kubes_google 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d795d19cc6f90fc23eb69f9e93a2e04993ce14d8681634961fb8ef349c95fd7c
-  data.tar.gz: 3acb4ab90062ac61f1e1a82cbe70319ea0086d7fcd9490bd290cc92fc0141683
+  metadata.gz: c2b41e672639ece65b0c749581b7321b30a48213744e28aa63e3e71bf6cf3fd3
+  data.tar.gz: 0b4006a22492fb1424c3d45b880f9a784deee99d824e986fb7a52e835196f955
 SHA512:
-  metadata.gz: 8048442e2abd946050b7740f1c7f60b7d528a18464e779f9a677cc41ed67182b218f44852096ab65558616c5b1bd3b293b2ca6b164dee12808d575ca1227c607
-  data.tar.gz: ae2add8d4baf621d40174eca105add4df3a752d0a27873f50ae1b97e830d601ad95c65b12e976f0320e2bbf60cd4866249dda677078bd17134ad639354856e49
+  metadata.gz: 139e70fe3e151df3fcefa12a4a8d7a7a45b08bc62909815b4be865906e7400f1c5141a42e41331b13aa774b6f04caca3d06a7a882c6a486646047d11a0d09a3f
+  data.tar.gz: 9c6058c9157f05a8be7aa662fedc71ada94171e7c4fe5086552c68743a683467a2247fa549d2217f6017ea3ed84fdc80cf18f85a2a2f934753546d95d93af943

data/CHANGELOG.md

@@ -3,6 +3,9 @@
 All notable changes to this project will be documented in this file.
 This project *loosely tries* to adhere to [Semantic Versioning](http://semver.org/), even before v1.0.
 
+## [0.3.0]
+- #3 gke hook to whitelist ip
+
 ## [0.2.0]
 - #2 add google_secret helper and register plugin
 - fix GOOGLE_PROJECT check

data/kubes_google.gemspec

@@ -23,7 +23,10 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
 
   spec.add_dependency "activesupport"
+  spec.add_dependency "google-cloud-container"
   spec.add_dependency "google-cloud-secret_manager"
   spec.add_dependency "memoist"
   spec.add_dependency "zeitwerk"
+
+  spec.add_development_dependency "kubes"
 end

data/lib/hooks/kubes.rb

@@ -0,0 +1,14 @@
+gke = KubesGoogle::Gke.new(
+  name: KubesGoogle.config.gke.cluster_name,
+  whitelist_ip: KubesGoogle.config.gke.whitelist_ip,
+)
+
+before("apply",
+  label: "gke whitelist hook",
+  execute: gke.method(:allow).to_proc,
+)
+
+after("apply",
+  label: "gke whitelist hook",
+  execute: gke.method(:deny).to_proc,
+)

data/lib/kubes_google.rb

@@ -16,6 +16,25 @@ module KubesGoogle
     @@logger = v
   end
 
+  # Friendlier method configure.
+  #
+  #    .kubes/config/env/dev.rb
+  #    .kubes/config/plugins/google.rb # also works
+  #
+  # Example:
+  #
+  #     KubesGoogle.configure do |config|
+  #       config.hooks.gke_whitelist = true
+  #     end
+  #
+  def configure(&block)
+    Config.instance.configure(&block)
+  end
+
+  def config
+    Config.instance.config
+  end
+
   extend self
 end
 

data/lib/kubes_google/config.rb

@@ -0,0 +1,23 @@
+module KubesGoogle
+  class Config
+    include Singleton
+
+    def defaults
+      c = ActiveSupport::OrderedOptions.new
+      c.gke = ActiveSupport::OrderedOptions.new
+      c.gke.cluster_name = nil
+      c.gke.enable_hooks = nil # nil since need cluster_name also. setting to false will explicitly disable hooks
+      c.gke.whitelist_ip = nil # default will auto-detect IP
+      c
+    end
+
+    @@config = nil
+    def config
+      @@config ||= defaults
+    end
+
+    def configure
+      yield(config)
+    end
+  end
+end

data/lib/kubes_google/gke.rb

@@ -0,0 +1,99 @@
+require 'open-uri'
+
+module KubesGoogle
+  class Gke
+    extend Memoist
+    include Logging
+    include Services
+
+    def initialize(name:, whitelist_ip: nil)
+      @name, @whitelist_ip = name, whitelist_ip
+    end
+
+    def allow
+      return unless enabled?
+      logger.debug "Updating cluster. Adding IP: #{ip}"
+      update_cluster(cidr_blocks(:with_whitelist))
+    end
+
+    def deny
+      return unless enabled?
+      logger.debug "Updating cluster. Removing IP: #{ip}"
+      update_cluster(cidr_blocks(:without_whitelist))
+    end
+
+    # Setting the cluster name is enough to enable the hooks
+    def enabled?
+      enable = KubesGoogle.config.gke.enable_hooks
+      enable = enable.nil? ? true : enable
+      # gke = KubesGoogle::Gke.new(name: KubesGoogle.config.gke.cluster_name)
+      # so @name = KubesGoogle.config.gke.cluster_name
+      !!(enable && @name)
+    end
+
+    def update_cluster(cidr_blocks)
+      resp = cluster_manager.update_cluster(
+        name: @name,
+        update: {
+          desired_master_authorized_networks_config: {
+            cidr_blocks: cidr_blocks,
+            enabled: true,
+          }
+        }
+      )
+      operation_name = resp.self_link.sub(/.*projects/,'projects')
+      wait_for(operation_name)
+    end
+
+    def wait_for(operation_name)
+      resp = cluster_manager.get_operation(name: operation_name)
+      until resp.status != :RUNNING do
+        sleep 5
+        resp = cluster_manager.get_operation(name: operation_name)
+      end
+    end
+
+    def cidr_blocks(type)
+      # so we dont keep adding duplicates
+      old = old_cidrs.reject do |x|
+        x[:display_name] == new_cidr[:display_name] &&
+        x[:cidr_block] == new_cidr[:cidr_block]
+      end
+      if type == :with_whitelist
+        old + [new_cidr]
+      else
+        old
+      end
+    end
+
+    def old_cidrs
+      resp = cluster_manager.get_cluster(name: @name)
+      config = resp.master_authorized_networks_config.to_h
+      config[:cidr_blocks]
+    end
+    memoize :old_cidrs
+
+    def new_cidr
+      {
+        display_name: "added-by-kubes-google",
+        cidr_block: ip,
+      }
+    end
+    memoize :new_cidr
+
+    def ip
+      @whitelist_ip || current_ip
+    end
+
+    def current_ip
+      resp = URI.open("http://ifconfig.me")
+      ip = resp.read
+      "#{ip}/32"
+    rescue SocketError => e
+      logger.info "WARN: #{e.message}"
+      logger.info "Unable to detect current ip. Will use 0.0.0.0/0"
+      "0.0.0.0/0"
+    end
+    memoize :current_ip
+  end
+end

data/lib/kubes_google/hooks.rb

@@ -0,0 +1,7 @@
+module KubesGoogle
+  class Hooks
+    def path
+      File.expand_path("../hooks", __dir__)
+    end
+  end
+end

data/lib/kubes_google/services.rb

@@ -1,9 +1,15 @@
 require "google-cloud-secret_manager"
+require "google/cloud/container"
 
 module KubesGoogle
   module Services
     extend Memoist
 
+    def cluster_manager
+      Google::Cloud::Container.cluster_manager
+    end
+    memoize :cluster_manager
+
     def secret_manager_service
       Google::Cloud::SecretManager.secret_manager_service
     end

data/lib/kubes_google/version.rb

@@ -1,3 +1,3 @@
 module KubesGoogle
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kubes_google
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Tung Nguyen
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-11-09 00:00:00.000000000 Z
+date: 2020-11-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -24,6 +24,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: google-cloud-container
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: google-cloud-secret_manager
   requirement: !ruby/object:Gem::Requirement
@@ -66,6 +80,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: kubes
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: 
 email:
 - tung@boltops.com
@@ -81,9 +109,13 @@ files:
 - README.md
 - Rakefile
 - kubes_google.gemspec
+- lib/hooks/kubes.rb
 - lib/kubes_google.rb
 - lib/kubes_google/autoloader.rb
+- lib/kubes_google/config.rb
+- lib/kubes_google/gke.rb
 - lib/kubes_google/helpers.rb
+- lib/kubes_google/hooks.rb
 - lib/kubes_google/logging.rb
 - lib/kubes_google/secrets.rb
 - lib/kubes_google/secrets/fetcher.rb