fix(kapsule): allow getting kubeconfig with readonly permission (#5049)

Author: jtherin

internal/namespaces/k8s/v1/custom_cluster_test.go

@@ -10,7 +10,7 @@ import (
 func Test_GetCluster(t *testing.T) {
 	t.Run("Simple", core.Test(&core.TestConfig{
 		Commands:   k8s.GetCommands(),
-		BeforeFunc: createCluster("get-cluster", 1, "DEV1-M"),
+		BeforeFunc: createCluster("get-cluster", false),
 		Cmd:        "scw k8s cluster get {{ .Cluster.ID }}",
 		Check: core.TestCheckCombine(
 			core.TestCheckGolden(),
@@ -23,7 +23,7 @@ func Test_GetCluster(t *testing.T) {
 func Test_WaitCluster(t *testing.T) {
 	t.Run("wait for pools", core.Test(&core.TestConfig{
 		Commands:   k8s.GetCommands(),
-		BeforeFunc: createCluster("wait-cluster", 1, "GP1-XS"),
+		BeforeFunc: createCluster("wait-cluster", false),
 		Cmd:        "scw k8s cluster wait {{ .Cluster.ID }} wait-for-pools=true",
 		Check: core.TestCheckCombine(
 			core.TestCheckGolden(),

internal/namespaces/k8s/v1/custom_kubeconfig_get.go

@@ -72,6 +72,9 @@ func k8sKubeconfigGetRun(ctx context.Context, argsI any) (i any, e error) {
 		GetClusterKubeConfig(&k8s.GetClusterKubeConfigRequest{
 			Region:    request.Region,
 			ClusterID: request.ClusterID,
+			Redacted: scw.BoolPtr(
+				request.AuthMethod != authMethodLegacy,
+			), // put true after legacy deprecation
 		})
 	if err != nil {
 		return nil, err

internal/namespaces/k8s/v1/custom_kubeconfig_get_test.go

@@ -17,11 +17,11 @@ func Test_GetKubeconfig(t *testing.T) {
 	////
 	// Simple use case
 	////
-
 	t.Run("simple", core.Test(&core.TestConfig{
 		Commands: k8s.GetCommands(),
-		BeforeFunc: createClusterAndWaitAndKubeconfig(
-			"get-kubeconfig-simple",
+		BeforeFunc: core.BeforeFuncCombine(
+			createCluster("get-kubeconfig-simple", true),
+			fetchClusterKubeconfigMetadata(true),
 		),
 		Cmd: "scw k8s kubeconfig get {{ ." + clusterMetaKey + ".ID }}",
 		OverrideEnv: map[string]string{
@@ -81,8 +81,9 @@ func Test_GetKubeconfig(t *testing.T) {
 	////
 	t.Run("with_flags", core.Test(&core.TestConfig{
 		Commands: k8s.GetCommands(),
-		BeforeFunc: createClusterAndWaitAndKubeconfig(
-			"get-kubeconfig-with-flags",
+		BeforeFunc: core.BeforeFuncCombine(
+			createCluster("get-kubeconfig-with-flags", true),
+			fetchClusterKubeconfigMetadata(true),
 		),
 		Cmd: "scw k8s --profile=default kubeconfig get {{ ." + clusterMetaKey + ".ID }}",
 		OverrideEnv: map[string]string{
@@ -147,8 +148,9 @@ func Test_GetKubeconfig(t *testing.T) {
 
 	t.Run("with_envs", core.Test(&core.TestConfig{
 		Commands: k8s.GetCommands(),
-		BeforeFunc: createClusterAndWaitAndKubeconfig(
-			"get-kubeconfig-with-envs",
+		BeforeFunc: core.BeforeFuncCombine(
+			createCluster("get-kubeconfig-with-envs", true),
+			fetchClusterKubeconfigMetadata(true),
 		),
 		Cmd: "scw k8s kubeconfig get {{ ." + clusterMetaKey + ".ID }}",
 		OverrideEnv: map[string]string{
@@ -212,8 +214,9 @@ func Test_GetKubeconfig(t *testing.T) {
 	////
 	t.Run("with_flags_and_envs", core.Test(&core.TestConfig{
 		Commands: k8s.GetCommands(),
-		BeforeFunc: createClusterAndWaitAndKubeconfig(
-			"get-kubeconfig-with-flags-and-envs",
+		BeforeFunc: core.BeforeFuncCombine(
+			createCluster("get-kubeconfig-with-flags-and-envs", true),
+			fetchClusterKubeconfigMetadata(true),
 		),
 		Cmd: "scw --profile=default k8s kubeconfig get {{ ." + clusterMetaKey + ".ID }}",
 		OverrideEnv: map[string]string{
@@ -283,10 +286,12 @@ func Test_GetKubeconfig(t *testing.T) {
 	t.Run("legacy", core.Test(&core.TestConfig{
 		Commands: k8s.GetCommands(),
 		Cmd:      "scw k8s kubeconfig get {{ ." + clusterMetaKey + ".ID }} auth-method=legacy",
-		BeforeFunc: createClusterAndWaitAndKubeconfig(
-			"get-kubeconfig-legacy",
+		BeforeFunc: core.BeforeFuncCombine(
+			createCluster("get-kubeconfig-legacy", true),
+			fetchClusterKubeconfigMetadata(false),
 		),
 		Check: core.TestCheckCombine(
+			core.TestCheckGolden(),
 			core.TestCheckExitCode(0),
 			func(t *testing.T, ctx *core.CheckFuncCtx) {
 				t.Helper()
@@ -304,8 +309,9 @@ func Test_GetKubeconfig(t *testing.T) {
 	////
 	t.Run("copy_cli_token", core.Test(&core.TestConfig{
 		Commands: k8s.GetCommands(),
-		BeforeFunc: createClusterAndWaitAndKubeconfig(
-			"get-kubeconfig-copy-cli-token",
+		BeforeFunc: core.BeforeFuncCombine(
+			createCluster("get-kubeconfig-copy-cli-token", true),
+			fetchClusterKubeconfigMetadata(true),
 		),
 		Cmd: "scw k8s kubeconfig get {{ ." + clusterMetaKey + ".ID }} auth-method=copy-cli-token",
 		OverrideEnv: map[string]string{

internal/namespaces/k8s/v1/custom_kubeconfig_install.go

@@ -86,6 +86,9 @@ func k8sKubeconfigInstallRun(ctx context.Context, argsI any) (i any, e error) {
 		GetClusterKubeConfig(&k8s.GetClusterKubeConfigRequest{
 			Region:    request.Region,
 			ClusterID: request.ClusterID,
+			Redacted: scw.BoolPtr(
+				request.AuthMethod != authMethodLegacy,
+			), // put true after legacy deprecation
 		})
 	if err != nil {
 		return nil, err

internal/namespaces/k8s/v1/custom_kubeconfig_install_test.go

@@ -48,8 +48,9 @@ func Test_InstallKubeconfig(t *testing.T) {
 	t.Run("simple", core.Test(&core.TestConfig{
 		Commands:   k8s.GetCommands(),
 		TmpHomeDir: true,
-		BeforeFunc: createClusterAndWaitAndKubeconfig(
-			"install-kubeconfig-simple",
+		BeforeFunc: core.BeforeFuncCombine(
+			createCluster("install-kubeconfig-simple", true),
+			fetchClusterKubeconfigMetadata(true),
 		),
 		Cmd: "scw k8s kubeconfig install {{ ." + clusterMetaKey + ".ID }}",
 		Check: core.TestCheckCombine(
@@ -101,9 +102,10 @@ func Test_InstallKubeconfig(t *testing.T) {
 	t.Run("merge", core.Test(&core.TestConfig{
 		Commands:   k8s.GetCommands(),
 		TmpHomeDir: true,
-		BeforeFunc: populateKubeconfigAndCreateCluster(
-			[]byte(existingKubeconfig),
-			"install-kubeconfig-merge",
+		BeforeFunc: core.BeforeFuncCombine(
+			writeKubeconfigFile([]byte(existingKubeconfig)),
+			createCluster("install-kubeconfig-merge", true),
+			fetchClusterKubeconfigMetadata(true),
 		),
 		Cmd: "scw k8s kubeconfig install {{ ." + clusterMetaKey + ".ID }}",
 		Check: core.TestCheckCombine(
@@ -165,9 +167,10 @@ func Test_InstallKubeconfig(t *testing.T) {
 	t.Run("merge-keep", core.Test(&core.TestConfig{
 		Commands:   k8s.GetCommands(),
 		TmpHomeDir: true,
-		BeforeFunc: populateKubeconfigAndCreateCluster(
-			[]byte(existingKubeconfig),
-			"install-kubeconfig-merge-keep",
+		BeforeFunc: core.BeforeFuncCombine(
+			writeKubeconfigFile([]byte(existingKubeconfig)),
+			createCluster("install-kubeconfig-merge-keep", true),
+			fetchClusterKubeconfigMetadata(true),
 		),
 		Cmd: "scw k8s kubeconfig install {{ ." + clusterMetaKey + ".ID }} keep-current-context=true",
 		Check: core.TestCheckCombine(
@@ -241,9 +244,10 @@ func Test_InstallKubeconfig(t *testing.T) {
 		testConfig := &core.TestConfig{
 			Commands:   k8s.GetCommands(),
 			TmpHomeDir: true,
-			BeforeFunc: populateKubeconfigAndCreateCluster(
-				[]byte(existingKubeconfig),
-				"install-kubeconfig-merge-kubeconfig",
+			BeforeFunc: core.BeforeFuncCombine(
+				writeKubeconfigFile([]byte(existingKubeconfig)),
+				createCluster("install-kubeconfig-merge-kubeconfig", true),
+				fetchClusterKubeconfigMetadata(true),
 			),
 			Cmd: "scw k8s kubeconfig install {{ ." + clusterMetaKey + ".ID }}",
 			Check: core.TestCheckCombine(

internal/namespaces/k8s/v1/custom_kubeconfig_uninstall_test.go

@@ -1,7 +1,6 @@
 package k8s_test
 
 import (
-	"errors"
 	"os"
 	"path"
 	"strings"
@@ -203,24 +202,11 @@ func Test_UninstallKubeconfig(t *testing.T) {
 	t.Run("uninstall_real_merge", core.Test(&core.TestConfig{
 		Commands:   k8s.GetCommands(),
 		TmpHomeDir: true,
-		BeforeFunc: func(ctx *core.BeforeFuncCtx) error {
-			bfunc := populateKubeconfigAndCreateCluster(
-				[]byte(uninstallKubeconfig),
-				"uninstall-kubeconfig-merge",
-			)
-			if err := bfunc(ctx); err != nil {
-				return err
-			}
-
-			cluster := ctx.Meta[clusterMetaKey].(*k8sSDK.Cluster)
-			cmd := "scw k8s kubeconfig install " + cluster.ID
-			installOut := ctx.ExecuteCmd(strings.Split(cmd, " "))
-			if !strings.Contains(installOut.(string), "successfully written") {
-				return errors.New("kubeconfig install failed")
-			}
-
-			return nil
-		},
+		BeforeFunc: core.BeforeFuncCombine(
+			createCluster("uninstall-kubeconfig-merge", true),
+			fetchClusterKubeconfigMetadata(true),
+			cliInstallKubeconfig(),
+		),
 		Cmd: "scw k8s kubeconfig uninstall {{ ." + clusterMetaKey + ".ID }}",
 		Check: core.TestCheckCombine(
 			// no golden tests since it's os specific

internal/namespaces/k8s/v1/helpers_test.go

@@ -1,6 +1,7 @@
 package k8s_test
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path"
@@ -10,6 +11,7 @@ import (
 	"github.com/scaleway/scaleway-cli/v2/core"
 	go_api "github.com/scaleway/scaleway-cli/v2/internal/namespaces/k8s/v1/types"
 	k8s "github.com/scaleway/scaleway-sdk-go/api/k8s/v1"
+	"github.com/scaleway/scaleway-sdk-go/scw"
 )
 
 const (
@@ -26,40 +28,35 @@ const (
 // register it in the context Meta at metaKey.
 func createCluster(
 	clusterNameSuffix string,
-	poolSize int,
-	nodeType string,
+	wait bool,
 ) core.BeforeFunc {
+	format := "scw k8s cluster create name=cli-test-%s version=%s cni=cilium pools.0.node-type=DEV1-M pools.0.size=1 pools.0.name=default"
+	if wait {
+		format += " --wait"
+	}
+
 	return core.ExecStoreBeforeCmd(
 		clusterMetaKey,
 		fmt.Sprintf(
-			"scw k8s cluster create name=cli-test-%s version=%s cni=cilium pools.0.node-type=%s pools.0.size=%d pools.0.name=default",
+			format,
 			clusterNameSuffix,
 			kapsuleVersion,
-			nodeType,
-			poolSize,
 		),
 	)
 }
 
-// createClusterAndWaitAndKubeconfig creates a basic cluster with 1 dev1-m as node, the given version and
-// register it in the context Meta at metaKey.
-func createClusterAndWaitAndKubeconfig(
-	clusterNameSuffix string,
+// fetchClusterKubeconfigMetadata fetch kubeconfig of previously created cluster.
+func fetchClusterKubeconfigMetadata(
+	redacted bool,
 ) core.BeforeFunc {
 	return func(ctx *core.BeforeFuncCtx) error {
-		cmd := fmt.Sprintf(
-			"scw k8s cluster create name=cli-test-%s version=%s cni=cilium pools.0.node-type=DEV1-M pools.0.size=1 pools.0.name=default --wait",
-			clusterNameSuffix,
-			kapsuleVersion,
-		)
-		res := ctx.ExecuteCmd(strings.Split(cmd, " "))
-		cluster := res.(*k8s.Cluster)
-		ctx.Meta[clusterMetaKey] = cluster
+		cluster := ctx.Meta[clusterMetaKey].(*k8s.Cluster)
 
 		apiKubeconfig, err := k8s.NewAPI(ctx.Client).
 			GetClusterKubeConfig(&k8s.GetClusterKubeConfigRequest{
 				Region:    cluster.Region,
 				ClusterID: cluster.ID,
+				Redacted:  scw.BoolPtr(redacted),
 			})
 		if err != nil {
 			return err
@@ -75,25 +72,28 @@ func createClusterAndWaitAndKubeconfig(
 	}
 }
 
-func populateKubeconfigAndCreateCluster(
-	kubeconfigRaw []byte,
-	clusterNameSuffix string,
-) core.BeforeFunc {
+func writeKubeconfigFile(kubeconfigRaw []byte) core.BeforeFunc {
 	return func(ctx *core.BeforeFuncCtx) error {
 		// Populate $HOME/.kube/config with existing data
 		kubeconfigPath := path.Join(ctx.Meta["HOME"].(string), ".kube", "config")
 		if err := os.MkdirAll(path.Dir(kubeconfigPath), 0o755); err != nil {
 			return err
 		}
 
-		if err := os.WriteFile(kubeconfigPath, kubeconfigRaw, 0o600); err != nil {
-			return err
+		return os.WriteFile(kubeconfigPath, kubeconfigRaw, 0o600)
+	}
+}
+
+func cliInstallKubeconfig() core.BeforeFunc {
+	return func(ctx *core.BeforeFuncCtx) error {
+		cluster := ctx.Meta[clusterMetaKey].(*k8s.Cluster)
+		cmd := "scw k8s kubeconfig install " + cluster.ID
+		installOut := ctx.ExecuteCmd(strings.Split(cmd, " "))
+		if !strings.Contains(installOut.(string), "successfully written") {
+			return errors.New("kubeconfig install failed")
 		}
 
-		// Then create a cluster
-		return createClusterAndWaitAndKubeconfig(
-			clusterNameSuffix,
-		)(ctx)
+		return nil
 	}
 }