debian-mirror-gitlab/lib/gitlab/kubernetes/kube_client.rb

210 lines
6 KiB
Ruby
Raw Normal View History

2018-11-20 20:47:30 +05:30
# frozen_string_literal: true
require 'uri'
module Gitlab
module Kubernetes
# Wrapper around Kubeclient::Client to dispatch
# the right message to the client that can respond to the message.
# We must have a kubeclient for each ApiGroup as there is no
# other way to use the Kubeclient gem.
#
# See https://github.com/abonas/kubeclient/issues/348.
class KubeClient
include Gitlab::Utils::StrongMemoize
2018-12-13 13:39:08 +05:30
SUPPORTED_API_GROUPS = {
core: { group: 'api', version: 'v1' },
rbac: { group: 'apis/rbac.authorization.k8s.io', version: 'v1' },
2020-03-09 13:42:32 +05:30
apps: { group: 'apis/apps', version: 'v1' },
2019-02-15 15:39:39 +05:30
extensions: { group: 'apis/extensions', version: 'v1beta1' },
2020-03-09 13:42:32 +05:30
istio: { group: 'apis/networking.istio.io', version: 'v1alpha3' },
2019-02-15 15:39:39 +05:30
knative: { group: 'apis/serving.knative.dev', version: 'v1alpha1' }
2018-12-13 13:39:08 +05:30
}.freeze
SUPPORTED_API_GROUPS.each do |name, params|
client_method_name = "#{name}_client".to_sym
define_method(client_method_name) do
strong_memoize(client_method_name) do
build_kubeclient(params[:group], params[:version])
end
end
end
2018-11-20 20:47:30 +05:30
# Core API methods delegates to the core api group client
delegate :get_pods,
:get_secrets,
:get_config_map,
:get_namespace,
:get_pod,
2018-12-05 23:21:45 +05:30
:get_secret,
2018-11-20 20:47:30 +05:30
:get_service,
:get_service_account,
2019-12-21 20:55:43 +05:30
:delete_namespace,
2018-11-20 20:47:30 +05:30
:delete_pod,
2019-12-21 20:55:43 +05:30
:delete_service_account,
2018-11-20 20:47:30 +05:30
:create_config_map,
:create_namespace,
:create_pod,
2018-12-05 23:21:45 +05:30
:create_secret,
2018-11-20 20:47:30 +05:30
:create_service_account,
:update_config_map,
2019-02-15 15:39:39 +05:30
:update_secret,
2018-11-20 20:47:30 +05:30
:update_service_account,
to: :core_client
# RBAC methods delegates to the apis/rbac.authorization.k8s.io api
# group client
delegate :create_cluster_role_binding,
:get_cluster_role_binding,
:update_cluster_role_binding,
to: :rbac_client
2019-09-30 21:07:59 +05:30
# RBAC methods delegates to the apis/rbac.authorization.k8s.io api
# group client
delegate :create_role,
:get_role,
:update_role,
to: :rbac_client
2018-12-13 13:39:08 +05:30
# RBAC methods delegates to the apis/rbac.authorization.k8s.io api
# group client
delegate :create_role_binding,
:get_role_binding,
:update_role_binding,
to: :rbac_client
2018-11-20 20:47:30 +05:30
# non-entity methods that can only work with the core client
# as it uses the pods/log resource
delegate :get_pod_log,
:watch_pod_log,
to: :core_client
2020-03-09 13:42:32 +05:30
# Gateway methods delegate to the apis/networking.istio.io api
# group client
delegate :create_gateway,
:get_gateway,
:update_gateway,
to: :istio_client
2018-12-13 13:39:08 +05:30
attr_reader :api_prefix, :kubeclient_options
2018-11-20 20:47:30 +05:30
2020-03-09 13:42:32 +05:30
DEFAULT_KUBECLIENT_OPTIONS = {
timeouts: {
open: 10,
read: 30
}
}.freeze
2019-03-02 22:35:43 +05:30
# We disable redirects through 'http_max_redirects: 0',
# so that KubeClient does not follow redirects and
# expose internal services.
2018-12-13 13:39:08 +05:30
def initialize(api_prefix, **kubeclient_options)
2018-11-20 20:47:30 +05:30
@api_prefix = api_prefix
2020-03-09 13:42:32 +05:30
@kubeclient_options = DEFAULT_KUBECLIENT_OPTIONS
.deep_merge(kubeclient_options)
.merge(http_max_redirects: 0)
2019-03-13 22:55:13 +05:30
validate_url!
2018-11-20 20:47:30 +05:30
end
2020-03-09 13:42:32 +05:30
# Deployments resource is currently on the apis/extensions api group
# until Kubernetes 1.15. Kubernetest 1.16+ has deployments resources in
# the apis/apps api group.
#
# As we still support Kubernetes 1.12+, we will need to support both.
def get_deployments(**args)
extensions_client.discover unless extensions_client.discovered
if extensions_client.respond_to?(:get_deployments)
extensions_client.get_deployments(**args)
else
apps_client.get_deployments(**args)
end
end
2019-02-15 15:39:39 +05:30
def create_or_update_cluster_role_binding(resource)
if cluster_role_binding_exists?(resource)
update_cluster_role_binding(resource)
else
create_cluster_role_binding(resource)
end
end
def create_or_update_role_binding(resource)
if role_binding_exists?(resource)
update_role_binding(resource)
else
create_role_binding(resource)
end
end
def create_or_update_service_account(resource)
if service_account_exists?(resource)
update_service_account(resource)
else
create_service_account(resource)
end
end
def create_or_update_secret(resource)
if secret_exists?(resource)
update_secret(resource)
else
create_secret(resource)
end
end
2018-11-20 20:47:30 +05:30
private
2019-03-13 22:55:13 +05:30
def validate_url!
2019-10-12 21:52:04 +05:30
return if Gitlab::CurrentSettings.allow_local_requests_from_web_hooks_and_services?
2019-03-13 22:55:13 +05:30
Gitlab::UrlBlocker.validate!(api_prefix, allow_local_network: false)
end
2019-02-15 15:39:39 +05:30
def cluster_role_binding_exists?(resource)
get_cluster_role_binding(resource.metadata.name)
rescue ::Kubeclient::ResourceNotFoundError
false
end
def role_binding_exists?(resource)
get_role_binding(resource.metadata.name, resource.metadata.namespace)
rescue ::Kubeclient::ResourceNotFoundError
false
end
def service_account_exists?(resource)
get_service_account(resource.metadata.name, resource.metadata.namespace)
rescue ::Kubeclient::ResourceNotFoundError
false
end
def secret_exists?(resource)
get_secret(resource.metadata.name, resource.metadata.namespace)
rescue ::Kubeclient::ResourceNotFoundError
false
end
2018-12-13 13:39:08 +05:30
def build_kubeclient(api_group, api_version)
::Kubeclient::Client.new(
join_api_url(api_prefix, api_group),
api_version,
**kubeclient_options
)
2018-11-20 20:47:30 +05:30
end
def join_api_url(api_prefix, api_path)
url = URI.parse(api_prefix)
prefix = url.path.sub(%r{/+\z}, '')
url.path = [prefix, api_path].join("/")
url.to_s
end
end
end
end