kruby 1.35.0

data/lib/kubernetes/config/incluster_config.rb

@@ -0,0 +1,106 @@
+# Copyright 2017 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require 'kubernetes/configuration'
+require 'kubernetes/config/error'
+
+module Kubernetes
+  # The InClusterConfig class represents configuration for authn/authz in a
+  # Kubernetes cluster.
+  class InClusterConfig
+    # rubocop:disable Metrics/LineLength
+    SERVICE_HOST_ENV_NAME = 'KUBERNETES_SERVICE_HOST'.freeze
+    SERVICE_PORT_ENV_NAME = 'KUBERNETES_SERVICE_PORT'.freeze
+    SERVICE_TOKEN_FILENAME = '/var/run/secrets/kubernetes.io/serviceaccount/token'.freeze
+    SERVICE_CA_CERT_FILENAME = '/var/run/secrets/kubernetes.io/serviceaccount/ca.crt'.freeze
+    TOKEN_REFRESH_PERIOD = 60 # 1 minute
+    # rubocop:enable Metrics/LineLength
+
+    attr_accessor :host
+    attr_accessor :port
+    attr_accessor :token
+    attr_accessor :token_expires_at
+
+    def validate
+      unless (self.host = env[SERVICE_HOST_ENV_NAME]) &&
+             (self.port = env[SERVICE_PORT_ENV_NAME])
+        raise ConfigError, 'Service host/port is not set'
+      end
+
+      # rubocop:disable Metrics/LineLength
+      raise ConfigError, 'Service token file does not exists' unless File.file?(token_file)
+      raise ConfigError, 'Service token file does not exists' unless File.file?(ca_cert)
+      # rubocop:enable Metrics/LineLength
+    end
+
+    def self.in_cluster?
+      File.exist?(SERVICE_TOKEN_FILENAME) &&
+        File.exist?(SERVICE_CA_CERT_FILENAME)
+    end
+
+    def env
+      @env ||= ENV
+      @env
+    end
+
+    def ca_cert
+      @ca_cert ||= SERVICE_CA_CERT_FILENAME
+      @ca_cert
+    end
+
+    def token_file
+      @token_file ||= SERVICE_TOKEN_FILENAME
+      @token_file
+    end
+
+    def token_refresh_period
+      @token_refresh_period ||= TOKEN_REFRESH_PERIOD
+      @token_refresh_period
+    end
+
+    def load_token
+      File.open(token_file) do |io|
+        self.token = io.read.chomp
+        self.token_expires_at = Time.now + token_refresh_period
+      end
+    end
+
+    # rubocop:disable Metrics/AbcSize
+    def configure(configuration, try_refresh_token: true)
+      validate
+      load_token
+      configuration.api_key['authorization'] = "Bearer #{token}"
+      configuration.scheme = 'https'
+      configuration.host = "#{host}:#{port}"
+      configuration.ssl_ca_cert = ca_cert
+      return unless try_refresh_token
+
+      Configuration.instance_variable_set(:@in_cluster_config, self)
+      Configuration.prepend(Module.new do
+        # rubocop:disable Metrics/LineLength
+        def api_key_with_prefix(identifier)
+          in_cluster_config = self.class.instance_variable_get(:@in_cluster_config)
+          if identifier == 'authorization' && @api_key.key?(identifier) && in_cluster_config.token_expires_at <= Time.now
+            in_cluster_config.load_token
+            @api_key[identifier] = 'Bearer ' + in_cluster_config.token
+          end
+          super identifier
+        end
+        # rubocop:enable Metrics/LineLength
+      end)
+    end
+    # rubocop:enable Metrics/AbcSize
+  end
+end

data/lib/kubernetes/config/kube_config.rb

@@ -0,0 +1,171 @@
+# Copyright 2017 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'base64'
+require 'yaml'
+require 'tempfile'
+require 'uri'
+
+require 'kubernetes/api_client'
+require 'kubernetes/configuration'
+require 'kubernetes/config/error'
+require 'kubernetes/utils'
+
+module Kubernetes
+  # rubocop:disable ClassLength
+  # The KubeConfig class represents configuration based on a YAML
+  # representation.
+  class KubeConfig
+    KUBE_CONFIG_DEFAULT_LOCATION = File.expand_path('~/.kube/config')
+    AUTH_KEY = 'authorization'.freeze
+
+    class << self
+      def list_context_names(config_file = KUBE_CONFIG_DEFAULT_LOCATION)
+        config = new(config_file)
+        config.list_context_names
+      end
+    end
+
+    attr_accessor :path
+    attr_writer :config
+
+    def initialize(path = nil, config_hash = nil)
+      @path = path
+      @config = config_hash
+    end
+
+    def base_path
+      File.dirname(path)
+    end
+
+    def config
+      @config ||= File.open(path) do |io|
+        ::YAML.safe_load(io.read)
+      end
+    end
+
+    def configure(configuration, context_name = nil)
+      context = context_name ? find_context(context_name) : current_context
+      return unless context
+
+      user = context['user'] || {}
+      cluster = context['cluster'] || {}
+
+      configuration.tap do |c|
+        c.api_key[AUTH_KEY] = user[AUTH_KEY] if user[AUTH_KEY]
+
+        init_server(cluster, user, c)
+      end
+    end
+
+    def init_server(cluster, user, config)
+      return unless (server = cluster['server'])
+
+      server = URI.parse(server)
+      config.scheme = server.scheme
+      host = "#{server.host}:#{server.port}"
+      host = "#{server.userinfo}@#{host}" if server.userinfo
+      config.host = host
+      config.base_path = server.path
+
+      return unless server.scheme == 'https'
+
+      setup_ssl(cluster, user, config)
+    end
+
+    def setup_ssl(cluster, user, config)
+      # rubocop:disable DoubleNegation
+      config.verify_ssl = !!cluster['verify-ssl']
+      config.verify_ssl_host = !!cluster['verify-ssl']
+      # rubocop:enable DoubleNegation
+
+      config.ssl_ca_cert = cluster['certificate-authority']
+      config.cert_file = user['client-certificate']
+      config.key_file = user['client-key']
+    end
+
+    def find_cluster(name)
+      find_by_name(config['clusters'], 'cluster', name).tap do |cluster|
+        Kubernetes.create_temp_file_and_set(cluster, 'certificate-authority')
+        cluster['verify_ssl'] = !cluster['insecure-skip-tls-verify']
+      end
+    end
+
+    def find_user(name)
+      find_by_name(config['users'], 'user', name).tap do |user|
+        next unless user
+
+        Kubernetes.create_temp_file_and_set(user, 'client-certificate')
+        Kubernetes.create_temp_file_and_set(user, 'client-key')
+        load_token_file(user)
+        setup_auth(user)
+      end
+    end
+
+    def load_token_file(user)
+      # If tokenFile is specified, then set token
+      return unless !user['token'] && user['tokenFile']
+
+      File.open(user['tokenFile']) do |io|
+        user['token'] = io.read.chomp
+      end
+    end
+
+    # rubocop:disable AbcSize
+    def setup_auth(user)
+      # Convert token field to http header
+      if user['token']
+        user['authorization'] = "Bearer #{user['token']}"
+      elsif user['username'] && user['password']
+        user_pass = "#{user['username']}:#{user['password']}"
+        user['authorization'] = "Basic #{Base64.strict_encode64(user_pass)}"
+      elsif user['auth-provider'] && user['auth-provider']['name'] == 'azure'
+        token = user['auth-provider']['config']['access-token']
+        user['authorization'] = "Bearer #{token}"
+      end
+    end
+    # rubocop:enable AbcSize
+
+    def list_context_names
+      config['contexts'].map { |e| e['name'] }
+    end
+
+    def find_context(name)
+      find_by_name(config['contexts'], 'context', name).tap do |context|
+        if context['cluster']
+          context['cluster'] = find_cluster(context['cluster'])
+        end
+        if context['user'] && !context['user'].empty?
+          context['user'] = find_user(context['user'])
+        end
+      end
+    end
+
+    def current_context
+      return unless config
+
+      find_context(config['current-context'])
+    end
+
+    protected
+
+    def find_by_name(list, key, name)
+      obj = list.find { |item| item['name'] == name }
+      raise ConfigError, "#{key}: #{name} not found" unless obj
+
+      obj[key].dup if obj[key]
+    end
+  end
+  # rubocop:enable ClassLength
+end

data/lib/kubernetes/configuration.rb

@@ -0,0 +1,277 @@
+=begin
+#Kubernetes
+
+#No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
+
+The version of the OpenAPI document: release-1.35
+
+Generated by: https://openapi-generator.tech
+OpenAPI Generator version: 5.1.0
+
+=end
+
+module Kubernetes
+  class Configuration
+    # Defines url scheme
+    attr_accessor :scheme
+
+    # Defines url host
+    attr_accessor :host
+
+    # Defines url base path
+    attr_accessor :base_path
+
+    # Define server configuration index
+    attr_accessor :server_index
+
+    # Define server operation configuration index
+    attr_accessor :server_operation_index
+
+    # Default server variables
+    attr_accessor :server_variables
+
+    # Default server operation variables
+    attr_accessor :server_operation_variables
+
+    # Defines API keys used with API Key authentications.
+    #
+    # @return [Hash] key: parameter name, value: parameter value (API key)
+    #
+    # @example parameter name is "api_key", API key is "xxx" (e.g. "api_key=xxx" in query string)
+    #   config.api_key['api_key'] = 'xxx'
+    attr_accessor :api_key
+
+    # Defines API key prefixes used with API Key authentications.
+    #
+    # @return [Hash] key: parameter name, value: API key prefix
+    #
+    # @example parameter name is "Authorization", API key prefix is "Token" (e.g. "Authorization: Token xxx" in headers)
+    #   config.api_key_prefix['api_key'] = 'Token'
+    attr_accessor :api_key_prefix
+
+    # Defines the username used with HTTP basic authentication.
+    #
+    # @return [String]
+    attr_accessor :username
+
+    # Defines the password used with HTTP basic authentication.
+    #
+    # @return [String]
+    attr_accessor :password
+
+    # Defines the access token (Bearer) used with OAuth2.
+    attr_accessor :access_token
+
+    # Set this to enable/disable debugging. When enabled (set to true), HTTP request/response
+    # details will be logged with `logger.debug` (see the `logger` attribute).
+    # Default to false.
+    #
+    # @return [true, false]
+    attr_accessor :debugging
+
+    # Defines the logger used for debugging.
+    # Default to `Rails.logger` (when in Rails) or logging to STDOUT.
+    #
+    # @return [#debug]
+    attr_accessor :logger
+
+    # Defines the temporary folder to store downloaded files
+    # (for API endpoints that have file response).
+    # Default to use `Tempfile`.
+    #
+    # @return [String]
+    attr_accessor :temp_folder_path
+
+    # The time limit for HTTP request in seconds.
+    # Default to 0 (never times out).
+    attr_accessor :timeout
+
+    # Set this to false to skip client side validation in the operation.
+    # Default to true.
+    # @return [true, false]
+    attr_accessor :client_side_validation
+
+    ### TLS/SSL setting
+    # Set this to false to skip verifying SSL certificate when calling API from https server.
+    # Default to true.
+    #
+    # @note Do NOT set it to false in production code, otherwise you would face multiple types of cryptographic attacks.
+    #
+    # @return [true, false]
+    attr_accessor :verify_ssl
+
+    ### TLS/SSL setting
+    # Set this to false to skip verifying SSL host name
+    # Default to true.
+    #
+    # @note Do NOT set it to false in production code, otherwise you would face multiple types of cryptographic attacks.
+    #
+    # @return [true, false]
+    attr_accessor :verify_ssl_host
+
+    ### TLS/SSL setting
+    # Set this to customize the certificate file to verify the peer.
+    #
+    # @return [String] the path to the certificate file
+    #
+    # @see The `cainfo` option of Typhoeus, `--cert` option of libcurl. Related source code:
+    # https://github.com/typhoeus/typhoeus/blob/master/lib/typhoeus/easy_factory.rb#L145
+    attr_accessor :ssl_ca_cert
+
+    ### TLS/SSL setting
+    # Client certificate file (for client certificate)
+    attr_accessor :cert_file
+
+    ### TLS/SSL setting
+    # Client private key file (for client certificate)
+    attr_accessor :key_file
+
+    # Set this to customize parameters encoding of array parameter with multi collectionFormat.
+    # Default to nil.
+    #
+    # @see The params_encoding option of Ethon. Related source code:
+    # https://github.com/typhoeus/ethon/blob/master/lib/ethon/easy/queryable.rb#L96
+    attr_accessor :params_encoding
+
+    attr_accessor :inject_format
+
+    attr_accessor :force_ending_format
+
+    def initialize
+      @scheme = 'http'
+      @host = 'localhost'
+      @base_path = ''
+      @server_index = 0
+      @server_operation_index = {}
+      @server_variables = {}
+      @server_operation_variables = {}
+      @api_key = {}
+      @api_key_prefix = {}
+      @timeout = 0
+      @client_side_validation = true
+      @verify_ssl = true
+      @verify_ssl_host = true
+      @params_encoding = nil
+      @cert_file = nil
+      @key_file = nil
+      @debugging = false
+      @inject_format = false
+      @force_ending_format = false
+      @logger = defined?(Rails) ? Rails.logger : Logger.new(STDOUT)
+
+      yield(self) if block_given?
+    end
+
+    # The default Configuration object.
+    def self.default
+      @@default ||= Configuration.new
+    end
+
+    def configure
+      yield(self) if block_given?
+    end
+
+    def scheme=(scheme)
+      # remove :// from scheme
+      @scheme = scheme.sub(/:\/\//, '')
+    end
+
+    def host=(host)
+      # remove http(s):// and anything after a slash
+      @host = host.sub(/https?:\/\//, '').split('/').first
+    end
+
+    def base_path=(base_path)
+      # Add leading and trailing slashes to base_path
+      @base_path = "/#{base_path}".gsub(/\/+/, '/')
+      @base_path = '' if @base_path == '/'
+    end
+
+    # Returns base URL for specified operation based on server settings
+    def base_url(operation = nil)
+      index = server_operation_index.fetch(operation, server_index)
+      return "#{scheme}://#{[host, base_path].join('/').gsub(/\/+/, '/')}".sub(/\/+\z/, '') if index == nil
+
+      server_url(index, server_operation_variables.fetch(operation, server_variables), operation_server_settings[operation])
+    end
+
+    # Gets API key (with prefix if set).
+    # @param [String] param_name the parameter name of API key auth
+    def api_key_with_prefix(param_name, param_alias = nil)
+      key = @api_key[param_name]
+      key = @api_key.fetch(param_alias, key) unless param_alias.nil?
+      if @api_key_prefix[param_name]
+        "#{@api_key_prefix[param_name]} #{key}"
+      else
+        key
+      end
+    end
+
+    # Gets Basic Auth token string
+    def basic_auth_token
+      'Basic ' + ["#{username}:#{password}"].pack('m').delete("\r\n")
+    end
+
+    # Returns Auth Settings hash for api client.
+    def auth_settings
+      {
+        'BearerToken' =>
+          {
+            type: 'api_key',
+            in: 'header',
+            key: 'authorization',
+            value: api_key_with_prefix('BearerToken')
+          },
+      }
+    end
+
+    # Returns an array of Server setting
+    def server_settings
+      [
+        {
+          url: "",
+          description: "No description provided",
+        }
+      ]
+    end
+
+    def operation_server_settings
+      {
+      }
+    end
+
+    # Returns URL based on server settings
+    #
+    # @param index array index of the server settings
+    # @param variables hash of variable and the corresponding value
+    def server_url(index, variables = {}, servers = nil)
+      servers = server_settings if servers == nil
+
+      # check array index out of bound
+      if (index < 0 || index >= servers.size)
+        fail ArgumentError, "Invalid index #{index} when selecting the server. Must be less than #{servers.size}"
+      end
+
+      server = servers[index]
+      url = server[:url]
+
+      return url unless server.key? :variables
+
+      # go through variable and assign a value
+      server[:variables].each do |name, variable|
+        if variables.key?(name)
+          if (!server[:variables][name].key?(:enum_values) || server[:variables][name][:enum_values].include?(variables[name]))
+            url.gsub! "{" + name.to_s + "}", variables[name]
+          else
+            fail ArgumentError, "The variable `#{name}` in the server URL has invalid value #{variables[name]}. Must be #{server[:variables][name][:enum_values]}."
+          end
+        else
+          # use default value
+          url.gsub! "{" + name.to_s + "}", server[:variables][name][:default_value]
+        end
+      end
+
+      url
+    end
+  end
+end

data/lib/kubernetes/loader.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+# Bridge require path for specs and gem consumers.
+require_relative '../../src/kubernetes/loader'