Skip to content

Commit 567959a

Browse files
mblaschkemblaschke
committed
Initial revision
Signed-off-by: Markus Blaschke <mblaschke82@gmail.com>
0 parents  commit 567959a

File tree

19 files changed

+1372
-0
lines changed

19 files changed

+1372
-0
lines changed

‎.dockerignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
/test
2+
/vendor
3+
/kube-bootstrap-token-manager

‎.editorconfig‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# EditorConfig is awesome: http://EditorConfig.org
2+
3+
# top-most EditorConfig file
4+
root = true
5+
charset = utf-8
6+
trim_trailing_whitespace = true
7+
8+
[*]
9+
end_of_line = lf
10+
insert_final_newline = true
11+
indent_style = space
12+
indent_size = 4
13+
14+
[Makefile]
15+
indent_style = tab
16+
17+
[*.yml]
18+
indent_size = 2
19+
20+
[*.yaml]
21+
indent_size = 2
22+
23+
[*.conf]
24+
indent_size = 2
25+
26+
[*.go]
27+
indent_style = tab
28+
indent_size = 4

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
/vendor
2+
/kube-bootstrap-token-manager
3+
*.exe

‎Dockerfile‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
FROM golang:1.14 as build
2+
3+
WORKDIR /go/src/github.com/webdevops/kube-bootstrap-token-manager
4+
5+
# Get deps (cached)
6+
COPY ./go.mod /go/src/github.com/webdevops/kube-bootstrap-token-manager
7+
COPY ./go.sum /go/src/github.com/webdevops/kube-bootstrap-token-manager
8+
RUN go mod download
9+
10+
# Compile
11+
COPY ./ /go/src/github.com/webdevops/kube-bootstrap-token-manager
12+
RUN make test
13+
RUN make lint
14+
RUN make build
15+
RUN ./kube-bootstrap-token-manager --help
16+
17+
#############################################
18+
# FINAL IMAGE
19+
#############################################
20+
FROM gcr.io/distroless/base
21+
ENV LOG_JSON=1
22+
COPY --from=build /go/src/github.com/webdevops/kube-bootstrap-token-manager/kube-bootstrap-token-manager /
23+
USER 1000
24+
ENTRYPOINT ["/kube-bootstrap-token-manager"]

‎LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
The MIT License (MIT)
2+
3+
Copyright (c) 2020 WebDevOps
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎Makefile‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
.PHONY: all build clean image check vendor dependencies
2+
3+
NAME := kube-bootstrap-token-manager
4+
GIT_TAG := $(shell git describe --dirty --tags --always)
5+
GIT_COMMIT := $(shell git rev-parse --short HEAD)
6+
LDFLAGS := -X "main.gitTag=$(GIT_TAG)" -X "main.gitCommit=$(GIT_COMMIT)" -extldflags "-static"
7+
8+
PKGS := $(shell go list ./... | grep -v -E '/vendor/|/test')
9+
FIRST_GOPATH := $(firstword $(subst :, ,$(shell go env GOPATH)))
10+
GOLANGCI_LINT_BIN := $(FIRST_GOPATH)/bin/golangci-lint
11+
12+
13+
all: build
14+
15+
clean:
16+
git clean -Xfd .
17+
18+
build:
19+
CGO_ENABLED=0 go build -a -ldflags '$(LDFLAGS)' -o $(NAME) .
20+
21+
vendor:
22+
go mod tidy
23+
go mod vendor
24+
go mod verify
25+
26+
image: build
27+
docker build -t $(NAME):$(TAG) .
28+
29+
test:
30+
go test ./...
31+
32+
.PHONY: lint
33+
lint: $(GOLANGCI_LINT_BIN)
34+
# megacheck fails to respect build flags, causing compilation failure during linting.
35+
# instead, use the unused, gosimple, and staticcheck linters directly
36+
$(GOLANGCI_LINT_BIN) run -D megacheck -E unused,gosimple,staticcheck --timeout=10m
37+
38+
dependencies: $(GOLANGCI_LINT_BIN)
39+
40+
$(GOLANGCI_LINT_BIN):
41+
curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $(FIRST_GOPATH)/bin v1.23.8
42+

‎README.md‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
Kubernetes node bootstrap token manager
2+
========================================
3+
4+
[![license](https://img.shields.io/github/license/webdevops/kube-bootstrap-token-manager.svg)](https://github.com/webdevops/kube-bootstrap-token-manager/blob/master/LICENSE)
5+
[![Docker](https://img.shields.io/docker/cloud/automated/webdevops/kube-bootstrap-token-manager)](https://hub.docker.com/r/webdevops/kube-bootstrap-token-manager/)
6+
[![Docker Build Status](https://img.shields.io/docker/cloud/build/webdevops/kube-bootstrap-token-manager)](https://hub.docker.com/r/webdevops/kube-bootstrap-token-manager/)
7+
8+
Manager for Node bootstrap tokens for Kubernetes.
9+
10+
Supports currently Azure cloud provider (more cloud provider support -> please submit PR).
11+
12+
Azure:
13+
- Stores token in Keyvault as secret
14+
- (re)creates token inside Kubernetes and ensures it existence
15+
- Manages renewal if token is going to be expired
16+
17+
Configuration
18+
-------------
19+
20+
```
21+
Usage:
22+
kube-bootstrap-token-manager [OPTIONS]
23+
24+
Application Options:
25+
--debug debug mode [$DEBUG]
26+
-v, --verbose verbose mode [$VERBOSE]
27+
--log.json Switch log output to json format [$LOG_JSON]
28+
--bootstraptoken.name= Name for bootstrap tokens (default: bootstrap-token-%s) [$BOOTSTRAPTOKEN_NAME]
29+
--bootstraptoken.label= Label for bootstrap tokens (default: webdevops.kubernetes.io/bootstraptoken-managed) [$BOOTSTRAPTOKEN_LABEL]
30+
--bootstraptoken.namespace= Namespace for bootstrap tokens (default: kube-system) [$BOOTSTRAPTOKEN_NAMESPACE]
31+
--bootstraptoken.type= Type for bootstrap tokens (default: bootstrap.kubernetes.io/token) [$BOOTSTRAPTOKEN_TYPE]
32+
--bootstraptoken.usage-bootstrap-authentication= Usage bootstrap authentication for bootstrap tokens (default: true) [$BOOTSTRAPTOKEN_USAGE_BOOTSTRAP_AUTHENTICATION]
33+
--bootstraptoken.usage-bootstrap-signing= usage bootstrap signing for bootstrap tokens (default: true) [$BOOTSTRAPTOKEN_USAGE_BOOTSTRAP_SIGNING]
34+
--bootstraptoken.auth-extra-groups= Auth extra groups for bootstrap tokens (default: system:bootstrappers:worker,system:bootstrappers:ingress) [$BOOTSTRAPTOKEN_AUTH_EXTRA_GROUPS]
35+
--bootstraptoken.expiration= Expiration (time.Duration) for bootstrap tokens (default: 8760h) [$BOOTSTRAPTOKEN_EXPIRATION]
36+
--bootstraptoken.token-length= Length of the random token string for bootstrap tokens (default: 16) [$BOOTSTRAPTOKEN_TOKEN_LENGTH]
37+
--bootstraptoken.token-runes= Runes which should be used for the random token string for bootstrap tokens (default:
38+
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789) [$BOOTSTRAPTOKEN_TOKEN_RUNES]
39+
--sync.time= Sync time (time.Duration) (default: 1h) [$SYNC_TIME]
40+
--sync.recreate-before= Time duration (time.Duration) when token should be recreated (default: 2190h) [$SYNC_RECREATE_BEFORE]
41+
--cloud-provider=[azure] Cloud provider [$CLOUD_PROVIDER]
42+
--cloud-config= Cloud provider configuration path [$CLOUD_CONFIG]
43+
--azure-environment= Azure environment name [$AZURE_ENVIRONMENT]
44+
--azure.keyvault-name= Name of Keyvault to sync token [$AZURE_KEYVAULT_NAME]
45+
--azure.keyvault-secret-name= Name of Keyvault secret to sync token [$AZURE_KEYVAULT_SECRET_NAME]
46+
--dry-run Dry run (do not apply to nodes) [$DRY_RUN]
47+
--bind= Server address (default: :8080) [$SERVER_BIND]
48+
49+
Help Options:
50+
-h, --help Show this help message
51+
```
52+
53+
for Azure API authentication (using ENV vars) see https://github.com/Azure/azure-sdk-for-go#authentication
54+
55+
Metrics
56+
-------
57+
58+
(see `:8080/metrics`)
59+
60+
| Metric | Description |
61+
|:-----------------------------------|:------------------------------------------------|
62+
| `bootstraptoken_token_info` | Info about current token |
63+
| `bootstraptoken_token_expiration` | Expiration time (unix timestamp) of token |
64+
| `bootstraptoken_sync_status` | Status if sync was successfull |
65+
| `bootstraptoken_sync_time` | Timestamp of last sync |
66+
| `bootstraptoken_sync_count` | Counter of sync |
67+
68+
Kubernetes deployment
69+
---------------------
70+
71+
see [deployment](/deployment)

‎config/opts.go‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
package config
2+
3+
import (
4+
"encoding/json"
5+
log "github.com/sirupsen/logrus"
6+
"time"
7+
)
8+
9+
type (
10+
Opts struct {
11+
// logger
12+
Logger struct {
13+
Debug bool ` long:"debug" env:"DEBUG" description:"debug mode"`
14+
Verbose bool `short:"v" long:"verbose" env:"VERBOSE" description:"verbose mode"`
15+
LogJson bool ` long:"log.json" env:"LOG_JSON" description:"Switch log output to json format"`
16+
}
17+
18+
BootstrapToken struct {
19+
Name string `long:"bootstraptoken.name" env:"BOOTSTRAPTOKEN_NAME" description:"Name for bootstrap tokens" default:"bootstrap-token-%s"`
20+
Label string `long:"bootstraptoken.label" env:"BOOTSTRAPTOKEN_LABEL" description:"Label for bootstrap tokens" default:"webdevops.kubernetes.io/bootstraptoken-managed"`
21+
Namespace string `long:"bootstraptoken.namespace" env:"BOOTSTRAPTOKEN_NAMESPACE" description:"Namespace for bootstrap tokens" default:"kube-system"`
22+
Type string `long:"bootstraptoken.type" env:"BOOTSTRAPTOKEN_TYPE" description:"Type for bootstrap tokens" default:"bootstrap.kubernetes.io/token"`
23+
UsageBootstrapAuthentication string `long:"bootstraptoken.usage-bootstrap-authentication" env:"BOOTSTRAPTOKEN_USAGE_BOOTSTRAP_AUTHENTICATION" description:"Usage bootstrap authentication for bootstrap tokens" default:"true"`
24+
UsageBootstrapSigning string `long:"bootstraptoken.usage-bootstrap-signing" env:"BOOTSTRAPTOKEN_USAGE_BOOTSTRAP_SIGNING" description:"usage bootstrap signing for bootstrap tokens" default:"true"`
25+
AuthExtraGroups string `long:"bootstraptoken.auth-extra-groups" env:"BOOTSTRAPTOKEN_AUTH_EXTRA_GROUPS" description:"Auth extra groups for bootstrap tokens" default:"system:bootstrappers:worker,system:bootstrappers:ingress"`
26+
Expiration *time.Duration `long:"bootstraptoken.expiration" env:"BOOTSTRAPTOKEN_EXPIRATION" description:"Expiration (time.Duration) for bootstrap tokens" default:"8760h"`
27+
TokenLength uint `long:"bootstraptoken.token-length" env:"BOOTSTRAPTOKEN_TOKEN_LENGTH" description:"Length of the random token string for bootstrap tokens" default:"16"`
28+
TokenRunes string `long:"bootstraptoken.token-runes" env:"BOOTSTRAPTOKEN_TOKEN_RUNES" description:"Runes which should be used for the random token string for bootstrap tokens" default:"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"`
29+
}
30+
31+
Sync struct {
32+
Time time.Duration `long:"sync.time" env:"SYNC_TIME" description:"Sync time (time.Duration)" default:"1h"`
33+
RecreateBefore time.Duration `long:"sync.recreate-before" env:"SYNC_RECREATE_BEFORE" description:"Time duration (time.Duration) when token should be recreated" default:"2190h"`
34+
}
35+
36+
CloudProvider struct {
37+
Provider *string `long:"cloud-provider" env:"CLOUD_PROVIDER" description:"Cloud provider" choice:"azure" required:"true"`
38+
Config *string `long:"cloud-config" env:"CLOUD_CONFIG" description:"Cloud provider configuration path"`
39+
40+
Azure struct {
41+
Environment *string `long:"azure-environment" env:"AZURE_ENVIRONMENT" description:"Azure environment name"`
42+
KeyVaultName *string `long:"azure.keyvault-name" env:"AZURE_KEYVAULT_NAME" description:"Name of Keyvault to sync token"`
43+
KeyVaultSecretName *string `long:"azure.keyvault-secret-name" env:"AZURE_KEYVAULT_SECRET_NAME" description:"Name of Keyvault secret to sync token"`
44+
}
45+
}
46+
47+
// general options
48+
DryRun bool `long:"dry-run" env:"DRY_RUN" description:"Dry run (do not apply to nodes)"`
49+
ServerBind string `long:"bind" env:"SERVER_BIND" description:"Server address" default:":8080"`
50+
}
51+
)
52+
53+
func (o *Opts) GetJson() []byte {
54+
jsonBytes, err := json.Marshal(o)
55+
if err != nil {
56+
log.Panic(err)
57+
}
58+
return jsonBytes
59+
}

‎deployment/config.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: kube-pool-manager
5+
namespace: kube-system
6+
data:
7+
pools.yaml: |
8+
pools:
9+
- pool: agents
10+
selector:
11+
- path: "{.spec.providerID}"
12+
regexp: "^.+virtualMachineScaleSets\\/aks-agents-35471996-vmss\\/.+$"
13+
node:
14+
roles: [agents]
15+
#configSource:
16+
# configMap:
17+
# name: kubelet-config
18+
# namespace: kube-system
19+
# kubeletConfigKey: kubelet
20+
labels:
21+
webdevops.io/testing: true
22+
annotations:
23+
webdevops.io/testing: 2

‎deployment/deployment.yaml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
---
2+
apiVersion: apps/v1
3+
kind: Deployment
4+
metadata:
5+
name: kube-pool-manager
6+
namespace: kube-system
7+
labels:
8+
app: kube-pool-manager
9+
spec:
10+
replicas: 1
11+
selector:
12+
matchLabels:
13+
app: kube-pool-manager
14+
template:
15+
metadata:
16+
labels:
17+
app: kube-pool-manager
18+
annotations:
19+
prometheus.io/scrape: "true"
20+
prometheus.io/path: /metrics
21+
prometheus.io/port: "8080"
22+
spec:
23+
serviceAccountName: kube-pool-manager
24+
containers:
25+
- name: kube-pool-manager
26+
image: webdevops/kube-pool-manager:development
27+
imagePullPolicy: Always
28+
env:
29+
- name: CONFIG
30+
value: "/config/pools.yaml"
31+
securityContext:
32+
readOnlyRootFilesystem: true
33+
runAsNonRoot: true
34+
capabilities:
35+
drop: ['ALL']
36+
ports:
37+
- containerPort: 8080
38+
name: http-metrics
39+
protocol: TCP
40+
resources:
41+
limits:
42+
cpu: 100m
43+
memory: 100Mi
44+
requests:
45+
cpu: 1m
46+
memory: 100Mi
47+
volumeMounts:
48+
- name: config
49+
mountPath: /config
50+
volumes:
51+
- name: config
52+
configMap:
53+
name: kube-pool-manager
54+
55+

0 commit comments

Comments
 (0)