diff --git a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java index 3a2eee2b..a44f0fd2 100644 --- a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java +++ b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java @@ -97,7 +97,7 @@ class ClientAuthenticationFactory { case KUBERNETES: return kubernetesAuthentication(vaultProperties); - } + } throw new UnsupportedOperationException(String.format( "Client authentication %s not supported", @@ -226,18 +226,22 @@ class ClientAuthenticationFactory { } private ClientAuthentication kubernetesAuthentication(VaultProperties vaultProperties) { + VaultProperties.KubernetesProperties kubernetes = vaultProperties.getKubernetes(); Assert.hasText(kubernetes.getRole(), "Role (spring.cloud.vault.kubernetes.role) must not be empty"); - Assert.hasText(kubernetes.getServiceAccountTokenFile(), - "Role (spring.cloud.vault.kubernetes.service-account-token-file) must not be empty"); + Assert.hasText( + kubernetes.getServiceAccountTokenFile(), + "Service account token file (spring.cloud.vault.kubernetes.service-account-token-file) must not be empty"); - KubernetesAuthenticationOptions options = KubernetesAuthenticationOptions.builder() - .path(kubernetes.getKubernetesPath()).role(kubernetes.getRole()) - .jwtSupplier(new KubernetesServiceAccountTokenFile( - kubernetes.getServiceAccountTokenFile())) - .build(); + KubernetesAuthenticationOptions options = KubernetesAuthenticationOptions + .builder() + .path(kubernetes.getKubernetesPath()) + .role(kubernetes.getRole()) + .jwtSupplier( + new KubernetesServiceAccountTokenFile(kubernetes + .getServiceAccountTokenFile())).build(); return new KubernetesAuthentication(options, restOperations); } diff --git a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/KubernetesAuthentication.java b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/KubernetesAuthentication.java index 6472d597..56f2af9c 100644 --- a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/KubernetesAuthentication.java +++ b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/KubernetesAuthentication.java @@ -1,5 +1,5 @@ /* - * Copyright 2016-2017 the original author or authors. + * Copyright 2017 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -29,11 +29,14 @@ import org.springframework.web.client.HttpStatusCodeException; import org.springframework.web.client.RestOperations; /** - * Kubernetes implementation of {@link ClientAuthentication}. {@link KubernetesAuthentication} - * uses a Kubernetes Service Account JSON Web Token to login into Vault. JWT and Role are - * sent in the login request to Vault to obtain a {@link VaultToken}. + * Kubernetes implementation of {@link ClientAuthentication}. + * {@link KubernetesAuthentication} uses a Kubernetes Service Account JSON Web Token to + * login into Vault. JWT and Role are sent in the login request to Vault to obtain a + * {@link VaultToken}. * * @author Michal Budzyn + * @author Mark Paluch + * @since 1.1 * @see KubernetesAuthenticationOptions * @see RestOperations * @see Auth Backend: @@ -46,14 +49,14 @@ class KubernetesAuthentication implements ClientAuthentication { private final RestOperations restOperations; /** - * Create a {@link KubernetesAuthentication} using {@link KubernetesAuthenticationOptions} and - * {@link RestOperations}. + * Create a {@link KubernetesAuthentication} using + * {@link KubernetesAuthenticationOptions} and {@link RestOperations}. * * @param options must not be {@literal null}. * @param restOperations must not be {@literal null}. */ - KubernetesAuthentication(KubernetesAuthenticationOptions options, - RestOperations restOperations) { + KubernetesAuthentication(KubernetesAuthenticationOptions options, + RestOperations restOperations) { Assert.notNull(options, "KubeAuthenticationOptions must not be null"); Assert.notNull(restOperations, "RestOperations must not be null"); @@ -62,24 +65,11 @@ class KubernetesAuthentication implements ClientAuthentication { this.restOperations = restOperations; } - private static Map getKubernetesLogin(String role, String jwt) { - - Assert.hasText(role, "role must not be empty"); - Assert.hasText(role, "jwt must not be empty"); - - Map login = new HashMap<>(); - - login.put("jwt", jwt); - login.put("role", role); - - return login; - } - @Override public VaultToken login() throws VaultException { - Map login = getKubernetesLogin(options.getRole(), - options.getJwtSupplier().get()); + Map login = getKubernetesLogin(options.getRole(), options + .getJwtSupplier().get()); try { VaultResponse response = restOperations.postForObject("auth/{mount}/login", @@ -99,7 +89,7 @@ class KubernetesAuthentication implements ClientAuthentication { /* * @see org.springframework.vault.authentication.LoginTokenUtil#from */ - private LoginToken from(Map auth) { + private static LoginToken from(Map auth) { String token = (String) auth.get("client_token"); Boolean renewable = (Boolean) auth.get("renewable"); @@ -115,4 +105,17 @@ class KubernetesAuthentication implements ClientAuthentication { return LoginToken.of(token); } + + private static Map getKubernetesLogin(String role, String jwt) { + + Assert.hasText(role, "Role must not be empty"); + Assert.hasText(role, "JWT must not be empty"); + + Map login = new HashMap<>(); + + login.put("jwt", jwt); + login.put("role", role); + + return login; + } } diff --git a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/KubernetesAuthenticationOptions.java b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/KubernetesAuthenticationOptions.java index 01aa4b5e..e5d2115d 100644 --- a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/KubernetesAuthenticationOptions.java +++ b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/KubernetesAuthenticationOptions.java @@ -1,5 +1,5 @@ /* - * Copyright 2016-2017 the original author or authors. + * Copyright 2017 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -21,10 +21,11 @@ import org.springframework.util.Assert; * Authentication options for {@link KubernetesAuthentication}. *

* Authentication options provide the path, role and jwt supplier. - * {@link KubernetesAuthentication} can be constructed using {@link #builder()}. Instances of - * this class are immutable once constructed. + * {@link KubernetesAuthentication} can be constructed using {@link #builder()}. Instances + * of this class are immutable once constructed. * * @author Michal Budzyn + * @since 1.1 * @see KubernetesAuthentication * @see #builder() */ @@ -38,7 +39,7 @@ class KubernetesAuthenticationOptions { private final String path; /** - * The Role. + * Name of the role against which the login is being attempted. */ private final String role; diff --git a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/KubernetesJwtSupplier.java b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/KubernetesJwtSupplier.java index 168089f0..d055f3a6 100644 --- a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/KubernetesJwtSupplier.java +++ b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/KubernetesJwtSupplier.java @@ -1,5 +1,5 @@ /* - * Copyright 2016-2017 the original author or authors. + * Copyright 2017 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -21,6 +21,7 @@ package org.springframework.cloud.vault.config; * * @author Michal Budzyn * @see KubernetesAuthentication + * @since 1.1 */ interface KubernetesJwtSupplier { diff --git a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/KubernetesServiceAccountTokenFile.java b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/KubernetesServiceAccountTokenFile.java index 3fa8dfdb..591e1516 100644 --- a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/KubernetesServiceAccountTokenFile.java +++ b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/KubernetesServiceAccountTokenFile.java @@ -1,5 +1,5 @@ /* - * Copyright 2016-2017 the original author or authors. + * Copyright 2017 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -15,7 +15,6 @@ */ package org.springframework.cloud.vault.config; -import java.io.File; import java.io.IOException; import java.io.InputStream; import java.nio.charset.StandardCharsets; @@ -29,10 +28,12 @@ import org.springframework.vault.VaultException; /** * Mechanism to retrieve a Kubernetes service account token. *

- * A file containing a token for a pod’s service account is automatically mounted at - * /var/run/secrets/kubernetes.io/serviceaccount/token + * A file containing a token for a pod's service account is automatically mounted at + * {@code /var/run/secrets/kubernetes.io/serviceaccount/token}. * * @author Michal Budzyn + * @author Mark Paluch + * @since 1.1 * @see KubernetesJwtSupplier */ class KubernetesServiceAccountTokenFile implements KubernetesJwtSupplier { @@ -44,78 +45,68 @@ class KubernetesServiceAccountTokenFile implements KubernetesJwtSupplier { private byte[] token; - /** - * Create a new {@link KubernetesServiceAccountTokenFile} pointing to the - * {@link #DEFAULT_KUBERNETES_SERVICE_ACCOUNT_TOKEN_FILE}. Construction fails with an - * exception if the file does not exist. - * - * @throws IllegalArgumentException if the - * {@link #DEFAULT_KUBERNETES_SERVICE_ACCOUNT_TOKEN_FILE} does not exist. - */ - KubernetesServiceAccountTokenFile() { - this(DEFAULT_KUBERNETES_SERVICE_ACCOUNT_TOKEN_FILE); - } + /** + * Create a new {@link KubernetesServiceAccountTokenFile} pointing to the + * {@link #DEFAULT_KUBERNETES_SERVICE_ACCOUNT_TOKEN_FILE}. Construction fails with an + * exception if the file does not exist. + * + * @throws IllegalArgumentException if the + * {@link #DEFAULT_KUBERNETES_SERVICE_ACCOUNT_TOKEN_FILE} does not exist. + */ + KubernetesServiceAccountTokenFile() { + this(DEFAULT_KUBERNETES_SERVICE_ACCOUNT_TOKEN_FILE); + } - /** - * Create a new {@link KubernetesServiceAccountTokenFile} - * {@link KubernetesServiceAccountTokenFile} from a {@code path}. - * - * @param path path to the service account token file. - * @throws IllegalArgumentException if the{@code path} does not exist. - */ - KubernetesServiceAccountTokenFile(String path) { - this(new FileSystemResource(path)); - } + /** + * Create a new {@link KubernetesServiceAccountTokenFile} + * {@link KubernetesServiceAccountTokenFile} from a {@code path}. + * + * @param path path to the service account token file. + * @throws IllegalArgumentException if the{@code path} does not exist. + */ + KubernetesServiceAccountTokenFile(String path) { + this(new FileSystemResource(path)); + } - /** - * Create a new {@link KubernetesServiceAccountTokenFile} - * {@link KubernetesServiceAccountTokenFile} from a {@link File} handle. - * - * @param file path to the service account token file. - * @throws IllegalArgumentException if the{@code path} does not exist. - */ - KubernetesServiceAccountTokenFile(File file) { - this(new FileSystemResource(file)); - } + /** + * Create a new {@link KubernetesServiceAccountTokenFile} + * {@link KubernetesServiceAccountTokenFile} from a {@link Resource} handle. + * + * @param resource resource pointing to the service account token file. + * @throws IllegalArgumentException if the{@code path} does not exist. + */ + KubernetesServiceAccountTokenFile(Resource resource) { - /** - * Create a new {@link KubernetesServiceAccountTokenFile} - * {@link KubernetesServiceAccountTokenFile} from a {@link Resource} handle. - * - * @param resource resource pointing to the service account token file. - * @throws IllegalArgumentException if the{@code path} does not exist. - */ - KubernetesServiceAccountTokenFile(Resource resource) { + Assert.isTrue(resource.exists(), + String.format("Resource %s does not exist", resource)); - Assert.isTrue(resource.exists(), String.format("Resource %s does not exist", resource)); + try { + this.token = readToken(resource); + } + catch (IOException e) { + throw new VaultException(String.format( + "Kube JWT token retrieval from %s failed", resource), e); + } + } - try { - this.token = readToken(resource); - } - catch (IOException e) { - throw new VaultException(String.format( - "Kube JWT token retrieval from %s failed", resource), e); - } - } + @Override + public String get() { + return new String(token, StandardCharsets.US_ASCII); + } - @Override - public String get() { - return new String(token, StandardCharsets.US_ASCII); - } + /** + * Read the token from {@link Resource}. + * + * @param resource the resource to read from, must not be {@literal null}. + * @return the new byte array that has been copied to (possibly empty). + * @throws IOException in case of I/O errors. + */ + private static byte[] readToken(Resource resource) throws IOException { - /** - * Read the token from {@link Resource}. - * - * @param resource the resource to read from, must not be {@literal null}. - * @return the new byte array that has been copied to (possibly empty). - * @throws IOException in case of I/O errors. - */ - protected static byte[] readToken(Resource resource) throws IOException { + Assert.notNull(resource, "Resource must not be null"); - Assert.notNull(resource, "Resource must not be null"); - - try (InputStream is = resource.getInputStream()) { - return StreamUtils.copyToByteArray(is); - } - } + try (InputStream is = resource.getInputStream()) { + return StreamUtils.copyToByteArray(is); + } + } } diff --git a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java index 65a953ed..91790de3 100644 --- a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java +++ b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java @@ -100,7 +100,7 @@ public class VaultProperties implements EnvironmentAware { private AwsIamProperties awsIam = new AwsIamProperties(); - private KubernetesProperties kubernetes = new KubernetesProperties(); + private KubernetesProperties kubernetes = new KubernetesProperties(); private Ssl ssl = new Ssl(); @@ -253,26 +253,26 @@ public class VaultProperties implements EnvironmentAware { private String serverName; } - @Data - public static class KubernetesProperties { + @Data + public static class KubernetesProperties { - /** - * Mount path of the Kubernetes authentication backend. - */ - @NotEmpty - private String kubernetesPath = "kubernetes"; + /** + * Mount path of the Kubernetes authentication backend. + */ + @NotEmpty + private String kubernetesPath = "kubernetes"; - /** - * The Role. - */ - private String role = null; + /** + * Name of the role against which the login is being attempted. + */ + private String role = ""; - /** - * File with service account token. - */ - @NotEmpty - private String serviceAccountTokenFile = "/var/run/secrets/kubernetes.io/serviceaccount/token"; - } + /** + * Path to the service account token file. + */ + @NotEmpty + private String serviceAccountTokenFile = "/var/run/secrets/kubernetes.io/serviceaccount/token"; + } @Data public static class Ssl { diff --git a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/KubernetesAuthenticationUnitTests.java b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/KubernetesAuthenticationUnitTests.java index 966d4345..2f670838 100644 --- a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/KubernetesAuthenticationUnitTests.java +++ b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/KubernetesAuthenticationUnitTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2016-2017 the original author or authors. + * Copyright 2017 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -15,15 +15,9 @@ */ package org.springframework.cloud.vault.config; -import static org.assertj.core.api.Assertions.assertThat; -import static org.springframework.test.web.client.match.MockRestRequestMatchers.jsonPath; -import static org.springframework.test.web.client.match.MockRestRequestMatchers.method; -import static org.springframework.test.web.client.match.MockRestRequestMatchers.requestTo; -import static org.springframework.test.web.client.response.MockRestResponseCreators.withServerError; -import static org.springframework.test.web.client.response.MockRestResponseCreators.withSuccess; - import org.junit.Before; import org.junit.Test; + import org.springframework.http.HttpMethod; import org.springframework.http.MediaType; import org.springframework.test.web.client.MockRestServiceServer; @@ -34,6 +28,13 @@ import org.springframework.vault.client.VaultClients.PrefixAwareUriTemplateHandl import org.springframework.vault.support.VaultToken; import org.springframework.web.client.RestTemplate; +import static org.assertj.core.api.Assertions.assertThat; +import static org.springframework.test.web.client.match.MockRestRequestMatchers.jsonPath; +import static org.springframework.test.web.client.match.MockRestRequestMatchers.method; +import static org.springframework.test.web.client.match.MockRestRequestMatchers.requestTo; +import static org.springframework.test.web.client.response.MockRestResponseCreators.withServerError; +import static org.springframework.test.web.client.response.MockRestResponseCreators.withSuccess; + /** * Unit tests for {@link KubernetesAuthentication}. * @@ -45,19 +46,20 @@ public class KubernetesAuthenticationUnitTests { private MockRestServiceServer mockRest; @Before - public void before() throws Exception { + public void before() { RestTemplate restTemplate = VaultClients.createRestTemplate(); restTemplate.setUriTemplateHandler(new PrefixAwareUriTemplateHandler()); + this.mockRest = MockRestServiceServer.createServer(restTemplate); this.restTemplate = restTemplate; } @Test - public void loginShouldObtainTokenWithStaticJwtSupplier() throws Exception { + public void loginShouldObtainTokenWithStaticJwtSupplier() { - KubernetesAuthenticationOptions options = KubernetesAuthenticationOptions.builder() - .role("hello") // + KubernetesAuthenticationOptions options = KubernetesAuthenticationOptions + .builder().role("hello") // .jwtSupplier((new KubernetesJwtSupplier() { @Override public String get() { @@ -69,10 +71,12 @@ public class KubernetesAuthenticationUnitTests { .andExpect(method(HttpMethod.POST)) .andExpect(jsonPath("$.role").value("hello")) .andExpect(jsonPath("$.jwt").value("my-jwt-token")) - .andRespond(withSuccess().contentType(MediaType.APPLICATION_JSON) - .body("{" + "\"auth\":{\"client_token\":\"my-token\"}" + "}")); + .andRespond( + withSuccess().contentType(MediaType.APPLICATION_JSON).body( + "{" + "\"auth\":{\"client_token\":\"my-token\"}" + "}")); - KubernetesAuthentication authentication = new KubernetesAuthentication(options, restTemplate); + KubernetesAuthentication authentication = new KubernetesAuthentication(options, + restTemplate); VaultToken login = authentication.login(); assertThat(login).isInstanceOf(LoginToken.class); @@ -80,10 +84,10 @@ public class KubernetesAuthenticationUnitTests { } @Test(expected = VaultException.class) - public void loginShouldFail() throws Exception { + public void loginShouldFail() { - KubernetesAuthenticationOptions options = KubernetesAuthenticationOptions.builder() - .role("hello").jwtSupplier(new KubernetesJwtSupplier() { + KubernetesAuthenticationOptions options = KubernetesAuthenticationOptions + .builder().role("hello").jwtSupplier(new KubernetesJwtSupplier() { @Override public String get() { return "my-jwt-token"; diff --git a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigKubernetesTests.java b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigKubernetesTests.java index 02e6d235..efc1e696 100644 --- a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigKubernetesTests.java +++ b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigKubernetesTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2016-2017 the original author or authors. + * Copyright 2017 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -15,10 +15,6 @@ */ package org.springframework.cloud.vault.config; -import static org.assertj.core.api.Assertions.assertThat; -import static org.junit.Assume.assumeTrue; -import static org.springframework.cloud.vault.util.Settings.findWorkDir; - import java.io.File; import java.nio.charset.StandardCharsets; import java.util.Collections; @@ -29,6 +25,7 @@ import org.assertj.core.util.Files; import org.junit.BeforeClass; import org.junit.Test; import org.junit.runner.RunWith; + import org.springframework.beans.factory.annotation.Value; import org.springframework.boot.SpringApplication; import org.springframework.boot.autoconfigure.SpringBootApplication; @@ -39,6 +36,10 @@ import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; import org.springframework.util.StringUtils; import org.springframework.vault.core.VaultOperations; +import static org.assertj.core.api.Assertions.assertThat; +import static org.junit.Assume.assumeTrue; +import static org.springframework.cloud.vault.util.Settings.findWorkDir; + /** * Integration test using config infrastructure with Kubernetes authentication. * @@ -56,14 +57,15 @@ public class VaultConfigKubernetesTests { String configValue; @BeforeClass - public static void beforeClass() throws Exception { + public static void beforeClass() { VaultRule vaultRule = new VaultRule(); vaultRule.before(); String minikubeIp = System.getProperty("MINIKUBE_IP"); - assumeTrue(StringUtils.hasText(minikubeIp) && vaultRule.prepare().getVersion() - .isGreaterThanOrEqualTo(Version.parse("0.8.3"))); + assumeTrue(StringUtils.hasText(minikubeIp) + && vaultRule.prepare().getVersion() + .isGreaterThanOrEqualTo(Version.parse("0.8.3"))); if (!vaultRule.prepare().hasAuth("kubernetes")) { vaultRule.prepare().mountAuth("kubernetes"); @@ -100,7 +102,6 @@ public class VaultConfigKubernetesTests { roleData.put("policies", "testpolicy"); roleData.put("ttl", "1h"); vaultOperations.write("auth/kubernetes/role/my-role", roleData); - } @Test diff --git a/src/test/bash/local_run_k8s.sh b/src/test/bash/local_run_k8s.sh deleted file mode 100755 index 3c06ae10..00000000 --- a/src/test/bash/local_run_k8s.sh +++ /dev/null @@ -1,73 +0,0 @@ -#!/bin/bash - -CMD_MINIKUBE=${1:-minikube} -CMD_KUBECTL=${2:-kubectl} -MINIKUBE_OPTS=${3:-} - -DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" - -if [ ! -d "work" ]; then - echo "work directory could not be found." - exit 1 -fi - -mkdir -p work/minikube -SERVICE_ACCOUNT_TOKEN_FILE=work/minikube/hello-minikube-token -SERVICE_ACCOUNT_CA_CRT=work/minikube/ca.crt - -function is_cluster_running() { - local _running=$(${CMD_MINIKUBE} status | grep "cluster: Running" || true) - echo "$_running" -} - -if [[ -z "$(is_cluster_running)" ]]; then - ${CMD_MINIKUBE} start "${MINIKUBE_OPTS}" - while [[ -z "$(is_cluster_running)" ]]; do - echo "Wait for minikube cluster to be up" - sleep 1 - done -fi - -export MINIKUBE_IP=$(${CMD_MINIKUBE} ip) -echo "MINIKUBE_IP ${MINIKUBE_IP}" - -# ensure kubectl context is not stale -${CMD_MINIKUBE} update-context - -# https://kubernetes.io/docs/getting-started-guides/minikube/ -${CMD_KUBECTL} run hello-minikube --image=gcr.io/google_containers/echoserver:1.4 --port=8080 -${CMD_KUBECTL} expose deployment hello-minikube --type=NodePort - -# Wait for service to be ready -echo "Wait for hello-minikube service to be ready" -HELLO_MINIKUBE_URL=$(${CMD_MINIKUBE} service hello-minikube --url --interval 5 --wait 120) -if [ $? != 0 ] ; then - echo "Error during service startup" - echo "In case of DNS problems try 'VBoxManage modifyvm minikube --natdnshostresolver1 on'" - # kubectl get pod -> STATUS: ContainerCreating - exit 1 -fi -echo "HELLO_MINIKUBE_URL ${HELLO_MINIKUBE_URL}" - -POD_NAME=$(${CMD_KUBECTL} get pod --selector=run=hello-minikube -o jsonpath='{.items..metadata.name}') -# Copy service account token -${CMD_KUBECTL} exec ${POD_NAME} -- cat /var/run/secrets/kubernetes.io/serviceaccount/token > ${SERVICE_ACCOUNT_TOKEN_FILE} -if [ $? != 0 ] ; then - echo "Error while retrieving service account token file" - exit 1 -fi -# Copy ca cert -${CMD_KUBECTL} exec ${POD_NAME} -- cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt > ${SERVICE_ACCOUNT_CA_CRT} -if [ $? != 0 ] ; then - echo "Error while retrieving service account ca.crt" - exit 1 -fi - -#BASEDIR=`dirname $0`/../../.. -#sh <( -#cat <<-EOF -#cd ${BASEDIR} && ${BASEDIR}/src/test/bash/env.sh -#vault auth-enable kubernetes -#vault write auth/kubernetes/config kubernetes_host=https://$(minikube ip):8443 kubernetes_ca_cert=@$HOME/.minikube/ca.crt -#EOF -#)