83 lines
2.5 KiB
Bash
Executable File
83 lines
2.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ADMIN_KUBECONFIG="${KUBECONFIG:-${KUBECONFIG_PATH:-${HOME}/.kube/config}}"
|
|
READONLY_NAMESPACE="${READONLY_NAMESPACE:-homelab-access}"
|
|
READONLY_SERVICE_ACCOUNT="${READONLY_SERVICE_ACCOUNT:-homelab-readonly}"
|
|
READONLY_KUBECONFIG="${READONLY_KUBECONFIG:-${HOME}/.kube/homelab-readonly.conf}"
|
|
READONLY_TOKEN_DURATION="${READONLY_TOKEN_DURATION:-24h}"
|
|
|
|
usage() {
|
|
cat <<'EOF'
|
|
Usage: scripts/kubeconfig-readonly
|
|
|
|
Generate a separate read-only kubeconfig from the repo-managed
|
|
homelab-access/homelab-readonly ServiceAccount.
|
|
EOF
|
|
}
|
|
|
|
require_kubectl() {
|
|
if ! command -v kubectl >/dev/null 2>&1; then
|
|
echo "kubectl is required." >&2
|
|
exit 1
|
|
fi
|
|
if [[ ! -s "${ADMIN_KUBECONFIG}" ]]; then
|
|
echo "admin kubeconfig missing: ${ADMIN_KUBECONFIG}" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
main() {
|
|
local server
|
|
local cluster_name
|
|
local ca_data
|
|
local token
|
|
local user_name="homelab-readonly"
|
|
local context_name="homelab-readonly"
|
|
|
|
case "${1:-}" in
|
|
-h | --help | help)
|
|
usage
|
|
return 0
|
|
;;
|
|
esac
|
|
|
|
require_kubectl
|
|
|
|
kubectl --kubeconfig "${ADMIN_KUBECONFIG}" -n "${READONLY_NAMESPACE}" get serviceaccount "${READONLY_SERVICE_ACCOUNT}" >/dev/null
|
|
token="$(kubectl --kubeconfig "${ADMIN_KUBECONFIG}" -n "${READONLY_NAMESPACE}" create token "${READONLY_SERVICE_ACCOUNT}" --duration="${READONLY_TOKEN_DURATION}")"
|
|
server="$(kubectl --kubeconfig "${ADMIN_KUBECONFIG}" config view --minify -o jsonpath='{.clusters[0].cluster.server}')"
|
|
cluster_name="$(kubectl --kubeconfig "${ADMIN_KUBECONFIG}" config view --minify -o jsonpath='{.clusters[0].name}')"
|
|
ca_data="$(kubectl --kubeconfig "${ADMIN_KUBECONFIG}" config view --raw --minify -o jsonpath='{.clusters[0].cluster.certificate-authority-data}')"
|
|
|
|
mkdir -p "$(dirname "${READONLY_KUBECONFIG}")"
|
|
umask 077
|
|
cat >"${READONLY_KUBECONFIG}" <<EOF
|
|
apiVersion: v1
|
|
kind: Config
|
|
clusters:
|
|
- name: ${cluster_name}
|
|
cluster:
|
|
server: ${server}
|
|
certificate-authority-data: ${ca_data}
|
|
users:
|
|
- name: ${user_name}
|
|
user:
|
|
token: ${token}
|
|
contexts:
|
|
- name: ${context_name}
|
|
context:
|
|
cluster: ${cluster_name}
|
|
user: ${user_name}
|
|
namespace: default
|
|
current-context: ${context_name}
|
|
EOF
|
|
chmod 0600 "${READONLY_KUBECONFIG}"
|
|
|
|
echo "Created read-only kubeconfig: ${READONLY_KUBECONFIG}"
|
|
echo "Test with:"
|
|
echo " KUBECONFIG=${READONLY_KUBECONFIG} kubectl get pods -A"
|
|
}
|
|
|
|
main "$@"
|