply_phases
 
       apply_phase(Phases::PullMasterImages, master_hosts, parallel: true)
       apply_phase(Phases::ConfigureMaster, master_hosts, parallel: false)
+      apply_phase(Phases::ConfigureServiceAccount, master_hosts, parallel: false)
       apply_phase(Phases::ConfigureClient, master_only, parallel: false)
       apply_phase(Phases::ReconfigureKubelet, config.hosts, parallel: true)
 

lib/pharos/kube/config.rb

@@ -18,20 +18,20 @@ def initialize(content = nil)
       def config
         @config ||= yaml_content || {
           'apiVersion' => 'v1',
+          'kind' => 'Config',
           'clusters' => [],
           'contexts' => [],
-          'current-context' => nil,
-          'kind' => 'Config',
+          'users' => [],
           'preferences' => {},
-          'users' => []
+          'current-context' => nil
         }
       end
       alias to_h config
 
       # Convert to YAML
       # @return [String]
       def dump
-        YAML.dump(config)
+        YAML.dump(JSON.parse(JSON.dump(config))) # dereference to get rid of *1 &1 etc in output
       end
       alias to_s dump
 

lib/pharos/phases/configure_master.rb

@@ -54,7 +54,6 @@ def install
 
       def install_kubeconfig
         transport.exec!('install -m 0700 -d ~/.kube')
-        transport.exec!('sudo install -o $USER -m 0600 /etc/kubernetes/admin.conf ~/.kube/config')
       end
 
       def reconfigure

lib/pharos/phases/configure_service_account.rb

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+module Pharos
+  module Phases
+    class ConfigureServiceAccount < Pharos::Phase
+      title "Configure 'pharos-admin' service account"
+
+      ADMIN_USER = 'pharos-admin'
+      KUBECONFIG_PARAM = '--kubeconfig=/etc/kubernetes/admin.conf'
+
+      def call
+        create_service_account
+        create_cluster_role_binding
+
+        config = build_config
+
+        if config_file.exist?
+          existing_config = Pharos::Kube::Config.new(config_file.read)
+          config << existing_config
+        end
+
+        config_file.write(config.dump, overwrite: true)
+        config_file.chmod('0600')
+
+        validate
+      end
+
+      def validate
+        transport.exec!('kubectl get -n kube-system serviceaccount/pharos-admin')
+      end
+
+      def config_file
+        @config_file ||= transport.file(File.join(home_kube_dir.path, 'config'))
+      end
+
+      def home_kube_dir
+        transport.file(transport.file('~/.kube').readlink(escape: false, canonicalize: true)).tap do |dir|
+          transport.exec!("mkdir '#{dir}' && chmod 0700 '#{dir}") unless dir.exist?
+        end
+      end
+
+      def create_service_account
+        transport.exec!("sudo kubectl get #{KUBECONFIG_PARAM} -n kube-system serviceaccount/#{ADMIN_USER} || sudo kubectl #{KUBECONFIG_PARAM} -n kube-system create serviceaccount #{ADMIN_USER}")
+      end
+
+      def create_cluster_role_binding
+        transport.exec!("sudo kubectl get #{KUBECONFIG_PARAM} clusterrolebinding pharos-cluster-admin || sudo kubectl create #{KUBECONFIG_PARAM} clusterrolebinding pharos-cluster-admin --clusterrole=cluster-admin --serviceaccount=kube-system:#{ADMIN_USER}")
+      end
+
+      # @return token_name [String]
+      def token_name
+        transport.exec!("sudo kubectl -n kube-system #{KUBECONFIG_PARAM} get serviceaccount/#{ADMIN_USER} -o jsonpath='{.secrets[0].name}'")
+      end
+
+      # @return token [String]
+      def token
+        @token ||= transport.exec!("sudo kubectl -n kube-system #{KUBECONFIG_PARAM} get secret #{token_name} -o jsonpath='{.data.token}' | base64 -d")
+      end
+
+      # @return [Pharos::Kube::Config]
+      def build_config
+        config = Pharos::Kube::Config.new
+        config.config['clusters'] << {
+          'cluster' => {
+            'certificate-authority-data' => certificate_authority_data,
+            'server' => "https://#{master_host.api_address}:6443"
+          },
+          'name' => @config.name
+        }
+
+        config.config['users'] << {
+          'user' => {
+            'token' => token
+          },
+          'name' => ADMIN_USER
+        }
+
+        config.config['contexts'] << {
+          'context' => {
+            'cluster' => @config.name,
+            'user' => ADMIN_USER
+          },
+          'name' => context_name
+        }
+
+        config.config['current-context'] = context_name
+
+        config
+      end
+
+      # @return [String]
+      def context_name
+        @context_name ||= "#{ADMIN_USER}@#{@config.name}"
+      end
+
+      # @return [String]
+      def certificate_authority_data
+        transport.exec!("sudo kubectl config view #{KUBECONFIG_PARAM} --raw --minify --flatten -o jsonpath='{.clusters[].cluster.certificate-authority-data}'")
+      end
+    end
+  end
+end

lib/pharos/transport/transport_file.rb

@@ -37,12 +37,13 @@ def dirname
       end
 
       # @param content [String]
+      # @param overwrite [Boolean] use force to overwrite target
       # @return [Pharos::Transport::Command::Result]
       # @raise [Pharos::ExecError]
-      def write(content)
+      def write(content, overwrite: false)
         tmp = temp_file_path.shellescape
         @client.exec!(
-          "cat > #{tmp} && (sudo mv #{tmp} #{escaped_path} || (rm #{tmp}; exit 1))",
+          "cat > #{tmp} && (sudo mv #{'-f ' if overwrite}#{tmp} #{escaped_path} || (rm -f #{tmp}; exit 1))",
           stdin: content
         )
       end
@@ -76,10 +77,11 @@ def with_existing
 
       # Moves the current file to target path
       # @param target [String]
+      # @param overwrite [Boolean] use force to overwrite target
       # @return [Pharos::Transport::Command::Result]
       # @raise [Pharos::ExecError]
-      def move(target)
-        @client.exec!("sudo mv #{@path} #{target.shellescape}")
+      def move(target, overwrite: false)
+        @client.exec!("sudo mv #{'-f ' if overwrite}#{@path} #{target.shellescape}")
       end
       alias mv move
 
@@ -100,10 +102,12 @@ def link(target)
         @client.exec!("sudo ln -s #{escaped_path} #{target.shellescape}")
       end
 
+      # @param escape [Boolean] escape file path
+      # @param canonicalize [Boolean] canonicalize by following every symlink in every component of the file name recursively; all but the last component must exist
       # @return [String, nil]
       # @raise [Pharos::ExecError]
-      def readlink
-        target = @client.exec!("readlink #{escaped_path} || echo").strip
+      def readlink(escape: true, canonicalize: false)
+        target = @client.exec!("readlink #{'-f ' if canonicalize}#{escape ? escaped_path : @path} || echo").strip
 
         return nil if target.empty?