1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
|
#!/usr/bin/python
# -*- coding: utf-8 -*-
# vim: expandtab:tabstop=4:shiftwidth=4
''' kubeclient_ca ansible module '''
import base64
import yaml
from ansible.module_utils.basic import AnsibleModule
DOCUMENTATION = '''
---
module: kubeclient_ca
short_description: Modify kubeclient certificate-authority-data
author: Andrew Butcher
requirements: [ ]
'''
EXAMPLES = '''
- kubeclient_ca:
client_path: /etc/origin/master/admin.kubeconfig
ca_path: /etc/origin/master/ca-bundle.crt
- slurp:
src: /etc/origin/master/ca-bundle.crt
register: ca_data
- kubeclient_ca:
client_path: /etc/origin/master/admin.kubeconfig
ca_data: "{{ ca_data.content }}"
'''
def main():
''' Modify kubeconfig located at `client_path`, setting the
certificate authority data to specified `ca_data` or contents of
`ca_path`.
'''
module = AnsibleModule( # noqa: F405
argument_spec=dict(
client_path=dict(required=True),
ca_data=dict(required=False, default=None),
ca_path=dict(required=False, default=None),
backup=dict(required=False, default=True, type='bool'),
),
supports_check_mode=True,
mutually_exclusive=[['ca_data', 'ca_path']],
required_one_of=[['ca_data', 'ca_path']]
)
client_path = module.params['client_path']
ca_data = module.params['ca_data']
ca_path = module.params['ca_path']
backup = module.params['backup']
try:
with open(client_path) as client_config_file:
client_config_data = yaml.safe_load(client_config_file.read())
if ca_data is None:
with open(ca_path) as ca_file:
ca_data = base64.standard_b64encode(ca_file.read())
changes = []
# Naively update the CA information for each cluster in the
# kubeconfig.
for cluster in client_config_data['clusters']:
if cluster['cluster']['certificate-authority-data'] != ca_data:
cluster['cluster']['certificate-authority-data'] = ca_data
changes.append(cluster['name'])
if not module.check_mode:
if len(changes) > 0 and backup:
module.backup_local(client_path)
with open(client_path, 'w') as client_config_file:
client_config_string = yaml.dump(client_config_data, default_flow_style=False)
client_config_string = client_config_string.replace('\'\'', '""')
client_config_file.write(client_config_string)
return module.exit_json(changed=(len(changes) > 0))
# ignore broad-except error to avoid stack trace to ansible user
# pylint: disable=broad-except
except Exception as error:
return module.fail_json(msg=str(error))
if __name__ == '__main__':
main()
|
