kubernetes 使用应用程序默认凭据的GKE身份验证

3zwtqj6y  于 2023-01-25  发布在  Kubernetes
关注(0)|答案(2)|浏览(265)

您好,我正在尝试使用应用程序默认凭据(ADC)获取群集资源详细信息。

package main

import (
    "context"
    "encoding/base64"
    "flag"
    "fmt"
    "log"

    "google.golang.org/api/container/v1"
    metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
    "k8s.io/client-go/kubernetes"
    _ "k8s.io/client-go/plugin/pkg/client/auth/gcp" // register GCP auth provider
    "k8s.io/client-go/tools/clientcmd"
    "k8s.io/client-go/tools/clientcmd/api"
)

var fProjectId = flag.String("projectId", "", "specify a project id to examine")

func main() {
    flag.Parse()
    if *fProjectId == "" {
        log.Fatal("must specific -projectId")
    }

    if err := run(context.Background(), *fProjectId); err != nil {
        log.Fatal(err)
    }
}

func run(ctx context.Context, projectId string) error {
    kubeConfig, err := getK8sClusterConfigs(ctx, projectId)
    if err != nil {
        return err
    }

    // Just list all the namespaces found in the project to test the API.
    for clusterName := range kubeConfig.Clusters {
        cfg, err := clientcmd.NewNonInteractiveClientConfig(*kubeConfig, clusterName, &clientcmd.ConfigOverrides{CurrentContext: clusterName}, nil).ClientConfig()
        if err != nil {
            return fmt.Errorf("failed to create Kubernetes configuration cluster=%s: %w", clusterName, err)
        }

        k8s, err := kubernetes.NewForConfig(cfg)
        if err != nil {
            return fmt.Errorf("failed to create Kubernetes client cluster=%s: %w", clusterName, err)
        }

        ns, err := k8s.CoreV1().Namespaces().List(ctx, metav1.ListOptions{})
        if err != nil {
            return fmt.Errorf("failed to list namespaces cluster=%s: %w", clusterName, err)
        }

        log.Printf("Namespaces found in cluster=%s", clusterName)

        for _, item := range ns.Items {
            log.Println(item.Name)
        }
    }

    return nil
}

func getK8sClusterConfigs(ctx context.Context, projectId string) (*api.Config, error) {
    svc, err := container.NewService(ctx)
    if err != nil {
        return nil, fmt.Errorf("container.NewService: %w", err)
    }

    // Basic config structure
    ret := api.Config{
        APIVersion: "v1",
        Kind:       "Config",
        Clusters:   map[string]*api.Cluster{},  // Clusters is a map of referencable names to cluster configs
        AuthInfos:  map[string]*api.AuthInfo{}, // AuthInfos is a map of referencable names to user configs
        Contexts:   map[string]*api.Context{},  // Contexts is a map of referencable names to context configs
    }

    // Ask Google for a list of all kube clusters in the given project.
    resp, err := svc.Projects.Zones.Clusters.List(projectId, "-").Context(ctx).Do()
    if err != nil {
        return nil, fmt.Errorf("clusters list project=%s: %w", projectId, err)
    }

    for _, f := range resp.Clusters {
        name := fmt.Sprintf("gke_%s_%s_%s", projectId, f.Zone, f.Name)
        cert, err := base64.StdEncoding.DecodeString(f.MasterAuth.ClusterCaCertificate)
        if err != nil {
            return nil, fmt.Errorf("invalid certificate cluster=%s cert=%s: %w", name, f.MasterAuth.ClusterCaCertificate, err)
        }
        // example: gke_my-project_us-central1-b_cluster-1 => https://XX.XX.XX.XX
        ret.Clusters[name] = &api.Cluster{
            CertificateAuthorityData: cert,
            Server:                   "https://" + f.Endpoint,
        }
        // Just reuse the context name as an auth name.
        ret.Contexts[name] = &api.Context{
            Cluster:  name,
            AuthInfo: name,
        }
        // GCP specific configation; use cloud platform scope.
        ret.AuthInfos[name] = &api.AuthInfo{
            AuthProvider: &api.AuthProviderConfig{
                Name: "gcp",
                Config: map[string]string{
                    "scopes": "https://www.googleapis.com/auth/cloud-platform",
                },
            },
        }
    }

    return &ret, nil
}

它给了我错误:

go run main.go -projectId=<Project-id>                                                              
2023/01/23 12:13:47 failed to create Kubernetes client cluster=<cluster-name>: The gcp auth plugin has been removed.
Please use the "gke-gcloud-auth-plugin" kubectl/client-go credential plugin instead.
See https://cloud.google.com/blog/products/containers-kubernetes/kubectl-auth-changes-in-gke for further details
exit status 1

这将是有帮助的,如果你们建议我如何解决这个问题。

gr8qqesn

gr8qqesn1#

从k8s 1.26开始,你需要单独安装GKE auth插件。所以,根据你的操作系统安装 google-cloud-sdk-gke-gcloud-auth-plugin,它应该可以工作。https://cloud.google.com/blog/products/containers-kubernetes/kubectl-auth-changes-in-gke

vsmadaxz

vsmadaxz2#

降级依赖项后,它可以正常工作

go get k8s.io/client-go/tools/clientcmd@v0.25.5  
go get k8s.io/cloud-provider-gcp/pkg/clientauthplugin/gcp@bb1acae5826dc877953d48

相关问题