incluster_config.py

# Copyright 2016 The Kubernetes Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

import datetime
import os
from config_exception import ConfigException
from kubernetes.client import Configuration


SERVICE_HOST_ENV_NAME = "KUBERNETES_SERVICE_HOST"
SERVICE_PORT_ENV_NAME = "KUBERNETES_SERVICE_PORT"
SERVICE_TOKEN_FILENAME = "/var/run/secrets/kubernetes.io/serviceaccount/token"
SERVICE_CERT_FILENAME = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"


def _join_host_port(host, port):
    """Adapted golang's net.JoinHostPort"""
    template = "%s:%s"
    host_requires_bracketing = ':' in host or '%' in host
    if host_requires_bracketing:
        template = "[%s]:%s"
    return template % (host, port)


class InClusterConfigLoader(object):
    def __init__(self,
                 token_filename,
                 cert_filename,
                 try_refresh_token=True,
                 environ=os.environ):
        self._token_filename = token_filename
        self._cert_filename = cert_filename
        self._environ = environ
        self._try_refresh_token = try_refresh_token
        self._token_refresh_period = datetime.timedelta(minutes=1)

    def load_and_set(self, client_configuration=None):
        try_set_default = False
        if client_configuration is None:
            client_configuration = type.__call__(Configuration)
            try_set_default = True
        self._load_config()
        self._set_config(client_configuration)
        if try_set_default:
            Configuration.set_default(client_configuration)

    def _load_config(self):
        if (SERVICE_HOST_ENV_NAME not in self._environ
                or SERVICE_PORT_ENV_NAME not in self._environ):
            raise ConfigException("Service host/port is not set.")

        if (not self._environ[SERVICE_HOST_ENV_NAME]
                or not self._environ[SERVICE_PORT_ENV_NAME]):
            raise ConfigException("Service host/port is set but empty.")

        self.host = ("https://" +
                     _join_host_port(self._environ[SERVICE_HOST_ENV_NAME],
                                     self._environ[SERVICE_PORT_ENV_NAME]))

        if not os.path.isfile(self._token_filename):
            raise ConfigException("Service token file does not exist.")

        self._read_token_file()

        if not os.path.isfile(self._cert_filename):
            raise ConfigException(
                "Service certification file does not exist.")

        with open(self._cert_filename) as f:
            if not f.read():
                raise ConfigException("Cert file exists but empty.")

        self.ssl_ca_cert = self._cert_filename

    def _set_config(self, client_configuration):
        client_configuration.host = self.host
        client_configuration.ssl_ca_cert = self.ssl_ca_cert
        if self.token is not None:
            client_configuration.api_key['authorization'] = self.token
        if not self._try_refresh_token:
            return

        def load_token_from_file(*args):
            if self.token_expires_at <= datetime.datetime.now():
                self._read_token_file()
            return self.token

        client_configuration.get_api_key_with_prefix = load_token_from_file

    def _read_token_file(self):
        with open(self._token_filename) as f:
            content = f.read()
            if not content:
                raise ConfigException("Token file exists but empty.")
            self.token = "bearer " + content
            self.token_expires_at = datetime.datetime.now(
            ) + self._token_refresh_period


def load_incluster_config(client_configuration=None, try_refresh_token=True):
    """
    Use the service account kubernetes gives to pods to connect to kubernetes
    cluster. It's intended for clients that expect to be running inside a pod
    running on kubernetes. It will raise an exception if called from a process
    not running in a kubernetes environment."""
    InClusterConfigLoader(
        token_filename=SERVICE_TOKEN_FILENAME,
        cert_filename=SERVICE_CERT_FILENAME,
        try_refresh_token=try_refresh_token).load_and_set(client_configuration)