cloudstack/data_source_cloudstack_kubernetes_cluster_config.go - cloudstack-terraform-provider - Git at Google

 //
 // Licensed to the Apache Software Foundation (ASF) under one
 // or more contributor license agreements.  See the NOTICE file
 // distributed with this work for additional information
 // regarding copyright ownership.  The ASF licenses this file
 // to you under the Apache License, Version 2.0 (the
 // "License"); you may not use this file except in compliance
 // with the License.  You may obtain a copy of the License at
 //
 //   http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing,
 // software distributed under the License is distributed on an
 // "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 // KIND, either express or implied.  See the License for the
 // specific language governing permissions and limitations
 // under the License.
 //

 package cloudstack

 import (
 	"encoding/base64"
 	"fmt"
 	"log"
 	"slices"

 	"github.com/apache/cloudstack-go/v2/cloudstack"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"gopkg.in/yaml.v3"
 )

 func dataSourceCloudstackKubernetesClusterConfig() *schema.Resource {
 	return &schema.Resource{
 		Read: datasourceCloudStackKubernetesClusterConfigRead,
 		Schema: map[string]*schema.Schema{
 			"cluster_id": {
 				Type:        schema.TypeString,
 				Required:    true,
 				Description: "The ID of the Kubernetes cluster to retrieve the config for.",
 			},

 			//Computed values
 			"name": {
 				Type:        schema.TypeString,
 				Computed:    true,
 				Description: "The name of the Kubernetes cluster.",
 			},

 			"config_data": {
 				Type:        schema.TypeString,
 				Computed:    true,
 				Sensitive:   true,
 				Description: "The raw kubeconfig of the Kubernetes cluster.",
 			},

 			"endpoint": {
 				Type:        schema.TypeString,
 				Computed:    true,
 				Description: "The URL of the Kubernetes API server, taken from the kubeconfig.",
 			},

 			"cluster_ca_certificate": {
 				Type:        schema.TypeString,
 				Computed:    true,
 				Description: "The PEM encoded certificate authority of the Kubernetes API server.",
 			},

 			"client_certificate": {
 				Type:        schema.TypeString,
 				Computed:    true,
 				Description: "The PEM encoded client certificate used to authenticate against the Kubernetes API server.",
 			},

 			"client_key": {
 				Type:        schema.TypeString,
 				Computed:    true,
 				Sensitive:   true,
 				Description: "The PEM encoded client key used to authenticate against the Kubernetes API server.",
 			},
 		},
 	}
 }

 // kubeConfig models only the subset of a kubeconfig document that this data
 // source exposes as separate attributes.
 type kubeConfig struct {
 	CurrentContext string              `yaml:"current-context"`
 	Clusters       []kubeConfigCluster `yaml:"clusters"`
 	Contexts       []kubeConfigContext `yaml:"contexts"`
 	Users          []kubeConfigUser    `yaml:"users"`
 }

 type kubeConfigCluster struct {
 	Name    string                `yaml:"name"`
 	Cluster kubeConfigClusterInfo `yaml:"cluster"`
 }

 type kubeConfigClusterInfo struct {
 	Server                   string `yaml:"server"`
 	CertificateAuthorityData string `yaml:"certificate-authority-data"`
 }

 type kubeConfigContext struct {
 	Name    string                `yaml:"name"`
 	Context kubeConfigContextInfo `yaml:"context"`
 }

 type kubeConfigContextInfo struct {
 	Cluster string `yaml:"cluster"`
 	User    string `yaml:"user"`
 }

 type kubeConfigUser struct {
 	Name string             `yaml:"name"`
 	User kubeConfigUserInfo `yaml:"user"`
 }

 type kubeConfigUserInfo struct {
 	ClientCertificateData string `yaml:"client-certificate-data"`
 	ClientKeyData         string `yaml:"client-key-data"`
 }

 // kubernetesClusterCredentials holds the values extracted from a kubeconfig that
 // are needed to connect to the Kubernetes API server.
 type kubernetesClusterCredentials struct {
 	Endpoint             string
 	ClusterCACertificate string
 	ClientCertificate    string
 	ClientKey            string
 }

 func datasourceCloudStackKubernetesClusterConfigRead(d *schema.ResourceData, meta interface{}) error {
 	cs := meta.(*cloudstack.CloudStackClient)
 	clusterID := d.Get("cluster_id").(string)

 	log.Printf("[DEBUG] Retrieving config of Kubernetes Cluster %s", clusterID)

 	p := cs.Kubernetes.NewGetKubernetesClusterConfigParams()
 	p.SetId(clusterID)

 	config, err := cs.Kubernetes.GetKubernetesClusterConfig(p)
 	if err != nil {
 		// CloudStack refuses to hand out a config while the cluster is still
 		// starting, and when the Kubernetes service plugin is disabled.
 		return fmt.Errorf("Failed to get the config of Kubernetes Cluster %s: %s", clusterID, err)
 	}

 	if config.Configdata == "" {
 		return fmt.Errorf("Kubernetes Cluster %s returned an empty config; the cluster ID may not "+
 			"exist, the cluster may still be starting, or the Kubernetes service plugin may be disabled", clusterID)
 	}

 	credentials, err := parseKubernetesClusterConfig(config.Configdata)
 	if err != nil {
 		return fmt.Errorf("Failed to parse the config of Kubernetes Cluster %s: %s", clusterID, err)
 	}

 	if *credentials == (kubernetesClusterCredentials{}) {
 		log.Printf("[WARN] Could not derive a cluster endpoint, CA certificate, client certificate or "+
 			"client key from the config of Kubernetes Cluster %s; use config_data directly instead", clusterID)
 	}

 	d.SetId(config.Id)
 	d.Set("name", config.Name)
 	d.Set("config_data", config.Configdata)
 	d.Set("endpoint", credentials.Endpoint)
 	d.Set("cluster_ca_certificate", credentials.ClusterCACertificate)
 	d.Set("client_certificate", credentials.ClientCertificate)
 	d.Set("client_key", credentials.ClientKey)

 	return nil
 }

 // parseKubernetesClusterConfig extracts the endpoint and client credentials
 // from a kubeconfig document.
 func parseKubernetesClusterConfig(configData string) (*kubernetesClusterCredentials, error) {
 	var config kubeConfig
 	if err := yaml.Unmarshal([]byte(configData), &config); err != nil {
 		return nil, fmt.Errorf("Invalid kubeconfig: %s", err)
 	}

 	// The current context is resolved the same way as the cluster/user it names.
 	contextIndex, err := findKubeConfigEntry(config.Contexts, config.CurrentContext, "context",
 		func(c kubeConfigContext) string { return c.Name })
 	if err != nil {
 		return nil, err
 	}

 	clusterName, userName := "", ""
 	if contextIndex >= 0 {
 		clusterName = config.Contexts[contextIndex].Context.Cluster
 		userName = config.Contexts[contextIndex].Context.User
 	}

 	credentials := &kubernetesClusterCredentials{}

 	cluster, err := findKubeConfigEntry(config.Clusters, clusterName, "cluster",
 		func(c kubeConfigCluster) string { return c.Name })
 	if err != nil {
 		return nil, err
 	}
 	if cluster >= 0 {
 		caCertificate, err := decodeKubernetesClusterConfigValue(
 			config.Clusters[cluster].Cluster.CertificateAuthorityData, "certificate-authority-data")
 		if err != nil {
 			return nil, err
 		}

 		credentials.Endpoint = config.Clusters[cluster].Cluster.Server
 		credentials.ClusterCACertificate = caCertificate
 	}

 	user, err := findKubeConfigEntry(config.Users, userName, "user",
 		func(u kubeConfigUser) string { return u.Name })
 	if err != nil {
 		return nil, err
 	}
 	if user >= 0 {
 		clientCertificate, err := decodeKubernetesClusterConfigValue(
 			config.Users[user].User.ClientCertificateData, "client-certificate-data")
 		if err != nil {
 			return nil, err
 		}

 		clientKey, err := decodeKubernetesClusterConfigValue(
 			config.Users[user].User.ClientKeyData, "client-key-data")
 		if err != nil {
 			return nil, err
 		}

 		credentials.ClientCertificate = clientCertificate
 		credentials.ClientKey = clientKey
 	}

 	return credentials, nil
 }

 // findKubeConfigEntry finds an entry by name, falling back to the sole entry
 // when there's only one. With more than one and no match, it errors instead
 // of guessing, since a wrong guess could pair the wrong cluster and user.
 func findKubeConfigEntry[T any](entries []T, name string, kind string, nameOf func(T) string) (int, error) {
 	if len(entries) == 0 {
 		log.Printf("[WARN] Kubeconfig does not contain any %s", kind)
 		return -1, nil
 	}

 	if name != "" {
 		if i := slices.IndexFunc(entries, func(e T) bool { return nameOf(e) == name }); i >= 0 {
 			return i, nil
 		}

 		if len(entries) > 1 {
 			return -1, fmt.Errorf("kubeconfig does not define %s %q among its %d %s entries",
 				kind, name, len(entries), kind)
 		}

 		log.Printf("[WARN] Kubeconfig does not define the %s %q, using the only %s available instead", kind, name, kind)
 		return 0, nil
 	}

 	if len(entries) > 1 {
 		log.Printf("[WARN] Kubeconfig has %d %s entries and no current context to select one, using the first %s", len(entries), kind, kind)
 	}

 	return 0, nil
 }

 // decodeKubernetesClusterConfigValue decodes a base64 encoded kubeconfig field,
 // passing an absent field through as an empty string.
 func decodeKubernetesClusterConfigValue(value string, field string) (string, error) {
 	if value == "" {
 		log.Printf("[WARN] Kubeconfig does not contain %s", field)
 		return "", nil
 	}

 	decoded, err := base64.StdEncoding.DecodeString(value)
 	if err != nil {
 		return "", fmt.Errorf("Failed to decode %s: %s", field, err)
 	}

 	return string(decoded), nil
 }
	//
	// Licensed to the Apache Software Foundation (ASF) under one
	// or more contributor license agreements. See the NOTICE file
	// distributed with this work for additional information
	// regarding copyright ownership. The ASF licenses this file
	// to you under the Apache License, Version 2.0 (the
	// "License"); you may not use this file except in compliance
	// with the License. You may obtain a copy of the License at
	//
	// http://www.apache.org/licenses/LICENSE-2.0
	//
	// Unless required by applicable law or agreed to in writing,
	// software distributed under the License is distributed on an
	// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
	// KIND, either express or implied. See the License for the
	// specific language governing permissions and limitations
	// under the License.
	//

	package cloudstack

	import (
	"encoding/base64"
	"fmt"
	"log"
	"slices"

	"github.com/apache/cloudstack-go/v2/cloudstack"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
	"gopkg.in/yaml.v3"
	)

	func dataSourceCloudstackKubernetesClusterConfig() *schema.Resource {
	return &schema.Resource{
	Read: datasourceCloudStackKubernetesClusterConfigRead,
	Schema: map[string]*schema.Schema{
	"cluster_id": {
	Type: schema.TypeString,
	Required: true,
	Description: "The ID of the Kubernetes cluster to retrieve the config for.",
	},

	//Computed values
	"name": {
	Type: schema.TypeString,
	Computed: true,
	Description: "The name of the Kubernetes cluster.",
	},

	"config_data": {
	Type: schema.TypeString,
	Computed: true,
	Sensitive: true,
	Description: "The raw kubeconfig of the Kubernetes cluster.",
	},

	"endpoint": {
	Type: schema.TypeString,
	Computed: true,
	Description: "The URL of the Kubernetes API server, taken from the kubeconfig.",
	},

	"cluster_ca_certificate": {
	Type: schema.TypeString,
	Computed: true,
	Description: "The PEM encoded certificate authority of the Kubernetes API server.",
	},

	"client_certificate": {
	Type: schema.TypeString,
	Computed: true,
	Description: "The PEM encoded client certificate used to authenticate against the Kubernetes API server.",
	},

	"client_key": {
	Type: schema.TypeString,
	Computed: true,
	Sensitive: true,
	Description: "The PEM encoded client key used to authenticate against the Kubernetes API server.",
	},
	},
	}
	}

	// kubeConfig models only the subset of a kubeconfig document that this data
	// source exposes as separate attributes.
	type kubeConfig struct {
	CurrentContext string `yaml:"current-context"`
	Clusters []kubeConfigCluster `yaml:"clusters"`
	Contexts []kubeConfigContext `yaml:"contexts"`
	Users []kubeConfigUser `yaml:"users"`
	}

	type kubeConfigCluster struct {
	Name string `yaml:"name"`
	Cluster kubeConfigClusterInfo `yaml:"cluster"`
	}

	type kubeConfigClusterInfo struct {
	Server string `yaml:"server"`
	CertificateAuthorityData string `yaml:"certificate-authority-data"`
	}

	type kubeConfigContext struct {
	Name string `yaml:"name"`
	Context kubeConfigContextInfo `yaml:"context"`
	}

	type kubeConfigContextInfo struct {
	Cluster string `yaml:"cluster"`
	User string `yaml:"user"`
	}

	type kubeConfigUser struct {
	Name string `yaml:"name"`
	User kubeConfigUserInfo `yaml:"user"`
	}

	type kubeConfigUserInfo struct {
	ClientCertificateData string `yaml:"client-certificate-data"`
	ClientKeyData string `yaml:"client-key-data"`
	}

	// kubernetesClusterCredentials holds the values extracted from a kubeconfig that
	// are needed to connect to the Kubernetes API server.
	type kubernetesClusterCredentials struct {
	Endpoint string
	ClusterCACertificate string
	ClientCertificate string
	ClientKey string
	}

	func datasourceCloudStackKubernetesClusterConfigRead(d *schema.ResourceData, meta interface{}) error {
	cs := meta.(*cloudstack.CloudStackClient)
	clusterID := d.Get("cluster_id").(string)

	log.Printf("[DEBUG] Retrieving config of Kubernetes Cluster %s", clusterID)

	p := cs.Kubernetes.NewGetKubernetesClusterConfigParams()
	p.SetId(clusterID)

	config, err := cs.Kubernetes.GetKubernetesClusterConfig(p)
	if err != nil {
	// CloudStack refuses to hand out a config while the cluster is still
	// starting, and when the Kubernetes service plugin is disabled.
	return fmt.Errorf("Failed to get the config of Kubernetes Cluster %s: %s", clusterID, err)
	}

	if config.Configdata == "" {
	return fmt.Errorf("Kubernetes Cluster %s returned an empty config; the cluster ID may not "+
	"exist, the cluster may still be starting, or the Kubernetes service plugin may be disabled", clusterID)
	}

	credentials, err := parseKubernetesClusterConfig(config.Configdata)
	if err != nil {
	return fmt.Errorf("Failed to parse the config of Kubernetes Cluster %s: %s", clusterID, err)
	}

	if *credentials == (kubernetesClusterCredentials{}) {
	log.Printf("[WARN] Could not derive a cluster endpoint, CA certificate, client certificate or "+
	"client key from the config of Kubernetes Cluster %s; use config_data directly instead", clusterID)
	}

	d.SetId(config.Id)
	d.Set("name", config.Name)
	d.Set("config_data", config.Configdata)
	d.Set("endpoint", credentials.Endpoint)
	d.Set("cluster_ca_certificate", credentials.ClusterCACertificate)
	d.Set("client_certificate", credentials.ClientCertificate)
	d.Set("client_key", credentials.ClientKey)

	return nil
	}

	// parseKubernetesClusterConfig extracts the endpoint and client credentials
	// from a kubeconfig document.
	func parseKubernetesClusterConfig(configData string) (*kubernetesClusterCredentials, error) {
	var config kubeConfig
	if err := yaml.Unmarshal([]byte(configData), &config); err != nil {
	return nil, fmt.Errorf("Invalid kubeconfig: %s", err)
	}

	// The current context is resolved the same way as the cluster/user it names.
	contextIndex, err := findKubeConfigEntry(config.Contexts, config.CurrentContext, "context",
	func(c kubeConfigContext) string { return c.Name })
	if err != nil {
	return nil, err
	}

	clusterName, userName := "", ""
	if contextIndex >= 0 {
	clusterName = config.Contexts[contextIndex].Context.Cluster
	userName = config.Contexts[contextIndex].Context.User
	}

	credentials := &kubernetesClusterCredentials{}

	cluster, err := findKubeConfigEntry(config.Clusters, clusterName, "cluster",
	func(c kubeConfigCluster) string { return c.Name })
	if err != nil {
	return nil, err
	}
	if cluster >= 0 {
	caCertificate, err := decodeKubernetesClusterConfigValue(
	config.Clusters[cluster].Cluster.CertificateAuthorityData, "certificate-authority-data")
	if err != nil {
	return nil, err
	}

	credentials.Endpoint = config.Clusters[cluster].Cluster.Server
	credentials.ClusterCACertificate = caCertificate
	}

	user, err := findKubeConfigEntry(config.Users, userName, "user",
	func(u kubeConfigUser) string { return u.Name })
	if err != nil {
	return nil, err
	}
	if user >= 0 {
	clientCertificate, err := decodeKubernetesClusterConfigValue(
	config.Users[user].User.ClientCertificateData, "client-certificate-data")
	if err != nil {
	return nil, err
	}

	clientKey, err := decodeKubernetesClusterConfigValue(
	config.Users[user].User.ClientKeyData, "client-key-data")
	if err != nil {
	return nil, err
	}

	credentials.ClientCertificate = clientCertificate
	credentials.ClientKey = clientKey
	}

	return credentials, nil
	}

	// findKubeConfigEntry finds an entry by name, falling back to the sole entry
	// when there's only one. With more than one and no match, it errors instead
	// of guessing, since a wrong guess could pair the wrong cluster and user.
	func findKubeConfigEntry[T any](entries []T, name string, kind string, nameOf func(T) string) (int, error) {
	if len(entries) == 0 {
	log.Printf("[WARN] Kubeconfig does not contain any %s", kind)
	return -1, nil
	}

	if name != "" {
	if i := slices.IndexFunc(entries, func(e T) bool { return nameOf(e) == name }); i >= 0 {
	return i, nil
	}

	if len(entries) > 1 {
	return -1, fmt.Errorf("kubeconfig does not define %s %q among its %d %s entries",
	kind, name, len(entries), kind)
	}

	log.Printf("[WARN] Kubeconfig does not define the %s %q, using the only %s available instead", kind, name, kind)
	return 0, nil
	}

	if len(entries) > 1 {
	log.Printf("[WARN] Kubeconfig has %d %s entries and no current context to select one, using the first %s", len(entries), kind, kind)
	}

	return 0, nil
	}

	// decodeKubernetesClusterConfigValue decodes a base64 encoded kubeconfig field,
	// passing an absent field through as an empty string.
	func decodeKubernetesClusterConfigValue(value string, field string) (string, error) {
	if value == "" {
	log.Printf("[WARN] Kubeconfig does not contain %s", field)
	return "", nil
	}

	decoded, err := base64.StdEncoding.DecodeString(value)
	if err != nil {
	return "", fmt.Errorf("Failed to decode %s: %s", field, err)
	}

	return string(decoded), nil
	}