Use secret CA and token to build cluster config
@@ -21,6 +21,7 @@ import (
"net"
"time"
+ "github.com/golang/glog"
fedv1a1 "github.com/marun/federation-v2/pkg/apis/federation/v1alpha1"
apiv1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -30,8 +31,6 @@ import (
"k8s.io/client-go/tools/clientcmd"
clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
crclientset "k8s.io/cluster-registry/pkg/client/clientset_generated/clientset"
-
- "github.com/golang/glog"
)
const (
@@ -92,9 +91,27 @@ func BuildClusterConfig(fedCluster *fedv1a1.FederatedCluster, kubeClient kubecli
return nil, err
}
- // TODO(marun) Use a service account instead of a serialized kubeconfig
+ token, tokenFound := secret.Data["token"]
+ ca, caFound := secret.Data["ca.crt"]
+
+ // TODO(font): These changes support both integration (legacy mode) and
+ // E2E tests (using service accounts). We cannot use JoinCluster in
+ // integration until we have the required RBAC controller(s) e.g. the
+ // token controller which observes the service account creation and
+ // creates the corresponding secret to allow API access. Until then, we
+ // have to rely on the legacy method to allow integration tests to
+ // pass.
+ if tokenFound != caFound {
+ return nil, fmt.Errorf("secret should have values for either both 'ca.crt' and 'token' in its Data, or neither: %v", secret)
+ } else if tokenFound && caFound {
+ clusterConfig, err = clientcmd.BuildConfigFromFlags(serverAddress, "")
+ clusterConfig.CAData = ca
+ clusterConfig.BearerToken = string(token)
+ } else {
kubeconfigGetter := KubeconfigGetterForSecret(secret)
clusterConfig, err = clientcmd.BuildConfigFromKubeconfigGetter(serverAddress, kubeconfigGetter)
+ }
+
if err != nil {
return nil, err
}
