Skip to content

Commit 832ed66

Browse files
author
Atharva Mulmuley
authored
Merge pull request #29 from Azure/cluster-connect-release-v1
Cluster connect release v1
2 parents 2f6bfda + 26974ad commit 832ed66

File tree

10 files changed

+606
-142
lines changed

10 files changed

+606
-142
lines changed

README.md

Lines changed: 48 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,17 @@
22

33
This action can be used to set cluster context before other actions like [`azure/k8s-deploy`](https://github.com/Azure/k8s-deploy/tree/master), [`azure/k8s-create-secret`](https://github.com/Azure/k8s-create-secret/tree/master) or any kubectl commands (in script) can be run subsequently in the workflow.
44

5-
There are two approaches for specifying the deployment target:
5+
It is a requirement to use [`azure/login`](https://github.com/Azure/login/tree/master) in your workflow before using this action.
6+
7+
There are three approaches for specifying the deployment target:
68

79
- Kubeconfig file provided as input to the action
810
- Service account approach where the secret associated with the service account is provided as input to the action
11+
- Service principal approach(only applicable for arc cluster) where service principal provided with 'creds' is used as input to action
912

10-
If inputs related to both these approaches are provided, kubeconfig approach related inputs are given precedence.
13+
If inputs related to all these approaches are provided, kubeconfig approach related inputs are given precedence.
1114

12-
In both these approaches it is recommended to store these contents (kubeconfig file content or secret content) in a [secret](https://developer.github.com/actions/managing-workflows/storing-secrets/) which could be referenced later in the action.
15+
In all these approaches it is recommended to store these contents (kubeconfig file content or secret content) in a [secret](https://developer.github.com/actions/managing-workflows/storing-secrets/) which could be referenced later in the action.
1316

1417
## Action inputs
1518

@@ -22,7 +25,7 @@ In both these approaches it is recommended to store these contents (kubeconfig f
2225
</thead>
2326
<tr>
2427
<td><code>method</code><br/>Method</td>
25-
<td>(Optional) Acceptable values: kubeconfig/service-account. Default value: kubeconfig</td>
28+
<td>(Optional) Acceptable values: kubeconfig/service-account/service-principal. Default value: kubeconfig</td>
2629
</tr>
2730
<tr>
2831
<td><code>kubeconfig</code><br/>Kubectl config</td>
@@ -40,6 +43,22 @@ In both these approaches it is recommended to store these contents (kubeconfig f
4043
<td><code>k8s-secret</code><br/>Secret</td>
4144
<td>(Relevant for service account approach) Secret associated with the service account to be used for deployments</td>
4245
</tr>
46+
<tr>
47+
<td><code>cluster-type</code><br/>Type of cluster</td>
48+
<td>Type of cluster. Acceptable values: generic/arc</td>
49+
</tr>
50+
<tr>
51+
<td><code>cluster-name</code><br/>Name of arc cluster</td>
52+
<td>Name of Azure Arc enabled Kubernetes cluster. Required only if cluster-type is 'arc'.</td>
53+
</tr>
54+
<tr>
55+
<td><code>resource-group</code><br/>resource group</td>
56+
<td>Resource group containing the Azure Arc enabled Kubernetes cluster. Required only if cluster-type is 'arc'.</td>
57+
</tr>
58+
<tr>
59+
<td><code>token</code><br/>Service account token</td>
60+
<td>Applicable for 'service-account' method.</td>
61+
</tr>
4362
</table>
4463

4564
## Example usage
@@ -101,6 +120,31 @@ kubectl get serviceAccounts <service-account-name> -n <namespace> -o 'jsonpath={
101120
kubectl get secret <service-account-secret-name> -n <namespace> -o yaml
102121
```
103122

123+
### Service account approach for arc cluster
124+
125+
```yaml
126+
- uses: azure/k8s-set-context@v1
127+
with:
128+
method: service-account
129+
cluster-type: 'arc'
130+
cluster-name: <cluster-name>
131+
resource-group: <resource-group>
132+
token: '${{ secrets.SA_TOKEN }}'
133+
id: setcontext
134+
```
135+
136+
### Service principal approach for arc cluster
137+
138+
```yaml
139+
- uses: azure/k8s-set-context@v1
140+
with:
141+
method: service-principal
142+
cluster-type: 'arc'
143+
cluster-name: <cluster-name>
144+
resource-group: <resource-group>
145+
id: setcontext
146+
```
147+
104148
## Contributing
105149
106150
This project welcomes contributions and suggestions. Most contributions require you to agree to a

action.yml

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,12 @@ name: 'Kubernetes set context'
22
description: 'Kubernetes set context'
33
inputs:
44
# Used for setting the target K8s cluster context which will be used by other actions like azure/k8s-actions/k8s-deploy or azure/k8s-actions/k8s-create-secret
5+
cluster-type:
6+
description: 'Acceptable values: generic or arc'
7+
required: true
8+
default: 'generic'
59
method:
6-
description: 'Acceptable values: kubeconfig or service-account'
10+
description: 'Acceptable values: kubeconfig or service-account or service-principal'
711
required: true
812
default: 'kubeconfig'
913
kubeconfig:
@@ -23,9 +27,21 @@ inputs:
2327
description: 'Service account secret. Run kubectl get serviceaccounts <service-account-name> -o yaml and copy the service-account-secret-name. Copy the ouptut of kubectl get secret <service-account-secret-name> -o yaml'
2428
required: false
2529
default: ''
30+
token:
31+
description: 'Token extracted from the secret of service account (should be base 64 decoded)'
32+
required: false
33+
default: ''
34+
resource-group:
35+
description: 'Azure resource group name'
36+
required: false
37+
default: ''
38+
cluster-name:
39+
description: 'Azure connected cluster name'
40+
required: false
41+
default: ''
2642

2743
branding:
2844
color: 'green' # optional, decorates the entry in the GitHub Marketplace
2945
runs:
3046
using: 'node12'
31-
main: 'lib/login.js'
47+
main: 'lib/login.js'

lib/arc-login.js

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
"use strict";
2+
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
3+
function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
4+
return new (P || (P = Promise))(function (resolve, reject) {
5+
function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
6+
function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
7+
function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
8+
step((generator = generator.apply(thisArg, _arguments || [])).next());
9+
});
10+
};
11+
Object.defineProperty(exports, "__esModule", { value: true });
12+
const core = require("@actions/core");
13+
const path = require("path");
14+
const child_process_1 = require("child_process");
15+
const fs = require("fs");
16+
const io = require("@actions/io");
17+
const exec = require("@actions/exec");
18+
var azPath;
19+
const kubeconfig_timeout = 120; //timeout in seconds
20+
function getArcKubeconfig() {
21+
return __awaiter(this, void 0, void 0, function* () {
22+
try {
23+
let method = core.getInput('method');
24+
if (method != 'service-account' && method != 'service-principal') {
25+
throw Error("Supported methods for arc cluster are 'service-account' and 'service-principal'.");
26+
}
27+
let resourceGroupName = core.getInput('resource-group');
28+
let clusterName = core.getInput('cluster-name');
29+
if (!resourceGroupName) {
30+
throw Error("'resourceGroupName' is not passed for arc cluster.");
31+
}
32+
if (!clusterName) {
33+
throw Error("'clusterName' is not passed for arc cluster.");
34+
}
35+
azPath = yield io.which("az", true);
36+
yield executeAzCliCommand(`account show`, false);
37+
try {
38+
yield executeAzCliCommand(`extension remove -n connectedk8s`, false);
39+
}
40+
catch (_a) {
41+
//ignore if this causes an error
42+
}
43+
yield executeAzCliCommand(`extension add -n connectedk8s`, false);
44+
yield executeAzCliCommand(`extension list`, false);
45+
const runnerTempDirectory = process.env['RUNNER_TEMP']; // Using process.env until the core libs are updated
46+
const kubeconfigPath = path.join(runnerTempDirectory, `kubeconfig_${Date.now()}`);
47+
if (method == 'service-account') {
48+
let saToken = core.getInput('token');
49+
if (!saToken) {
50+
throw Error("'saToken' is not passed for 'service-account' method.");
51+
}
52+
console.log("using 'service-account' method for authenticating to arc cluster.");
53+
const proc = child_process_1.spawn(azPath, ['connectedk8s', 'proxy', '-n', clusterName, '-g', resourceGroupName, '-f', kubeconfigPath, '--token', saToken], {
54+
detached: true,
55+
stdio: 'ignore'
56+
});
57+
proc.unref();
58+
}
59+
else {
60+
console.log("using 'service-principal' method for authenticating to arc cluster.");
61+
const proc = child_process_1.spawn(azPath, ['connectedk8s', 'proxy', '-n', clusterName, '-g', resourceGroupName, '-f', kubeconfigPath], {
62+
detached: true,
63+
stdio: 'ignore'
64+
});
65+
proc.unref();
66+
}
67+
console.log(`Waiting for ${kubeconfig_timeout} seconds for kubeconfig to be merged....`);
68+
yield sleep(kubeconfig_timeout * 1000); //sleeping for 2 minutes to allow kubeconfig to be merged
69+
fs.chmodSync(kubeconfigPath, '600');
70+
core.exportVariable('KUBECONFIG', kubeconfigPath);
71+
console.log('KUBECONFIG environment variable is set');
72+
}
73+
catch (ex) {
74+
return Promise.reject(ex);
75+
}
76+
});
77+
}
78+
exports.getArcKubeconfig = getArcKubeconfig;
79+
function sleep(ms) {
80+
return new Promise(resolve => setTimeout(resolve, ms));
81+
}
82+
function executeAzCliCommand(command, silent, execOptions = {}, args = []) {
83+
return __awaiter(this, void 0, void 0, function* () {
84+
execOptions.silent = !!silent;
85+
try {
86+
yield exec.exec(`"${azPath}" ${command}`, args, execOptions);
87+
}
88+
catch (error) {
89+
throw new Error(error);
90+
}
91+
});
92+
}

lib/client.js

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
"use strict";
2+
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
3+
function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
4+
return new (P || (P = Promise))(function (resolve, reject) {
5+
function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
6+
function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
7+
function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
8+
step((generator = generator.apply(thisArg, _arguments || [])).next());
9+
});
10+
};
11+
Object.defineProperty(exports, "__esModule", { value: true });
12+
const util = require("util");
13+
const fs = require("fs");
14+
const httpClient = require("typed-rest-client/HttpClient");
15+
const core = require("@actions/core");
16+
var httpCallbackClient = new httpClient.HttpClient('GITHUB_RUNNER', null, {});
17+
class WebRequest {
18+
}
19+
exports.WebRequest = WebRequest;
20+
class WebResponse {
21+
}
22+
exports.WebResponse = WebResponse;
23+
class WebRequestOptions {
24+
}
25+
exports.WebRequestOptions = WebRequestOptions;
26+
function sendRequest(request, options) {
27+
return __awaiter(this, void 0, void 0, function* () {
28+
let i = 0;
29+
let retryCount = options && options.retryCount ? options.retryCount : 5;
30+
let retryIntervalInSeconds = options && options.retryIntervalInSeconds ? options.retryIntervalInSeconds : 2;
31+
let retriableErrorCodes = options && options.retriableErrorCodes ? options.retriableErrorCodes : ["ETIMEDOUT", "ECONNRESET", "ENOTFOUND", "ESOCKETTIMEDOUT", "ECONNREFUSED", "EHOSTUNREACH", "EPIPE", "EA_AGAIN"];
32+
let retriableStatusCodes = options && options.retriableStatusCodes ? options.retriableStatusCodes : [408, 409, 500, 502, 503, 504];
33+
let timeToWait = retryIntervalInSeconds;
34+
while (true) {
35+
try {
36+
if (request.body && typeof (request.body) !== 'string' && !request.body["readable"]) {
37+
request.body = fs.createReadStream(request.body["path"]);
38+
}
39+
let response = yield sendRequestInternal(request);
40+
if (retriableStatusCodes.indexOf(response.statusCode) != -1 && ++i < retryCount) {
41+
core.debug(util.format("Encountered a retriable status code: %s. Message: '%s'.", response.statusCode, response.statusMessage));
42+
yield sleepFor(timeToWait);
43+
timeToWait = timeToWait * retryIntervalInSeconds + retryIntervalInSeconds;
44+
continue;
45+
}
46+
return response;
47+
}
48+
catch (error) {
49+
if (retriableErrorCodes.indexOf(error.code) != -1 && ++i < retryCount) {
50+
core.debug(util.format("Encountered a retriable error:%s. Message: %s.", error.code, error.message));
51+
yield sleepFor(timeToWait);
52+
timeToWait = timeToWait * retryIntervalInSeconds + retryIntervalInSeconds;
53+
}
54+
else {
55+
if (error.code) {
56+
core.debug("error code =" + error.code);
57+
}
58+
throw error;
59+
}
60+
}
61+
}
62+
});
63+
}
64+
exports.sendRequest = sendRequest;
65+
function sleepFor(sleepDurationInSeconds) {
66+
return new Promise((resolve, reject) => {
67+
setTimeout(resolve, sleepDurationInSeconds * 1000);
68+
});
69+
}
70+
exports.sleepFor = sleepFor;
71+
function sendRequestInternal(request) {
72+
return __awaiter(this, void 0, void 0, function* () {
73+
core.debug(util.format("[%s]%s", request.method, request.uri));
74+
var response = yield httpCallbackClient.request(request.method, request.uri, request.body, request.headers);
75+
return yield toWebResponse(response);
76+
});
77+
}
78+
function toWebResponse(response) {
79+
return __awaiter(this, void 0, void 0, function* () {
80+
var res = new WebResponse();
81+
if (response) {
82+
res.statusCode = response.message.statusCode;
83+
res.statusMessage = response.message.statusMessage;
84+
res.headers = response.message.headers;
85+
var body = yield response.readBody();
86+
if (body) {
87+
try {
88+
res.body = JSON.parse(body);
89+
}
90+
catch (error) {
91+
core.debug("Could not parse response: " + JSON.stringify(error));
92+
core.debug("Response: " + JSON.stringify(res.body));
93+
res.body = body;
94+
}
95+
}
96+
}
97+
return res;
98+
});
99+
}

0 commit comments

Comments
 (0)