Examples with SecretBuilder io.fabric8.kubernetes.api.model.SecretBuilder used on opensource projects

Example 1 with SecretBuilder

use of io.fabric8.kubernetes.api.model.SecretBuilder in project curiostack by curioswitch.

the class RequestNamespaceCertTask method exec.

@TaskAction
public void exec() {
    ImmutableClusterExtension cluster = getProject().getExtensions().getByType(ClusterExtension.class);
    final KeyPairGenerator keygen;
    try {
        keygen = KeyPairGenerator.getInstance("ECDSA", BouncyCastleProvider.PROVIDER_NAME);
    } catch (NoSuchAlgorithmException | NoSuchProviderException e) {
        throw new IllegalStateException("Could not find RSA, can't happen.", e);
    }
    keygen.initialize(256, new SecureRandom());
    KeyPair keyPair = keygen.generateKeyPair();
    PKCS10CertificationRequestBuilder p10Builder = new JcaPKCS10CertificationRequestBuilder(new X500Principal("CN=" + cluster.namespace() + ".ns.cluster.stellarstation.com"), keyPair.getPublic());
    Stream<GeneralName> generalNames = Streams.concat(Stream.of(new GeneralName(GeneralName.dNSName, "*." + cluster.namespace()), new GeneralName(GeneralName.dNSName, "*." + cluster.namespace() + ".svc"), new GeneralName(GeneralName.dNSName, "*." + cluster.namespace() + ".svc.cluster.local")), cluster.extraNamespaceTlsHosts().stream().map(name -> new GeneralName(GeneralName.dNSName, name)));
    GeneralNames subjectAltNames = new GeneralNames(generalNames.toArray(GeneralName[]::new));
    ExtensionsGenerator extensions = new ExtensionsGenerator();
    try {
        extensions.addExtension(Extension.subjectAlternativeName, false, subjectAltNames);
        p10Builder.setAttribute(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest, extensions.generate());
    } catch (IOException e) {
        throw new IllegalStateException("Could not encode cert name, can't happen.", e);
    }
    final ContentSigner signer;
    try {
        signer = new JcaContentSignerBuilder("SHA256withECDSA").build(keyPair.getPrivate());
    } catch (OperatorCreationException e) {
        throw new IllegalStateException("Could not find signer, can't happen.", e);
    }
    PKCS10CertificationRequest csr = p10Builder.build(signer);
    StringWriter csrWriter = new StringWriter();
    try (JcaPEMWriter pemWriter = new JcaPEMWriter(csrWriter)) {
        pemWriter.writeObject(csr);
    } catch (IOException e) {
        throw new IllegalStateException("Could not encode csr, can't happen.", e);
    }
    String encodedCsr = Base64.getEncoder().encodeToString(csrWriter.toString().getBytes(StandardCharsets.UTF_8));
    Map<Object, Object> csrApiRequest = ImmutableMap.of("apiVersion", "certificates.k8s.io/v1beta1", "kind", "CertificateSigningRequest", "metadata", ImmutableMap.of("name", cluster.namespace() + ".server.crt"), "spec", ImmutableMap.of("request", encodedCsr, "usages", ImmutableList.of("digital signature", "key encipherment", "server auth", "client auth")));
    final byte[] encodedApiRequest;
    try {
        encodedApiRequest = OBJECT_MAPPER.writeValueAsBytes(csrApiRequest);
    } catch (JsonProcessingException e) {
        throw new IllegalStateException("Could not encode yaml", e);
    }
    ImmutableGcloudExtension config = getProject().getRootProject().getExtensions().getByType(GcloudExtension.class);
    String command = config.download() ? CommandUtil.getGcloudSdkBinDir(getProject()).resolve("kubectl").toAbsolutePath().toString() : "kubectl";
    getProject().exec(exec -> {
        exec.executable(command);
        exec.args("create", "-f", "-");
        exec.setStandardInput(new ByteArrayInputStream(encodedApiRequest));
    });
    getProject().exec(exec -> {
        exec.executable(command);
        exec.args("certificate", "approve", cluster.namespace() + ".server.crt");
    });
    // Need to wait a bit for certificate to propagate before fetching.
    try {
        TimeUnit.SECONDS.sleep(5);
    } catch (InterruptedException e) {
        throw new RuntimeException(e);
    }
    // Gradle Exec seems to be flaky when reading from stdout, so use normal ProcessBuilder.
    final byte[] certificateBytes;
    try {
        Process getCertProcess = new ProcessBuilder(command, "get", "csr", cluster.namespace() + ".server.crt", "-o", "jsonpath={.status.certificate}").start();
        certificateBytes = ByteStreams.toByteArray(getCertProcess.getInputStream());
    } catch (IOException e) {
        throw new UncheckedIOException("Could not fetch certificate.", e);
    }
    String certificate = new String(Base64.getDecoder().decode(certificateBytes), StandardCharsets.UTF_8);
    final JcaPKCS8Generator keyGenerator;
    final PemObject keyObject;
    try {
        keyGenerator = new JcaPKCS8Generator(keyPair.getPrivate(), null);
        keyObject = keyGenerator.generate();
    } catch (PemGenerationException e) {
        throw new IllegalStateException("Could not encode to pkcs8.", e);
    }
    StringWriter keyWriter = new StringWriter();
    try (JcaPEMWriter pemWriter = new JcaPEMWriter(keyWriter)) {
        pemWriter.writeObject(keyObject);
    } catch (IOException e) {
        throw new IllegalStateException("Could not encode csr, can't happen.", e);
    }
    String key = keyWriter.toString();
    KubernetesClient client = new DefaultKubernetesClient();
    Secret certificateSecret = new SecretBuilder().withMetadata(new ObjectMetaBuilder().withName("server-tls").withNamespace(cluster.namespace()).build()).withType("Opaque").withData(ImmutableMap.of("server.crt", Base64.getEncoder().encodeToString(certificate.getBytes(StandardCharsets.UTF_8)), "server-key.pem", Base64.getEncoder().encodeToString(key.getBytes(StandardCharsets.UTF_8)))).build();
    client.resource(certificateSecret).createOrReplace();
}

Example 2 with SecretBuilder

use of io.fabric8.kubernetes.api.model.SecretBuilder in project fabric8-maven-plugin by fabric8io.

the class DockerRegistrySecretEnricherTest method createBaseSecret.

private Secret createBaseSecret(boolean withAnnotation) {
    ObjectMetaBuilder metaBuilder = new ObjectMetaBuilder().withNamespace("default");
    if (withAnnotation) {
        Map<String, String> annotations = new HashMap<>();
        annotations.put(annotation, dockerUrl);
        metaBuilder = metaBuilder.withAnnotations(annotations);
    }
    Map<String, String> data = new HashMap<>();
    return new SecretBuilder().withData(data).withMetadata(metaBuilder.build()).withType(SecretConstants.DOCKER_CONFIG_TYPE).build();
}

Example 3 with SecretBuilder

use of io.fabric8.kubernetes.api.model.SecretBuilder in project fabric8-maven-plugin by fabric8io.

the class SecretEnricher method addMissingResources.

@Override
public void addMissingResources(KubernetesListBuilder builder) {
    Map<String, String> config = getRawConfig();
    SecretBuilder secretBuilder = createSecretBuilder();
    for (Map.Entry<String, String> entry : config.entrySet()) {
        if (!isTypedKey(entry.getKey())) {
            addToSecretBuilder(secretBuilder, entry.getKey(), entry.getValue());
        }
    }
    if (secretBuilder.hasData() && secretBuilder.getData().size() > 0) {
        builder.addToSecretItems(secretBuilder.build());
    }
}

Example 4 with SecretBuilder

use of io.fabric8.kubernetes.api.model.SecretBuilder in project syndesis by syndesisio.

the class OpenShiftServiceImplTest method testDeploy.

@SuppressWarnings({ "PMD.ExcessiveMethodLength", "PMD.JUnitTestsShouldIncludeAssert" })
@Test
public void testDeploy() {
    String name = "test-deployment";
    OpenShiftConfigurationProperties config = new OpenShiftConfigurationProperties();
    OpenShiftServiceImpl service = new OpenShiftServiceImpl(client, config);
    DeploymentData deploymentData = new DeploymentData.Builder().addAnnotation("testName", testName.getMethodName()).addLabel("type", "test").addSecretEntry("secret-key", "secret-val").withImage("testimage").build();
    ImageStream expectedImageStream = new ImageStreamBuilder().withNewMetadata().withName(name).endMetadata().build();
    Secret expectedSecret = new SecretBuilder().withNewMetadata().withName(name).addToAnnotations(deploymentData.getAnnotations()).addToLabels(deploymentData.getLabels()).endMetadata().withStringData(deploymentData.getSecret()).build();
    DeploymentConfig expectedDeploymentConfig = new DeploymentConfigBuilder().withNewMetadata().withName(OpenShiftServiceImpl.openshiftName(name)).addToAnnotations(deploymentData.getAnnotations()).addToLabels(deploymentData.getLabels()).endMetadata().withNewSpec().withReplicas(1).addToSelector("integration", name).withNewStrategy().withType("Recreate").withNewResources().addToLimits("memory", new Quantity(config.getDeploymentMemoryLimitMi() + "Mi")).addToRequests("memory", new Quantity(config.getDeploymentMemoryRequestMi() + "Mi")).endResources().endStrategy().withRevisionHistoryLimit(0).withNewTemplate().withNewMetadata().addToLabels("integration", name).addToLabels(OpenShiftServiceImpl.COMPONENT_LABEL, "integration").addToLabels(deploymentData.getLabels()).addToAnnotations(deploymentData.getAnnotations()).addToAnnotations("prometheus.io/scrape", "true").addToAnnotations("prometheus.io/port", "9779").endMetadata().withNewSpec().addNewContainer().withImage(deploymentData.getImage()).withImagePullPolicy("Always").withName(name).addToEnv(new EnvVarBuilder().withName("LOADER_HOME").withValue(config.getIntegrationDataPath()).build()).addToEnv(new EnvVarBuilder().withName("AB_JMX_EXPORTER_CONFIG").withValue("/tmp/src/prometheus-config.yml").build()).addNewPort().withName("jolokia").withContainerPort(8778).endPort().addNewVolumeMount().withName("secret-volume").withMountPath("/deployments/config").withReadOnly(false).endVolumeMount().endContainer().addNewVolume().withName("secret-volume").withNewSecret().withSecretName(expectedSecret.getMetadata().getName()).endSecret().endVolume().endSpec().endTemplate().addNewTrigger().withType("ConfigChange").endTrigger().endSpec().withNewStatus().withLatestVersion(1L).endStatus().build();
    server.expect().withPath("/oapi/v1/namespaces/test/imagestreams").andReturn(200, expectedImageStream).always();
    server.expect().withPath("/api/v1/namespaces/test/secrets").andReturn(200, expectedSecret).always();
    server.expect().withPath("/oapi/v1/namespaces/test/deploymentconfigs").andReturn(200, expectedDeploymentConfig).always();
    server.expect().withPath("/oapi/v1/namespaces/test/deploymentconfigs/i-test-deployment").andReturn(200, expectedDeploymentConfig).always();
    server.expect().withPath("/oapi/v1/namespaces/test/deploymentconfigs/test-deployment").andReturn(200, expectedDeploymentConfig).always();
    service.deploy(name, deploymentData);
}

Example 5 with SecretBuilder

use of io.fabric8.kubernetes.api.model.SecretBuilder in project fabric8-maven-plugin by fabric8io.

the class ImportMojo method findOrCreateGitSecret.

private Secret findOrCreateGitSecret(KubernetesClient kubernetes, String secretName, String repositoryHost) {
    String secretNamespace = getSecretNamespace();
    ensureNamespaceExists(kubernetes, secretNamespace);
    Secret gogsSecret = kubernetes.secrets().inNamespace(secretNamespace).withName(secretName).get();
    if (gogsSecret == null) {
        // lets create a new secret!
        Map<String, String> labels = new HashMap<>();
        labels.put("provider", "fabric8");
        labels.put("repository", repositoryHost);
        labels.put("scm", "git");
        gogsSecret = new SecretBuilder().withNewMetadata().withName(secretName).withLabels(labels).endMetadata().withData(new HashMap<String, String>()).build();
    }
    return gogsSecret;
}