140 lines
3.9 KiB
Go
140 lines
3.9 KiB
Go
package cmd
|
|
|
|
import (
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"net/url"
|
|
"os"
|
|
"strings"
|
|
|
|
"github.com/spf13/cobra"
|
|
"gopkg.in/yaml.v3"
|
|
|
|
"git.shee.sh/james/ward/pkg/handler"
|
|
"git.shee.sh/james/ward/pkg/kubeconfig"
|
|
)
|
|
|
|
func newLoginCmd() *cobra.Command {
|
|
var (
|
|
server string
|
|
username string
|
|
contextName string
|
|
noKerberos bool
|
|
noSetContext bool
|
|
debugFlag bool
|
|
)
|
|
|
|
cmd := &cobra.Command{
|
|
Use: "login",
|
|
Short: "Authenticate to ward and configure kubectl",
|
|
Long: `Authenticates to the ward server, caches a long-lived credential, and
|
|
updates ~/.kube/config with the cluster, user (exec plugin), and context.
|
|
After login, kubectl works silently until the credential expires, at
|
|
which point you run 'ward login' again.
|
|
|
|
Authentication priority:
|
|
1. Kerberos SPNEGO using the active credential cache (from kinit)
|
|
2. Password prompt`,
|
|
RunE: func(cmd *cobra.Command, args []string) error {
|
|
if server == "" {
|
|
return fmt.Errorf("--server is required")
|
|
}
|
|
|
|
server = normalizeServer(server)
|
|
|
|
logf := func(format string, a ...any) {
|
|
if debugFlag {
|
|
fmt.Fprintf(os.Stderr, "[ward] "+format+"\n", a...)
|
|
}
|
|
}
|
|
|
|
if username == "" {
|
|
username = os.Getenv("USER")
|
|
}
|
|
|
|
ec, err := loginFetch(server, username, noKerberos, logf)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
credWriteCache(server, ec, logf)
|
|
|
|
bootstrap, err := fetchBootstrap(server, username, logf)
|
|
if err != nil {
|
|
return fmt.Errorf("fetching bootstrap kubeconfig: %w", err)
|
|
}
|
|
|
|
if contextName != "" {
|
|
kubeconfig.RenameContext(bootstrap, contextName)
|
|
}
|
|
|
|
contextApplied := bootstrap.CurrentContext
|
|
if err := kubeconfig.Merge(bootstrap, !noSetContext); err != nil {
|
|
return fmt.Errorf("updating kubeconfig: %w", err)
|
|
}
|
|
|
|
fmt.Fprintf(os.Stderr, "ward: logged in — context %q configured in %s\n",
|
|
contextApplied, kubeconfig.FilePath())
|
|
return nil
|
|
},
|
|
}
|
|
|
|
cmd.Flags().StringVar(&server, "server", "", "ward server URL (required)")
|
|
cmd.Flags().StringVar(&username, "username", "", "username (default: $USER)")
|
|
cmd.Flags().StringVar(&contextName, "context", "", "kubectl context/cluster name (overrides server default)")
|
|
cmd.Flags().BoolVar(&noKerberos, "no-kerberos", false, "skip Kerberos; use password auth")
|
|
cmd.Flags().BoolVar(&noSetContext, "no-set-context", false, "do not set as current-context")
|
|
cmd.Flags().BoolVar(&debugFlag, "debug", os.Getenv("WARD_DEBUG") != "", "verbose debug output to stderr")
|
|
|
|
return cmd
|
|
}
|
|
|
|
func loginFetch(server, username string, noKerberos bool, logf func(string, ...any)) (*handler.ExecCredential, error) {
|
|
loginURL := strings.TrimRight(server, "/") + "/credential?login=true"
|
|
|
|
if !noKerberos {
|
|
body, err := credFetchKerberos(loginURL, logf)
|
|
if err != nil {
|
|
logf("Kerberos: %v — falling back to password auth", err)
|
|
fmt.Fprintf(os.Stderr, "ward: Kerberos failed (%v); using password auth\nhint: run 'kinit' to avoid the password prompt next time\n", err)
|
|
} else {
|
|
return credParse(body)
|
|
}
|
|
}
|
|
|
|
password, err := promptPassword(username)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
body, err := credFetchBasic(loginURL, username, password, logf)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return credParse(body)
|
|
}
|
|
|
|
func fetchBootstrap(server, username string, logf func(string, ...any)) (*kubeconfig.KubeConfig, error) {
|
|
bootstrapURL := strings.TrimRight(server, "/") + "/bootstrap?user=" + url.QueryEscape(username)
|
|
logf("HTTP: GET %s", bootstrapURL)
|
|
|
|
resp, err := http.Get(bootstrapURL) //nolint:gosec // URL derived from user-supplied server flag
|
|
if err != nil {
|
|
return nil, fmt.Errorf("HTTP request: %w", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
body, err := io.ReadAll(resp.Body)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("reading response: %w", err)
|
|
}
|
|
if resp.StatusCode != http.StatusOK {
|
|
return nil, fmt.Errorf("server returned %s", resp.Status)
|
|
}
|
|
|
|
var cfg kubeconfig.KubeConfig
|
|
if err := yaml.Unmarshal(body, &cfg); err != nil {
|
|
return nil, fmt.Errorf("parsing bootstrap kubeconfig: %w", err)
|
|
}
|
|
return &cfg, nil
|
|
}
|