Skip to content

Commit 5147ef3

Browse files
medyaghmedyagh
authored
Merge pull request #10730 from sharifelgamal/auth-gce
auto-detect gce and do not enable gcp auth addon
2 parents e1c872a + 86080e5 commit 5147ef3

File tree

14 files changed

+274
-155
lines changed

14 files changed

+274
-155
lines changed

Diff for: ‎cmd/minikube/cmd/config/enable.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ var addonsEnableCmd = &cobra.Command{
4242
addon := args[0]
4343
// replace heapster as metrics-server because heapster is deprecated
4444
if addon == "heapster" {
45-
out.Styled(style.Waiting, "enable metrics-server addon instead of heapster addon because heapster is deprecated")
45+
out.Styled(style.Waiting, "using metrics-server addon, heapster is deprecated")
4646
addon = "metrics-server"
4747
}
4848
viper.Set(config.AddonImages, images)
@@ -76,5 +76,6 @@ var (
7676
func init() {
7777
addonsEnableCmd.Flags().StringVar(&images, "images", "", "Images used by this addon. Separated by commas.")
7878
addonsEnableCmd.Flags().StringVar(&registries, "registries", "", "Registries used by this addon. Separated by commas.")
79+
addonsEnableCmd.Flags().BoolVar(&addons.Force, "force", false, "If true, will perform potentially dangerous operations. Use with discretion.")
7980
AddonsCmd.AddCommand(addonsEnableCmd)
8081
}

Diff for: ‎cmd/minikube/cmd/root.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ import (
3535
"k8s.io/minikube/pkg/minikube/audit"
3636
"k8s.io/minikube/pkg/minikube/config"
3737
"k8s.io/minikube/pkg/minikube/constants"
38-
"k8s.io/minikube/pkg/minikube/driver"
38+
"k8s.io/minikube/pkg/minikube/detect"
3939
"k8s.io/minikube/pkg/minikube/exit"
4040
"k8s.io/minikube/pkg/minikube/localpath"
4141
"k8s.io/minikube/pkg/minikube/out"
@@ -80,7 +80,7 @@ func Execute() {
8080
defer audit.Log(time.Now())
8181

8282
// Check whether this is a windows binary (.exe) running inisde WSL.
83-
if runtime.GOOS == "windows" && driver.IsMicrosoftWSL() {
83+
if runtime.GOOS == "windows" && detect.IsMicrosoftWSL() {
8484
var found = false
8585
for _, a := range os.Args {
8686
if a == "--force" {

Diff for: ‎pkg/addons/addons.go

+2-115
Original file line numberDiff line numberDiff line change
@@ -38,20 +38,17 @@ import (
3838
"k8s.io/minikube/pkg/minikube/constants"
3939
"k8s.io/minikube/pkg/minikube/driver"
4040
"k8s.io/minikube/pkg/minikube/exit"
41-
"k8s.io/minikube/pkg/minikube/kubeconfig"
4241
"k8s.io/minikube/pkg/minikube/machine"
43-
"k8s.io/minikube/pkg/minikube/mustload"
4442
"k8s.io/minikube/pkg/minikube/out"
4543
"k8s.io/minikube/pkg/minikube/out/register"
4644
"k8s.io/minikube/pkg/minikube/reason"
47-
"k8s.io/minikube/pkg/minikube/storageclass"
4845
"k8s.io/minikube/pkg/minikube/style"
4946
"k8s.io/minikube/pkg/minikube/sysinit"
5047
"k8s.io/minikube/pkg/util/retry"
5148
)
5249

53-
// defaultStorageClassProvisioner is the name of the default storage class provisioner
54-
const defaultStorageClassProvisioner = "standard"
50+
// Force is used to override checks for addons
51+
var Force bool = false
5552

5653
// RunCallbacks runs all actions associated to an addon, but does not set it (thread-safe)
5754
func RunCallbacks(cc *config.ClusterConfig, name string, value string) error {
@@ -174,7 +171,6 @@ https://github.com/kubernetes/minikube/issues/7332`, out.V{"driver_name": cc.Dri
174171
}
175172
}
176173

177-
// TODO(r2d4): config package should not reference API, pull this out
178174
api, err := machine.NewAPIClient()
179175
if err != nil {
180176
return errors.Wrap(err, "machine client")
@@ -279,75 +275,10 @@ func enableOrDisableAddonInternal(cc *config.ClusterConfig, addon *assets.Addon,
279275
return retry.Expo(apply, 250*time.Millisecond, 2*time.Minute)
280276
}
281277

282-
// enableOrDisableStorageClasses enables or disables storage classes
283-
func enableOrDisableStorageClasses(cc *config.ClusterConfig, name string, val string) error {
284-
klog.Infof("enableOrDisableStorageClasses %s=%v on %q", name, val, cc.Name)
285-
enable, err := strconv.ParseBool(val)
286-
if err != nil {
287-
return errors.Wrap(err, "Error parsing boolean")
288-
}
289-
290-
class := defaultStorageClassProvisioner
291-
if name == "storage-provisioner-gluster" {
292-
class = "glusterfile"
293-
}
294-
295-
api, err := machine.NewAPIClient()
296-
if err != nil {
297-
return errors.Wrap(err, "machine client")
298-
}
299-
defer api.Close()
300-
301-
cp, err := config.PrimaryControlPlane(cc)
302-
if err != nil {
303-
return errors.Wrap(err, "getting control plane")
304-
}
305-
if !machine.IsRunning(api, config.MachineName(*cc, cp)) {
306-
klog.Warningf("%q is not running, writing %s=%v to disk and skipping enablement", config.MachineName(*cc, cp), name, val)
307-
return EnableOrDisableAddon(cc, name, val)
308-
}
309-
310-
storagev1, err := storageclass.GetStoragev1(cc.Name)
311-
if err != nil {
312-
return errors.Wrapf(err, "Error getting storagev1 interface %v ", err)
313-
}
314-
315-
if enable {
316-
// Only StorageClass for 'name' should be marked as default
317-
err = storageclass.SetDefaultStorageClass(storagev1, class)
318-
if err != nil {
319-
return errors.Wrapf(err, "Error making %s the default storage class", class)
320-
}
321-
} else {
322-
// Unset the StorageClass as default
323-
err := storageclass.DisableDefaultStorageClass(storagev1, class)
324-
if err != nil {
325-
return errors.Wrapf(err, "Error disabling %s as the default storage class", class)
326-
}
327-
}
328-
329-
return EnableOrDisableAddon(cc, name, val)
330-
}
331-
332278
func verifyAddonStatus(cc *config.ClusterConfig, name string, val string) error {
333279
return verifyAddonStatusInternal(cc, name, val, "kube-system")
334280
}
335281

336-
func verifyGCPAuthAddon(cc *config.ClusterConfig, name string, val string) error {
337-
enable, err := strconv.ParseBool(val)
338-
if err != nil {
339-
return errors.Wrapf(err, "parsing bool: %s", name)
340-
}
341-
err = verifyAddonStatusInternal(cc, name, val, "gcp-auth")
342-
343-
if enable && err == nil {
344-
out.Styled(style.Notice, "Your GCP credentials will now be mounted into every pod created in the {{.name}} cluster.", out.V{"name": cc.Name})
345-
out.Styled(style.Notice, "If you don't want your credentials mounted into a specific pod, add a label with the `gcp-auth-skip-secret` key to your pod configuration.")
346-
}
347-
348-
return err
349-
}
350-
351282
func verifyAddonStatusInternal(cc *config.ClusterConfig, name string, val string, ns string) error {
352283
klog.Infof("Verifying addon %s=%s in %q", name, val, cc.Name)
353284
enable, err := strconv.ParseBool(val)
@@ -444,47 +375,3 @@ func Start(wg *sync.WaitGroup, cc *config.ClusterConfig, toEnable map[string]boo
444375
}
445376
}
446377
}
447-
448-
// enableOrDisableAutoPause enables the service after the config was copied by generic enble
449-
func enableOrDisableAutoPause(cc *config.ClusterConfig, name string, val string) error {
450-
enable, err := strconv.ParseBool(val)
451-
if err != nil {
452-
return errors.Wrapf(err, "parsing bool: %s", name)
453-
}
454-
out.Infof("auto-pause addon is an alpha feature and still in early development. Please file issues to help us make it better.")
455-
out.Infof("https://github.com/kubernetes/minikube/labels/co%2Fauto-pause")
456-
457-
if !driver.IsKIC(cc.Driver) || runtime.GOARCH != "amd64" {
458-
exit.Message(reason.Usage, `auto-pause currently is only supported on docker driver/docker runtime/amd64. Track progress of others here: https://github.com/kubernetes/minikube/issues/10601`)
459-
}
460-
co := mustload.Running(cc.Name)
461-
if enable {
462-
if err := sysinit.New(co.CP.Runner).EnableNow("auto-pause"); err != nil {
463-
klog.ErrorS(err, "failed to enable", "service", "auto-pause")
464-
}
465-
}
466-
467-
port := co.CP.Port // api server port
468-
if enable { // if enable then need to calculate the forwarded port
469-
port = constants.AutoPauseProxyPort
470-
if driver.NeedsPortForward(cc.Driver) {
471-
port, err = oci.ForwardedPort(cc.Driver, cc.Name, port)
472-
if err != nil {
473-
klog.ErrorS(err, "failed to get forwarded port for", "auto-pause port", port)
474-
}
475-
}
476-
}
477-
478-
updated, err := kubeconfig.UpdateEndpoint(cc.Name, co.CP.Hostname, port, kubeconfig.PathFromEnv(), kubeconfig.NewExtension())
479-
if err != nil {
480-
klog.ErrorS(err, "failed to update kubeconfig", "auto-pause proxy endpoint")
481-
return err
482-
}
483-
if updated {
484-
klog.Infof("%s context has been updated to point to auto-pause proxy %s:%s", cc.Name, co.CP.Hostname, co.CP.Port)
485-
} else {
486-
klog.Info("no need to update kube-context for auto-pause proxy")
487-
}
488-
489-
return nil
490-
}

Diff for: ‎pkg/addons/addons_autopause.go

+79
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
/*
2+
Copyright 2021 The Kubernetes Authors All rights reserved.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package addons
18+
19+
import (
20+
"runtime"
21+
"strconv"
22+
23+
"github.com/pkg/errors"
24+
"k8s.io/klog/v2"
25+
"k8s.io/minikube/pkg/drivers/kic/oci"
26+
"k8s.io/minikube/pkg/minikube/config"
27+
"k8s.io/minikube/pkg/minikube/constants"
28+
"k8s.io/minikube/pkg/minikube/driver"
29+
"k8s.io/minikube/pkg/minikube/exit"
30+
"k8s.io/minikube/pkg/minikube/kubeconfig"
31+
"k8s.io/minikube/pkg/minikube/mustload"
32+
"k8s.io/minikube/pkg/minikube/out"
33+
"k8s.io/minikube/pkg/minikube/reason"
34+
"k8s.io/minikube/pkg/minikube/sysinit"
35+
)
36+
37+
// enableOrDisableAutoPause enables the service after the config was copied by generic enble
38+
func enableOrDisableAutoPause(cc *config.ClusterConfig, name string, val string) error {
39+
enable, err := strconv.ParseBool(val)
40+
if err != nil {
41+
return errors.Wrapf(err, "parsing bool: %s", name)
42+
}
43+
out.Infof("auto-pause addon is an alpha feature and still in early development. Please file issues to help us make it better.")
44+
out.Infof("https://github.com/kubernetes/minikube/labels/co%2Fauto-pause")
45+
46+
if !driver.IsKIC(cc.Driver) || runtime.GOARCH != "amd64" {
47+
exit.Message(reason.Usage, `auto-pause currently is only supported on docker driver/docker runtime/amd64. Track progress of others here: https://github.com/kubernetes/minikube/issues/10601`)
48+
}
49+
co := mustload.Running(cc.Name)
50+
if enable {
51+
if err := sysinit.New(co.CP.Runner).EnableNow("auto-pause"); err != nil {
52+
klog.ErrorS(err, "failed to enable", "service", "auto-pause")
53+
}
54+
}
55+
56+
port := co.CP.Port // api server port
57+
if enable { // if enable then need to calculate the forwarded port
58+
port = constants.AutoPauseProxyPort
59+
if driver.NeedsPortForward(cc.Driver) {
60+
port, err = oci.ForwardedPort(cc.Driver, cc.Name, port)
61+
if err != nil {
62+
klog.ErrorS(err, "failed to get forwarded port for", "auto-pause port", port)
63+
}
64+
}
65+
}
66+
67+
updated, err := kubeconfig.UpdateEndpoint(cc.Name, co.CP.Hostname, port, kubeconfig.PathFromEnv(), kubeconfig.NewExtension())
68+
if err != nil {
69+
klog.ErrorS(err, "failed to update kubeconfig", "auto-pause proxy endpoint")
70+
return err
71+
}
72+
if updated {
73+
klog.Infof("%s context has been updated to point to auto-pause proxy %s:%s", cc.Name, co.CP.Hostname, co.CP.Port)
74+
} else {
75+
klog.Info("no need to update kube-context for auto-pause proxy")
76+
}
77+
78+
return nil
79+
}

Diff for: ‎pkg/addons/gcpauth/enable.go renamed to ‎pkg/addons/addons_gcpauth.go

+30-23
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright 2020 The Kubernetes Authors All rights reserved.
2+
Copyright 2021 The Kubernetes Authors All rights reserved.
33
44
Licensed under the Apache License, Version 2.0 (the "License");
55
you may not use this file except in compliance with the License.
@@ -14,21 +14,20 @@ See the License for the specific language governing permissions and
1414
limitations under the License.
1515
*/
1616

17-
package gcpauth
17+
package addons
1818

1919
import (
2020
"bytes"
2121
"context"
22-
"io/ioutil"
2322
"os"
2423
"os/exec"
25-
"path"
2624
"strconv"
2725

2826
"github.com/pkg/errors"
2927
"golang.org/x/oauth2/google"
3028
"k8s.io/minikube/pkg/minikube/assets"
3129
"k8s.io/minikube/pkg/minikube/config"
30+
"k8s.io/minikube/pkg/minikube/detect"
3231
"k8s.io/minikube/pkg/minikube/exit"
3332
"k8s.io/minikube/pkg/minikube/mustload"
3433
"k8s.io/minikube/pkg/minikube/out"
@@ -41,19 +40,23 @@ const (
4140
projectPath = "/var/lib/minikube/google_cloud_project"
4241
)
4342

44-
// EnableOrDisable enables or disables the metadata addon depending on the val parameter
45-
func EnableOrDisable(cfg *config.ClusterConfig, name string, val string) error {
43+
// enableOrDisableGCPAuth enables or disables the gcp-auth addon depending on the val parameter
44+
func enableOrDisableGCPAuth(cfg *config.ClusterConfig, name string, val string) error {
4645
enable, err := strconv.ParseBool(val)
4746
if err != nil {
4847
return errors.Wrapf(err, "parsing bool: %s", name)
4948
}
5049
if enable {
51-
return enableAddon(cfg)
50+
return enableAddonGCPAuth(cfg)
5251
}
53-
return disableAddon(cfg)
52+
return disableAddonGCPAuth(cfg)
5453
}
5554

56-
func enableAddon(cfg *config.ClusterConfig) error {
55+
func enableAddonGCPAuth(cfg *config.ClusterConfig) error {
56+
if !Force && detect.IsOnGCE() {
57+
exit.Message(reason.InternalCredsNotFound, "It seems that you are running in GCE, which means authentication should work without the GCP Auth addon. If you would still like to authenticate using a credentials file, use the --force flag.")
58+
}
59+
5760
// Grab command runner from running cluster
5861
cc := mustload.Running(cfg.Name)
5962
r := cc.CP.Runner
@@ -65,20 +68,9 @@ func enableAddon(cfg *config.ClusterConfig) error {
6568
exit.Message(reason.InternalCredsNotFound, "Could not find any GCP credentials. Either run `gcloud auth application-default login` or set the GOOGLE_APPLICATION_CREDENTIALS environment variable to the path of your credentials file.")
6669
}
6770

71+
// Don't mount in empty credentials file
6872
if creds.JSON == nil {
69-
// Cloud Shell sends credential files to an unusual location, let's check that location
70-
// For example, CLOUDSDK_CONFIG=/tmp/tmp.cflmvysoQE
71-
if e := os.Getenv("CLOUDSDK_CONFIG"); e != "" {
72-
credFile := path.Join(e, "application_default_credentials.json")
73-
b, err := ioutil.ReadFile(credFile)
74-
if err != nil {
75-
exit.Message(reason.InternalCredsNotFound, "Could not find any GCP credentials. Either run `gcloud auth application-default login` or set the GOOGLE_APPLICATION_CREDENTIALS environment variable to the path of your credentials file.")
76-
}
77-
creds.JSON = b
78-
} else {
79-
// We don't currently support authentication through the metadata server
80-
exit.Message(reason.InternalCredsNotFound, "Could not find any GCP credentials. Either run `gcloud auth application-default login` or set the GOOGLE_APPLICATION_CREDENTIALS environment variable to the path of your credentials file.")
81-
}
73+
exit.Message(reason.InternalCredsNotFound, "Could not find any GCP credentials. Either run `gcloud auth application-default login` or set the GOOGLE_APPLICATION_CREDENTIALS environment variable to the path of your credentials file.")
8274
}
8375

8476
f := assets.NewMemoryAssetTarget(creds.JSON, credentialsPath, "0444")
@@ -114,7 +106,7 @@ or set the GOOGLE_CLOUD_PROJECT environment variable.`)
114106
return r.Copy(emptyFile)
115107
}
116108

117-
func disableAddon(cfg *config.ClusterConfig) error {
109+
func disableAddonGCPAuth(cfg *config.ClusterConfig) error {
118110
// Grab command runner from running cluster
119111
cc := mustload.Running(cfg.Name)
120112
r := cc.CP.Runner
@@ -134,3 +126,18 @@ func disableAddon(cfg *config.ClusterConfig) error {
134126

135127
return nil
136128
}
129+
130+
func verifyGCPAuthAddon(cc *config.ClusterConfig, name string, val string) error {
131+
enable, err := strconv.ParseBool(val)
132+
if err != nil {
133+
return errors.Wrapf(err, "parsing bool: %s", name)
134+
}
135+
err = verifyAddonStatusInternal(cc, name, val, "gcp-auth")
136+
137+
if enable && err == nil {
138+
out.Styled(style.Notice, "Your GCP credentials will now be mounted into every pod created in the {{.name}} cluster.", out.V{"name": cc.Name})
139+
out.Styled(style.Notice, "If you don't want your credentials mounted into a specific pod, add a label with the `gcp-auth-skip-secret` key to your pod configuration.")
140+
}
141+
142+
return err
143+
}

0 commit comments

Comments
 (0)