Fix retrieval of shoot kubeconfig

Signed-off-by: Matthias Büchse <matthias.buechse@alasca.cloud>

Author: mbuechse

Tests/kaas/plugin/gardener_helper.py

@@ -1,8 +1,9 @@
 """helper functions for Gardener plugin"""
 import base64
+import json
 import os
 
-from kubernetes.client import Configuration, CoreV1Api, CustomObjectsApi
+from kubernetes.client import Configuration, CoreV1Api, CustomObjectsApi, ApiClient
 
 
 GARDENER_GROUP = 'core.gardener.cloud'
@@ -68,10 +69,22 @@ def get_shoot_status(co_api: CustomObjectsApi, namespace: str, name: str):
     )
 
 
-# def get_secret_data(core_api: CoreV1Api, namespace: str, name: str):
-#     secret = core_api.read_namespaced_secret(name, namespace)
-#     return base64.b64decode(secret.data['kubeconfig'])
-def get_secret_data(api_instance: CoreV1Api, namespace, secret):
-    """mimic `kubectl get secrets NAME -o=jsonpath='{.data.value}' | base64 -d  > kubeconfig.yaml`"""
-    res = api_instance.read_namespaced_secret(secret, namespace)
-    return base64.standard_b64decode(res.data['value'].encode())
+def request_kubeconfig(api_client: ApiClient, namespace: str, name: str, expiration_seconds=8*3600):
+    # adapted from
+    # https://gardener.cloud/docs/gardener/shoot/shoot_access/#shoots-adminkubeconfig-subresource
+    kubeconfig_request = {
+        'apiVersion': 'authentication.gardener.cloud/v1alpha1',
+        'kind': 'AdminKubeconfigRequest',
+        'spec': {
+            'expirationSeconds': expiration_seconds,
+        }
+    }
+    response = api_client.call_api(
+        resource_path=f'/apis/core.gardener.cloud/v1beta1/namespaces/{namespace}/shoots/{name}/adminkubeconfig',
+        method='POST',
+        body=kubeconfig_request,
+        auth_settings=['BearerToken'],
+        _preload_content=False,
+        _return_http_data_only=True,
+    )
+    return base64.standard_b64decode(json.loads(response.data)["status"]["kubeconfig"])

Tests/kaas/plugin/plugin_gardener.py

@@ -21,7 +21,6 @@ class _ShootOps:
     def __init__(self, namespace: str, name: str):
         self.namespace = namespace
         self.name = name
-        self.secret_name = f'{name}.kubeconfig'
 
     def _get_last_operation(self, co_api: _gh.CustomObjectsApi):
         try:
@@ -94,8 +93,8 @@ def delete(self, co_api: _gh.CustomObjectsApi):
                 logger.info(f"Shoot {self.name} deletion succeeded, but object still exists. Waiting 30 s for it to vanish.")
             time.sleep(30)
 
-    def get_kubeconfig(self, core_api: _gh.CoreV1Api):
-        return _gh.get_secret_data(core_api, self.namespace, self.secret_name)
+    def get_kubeconfig(self, api_client: ApiClient):
+        return _gh.request_kubeconfig(api_client, self.namespace, self.name)
 
     def wait_for_shoot_ready(self, co_api: _gh.CustomObjectsApi):
         last_op = self._get_last_operation(co_api)
@@ -172,7 +171,7 @@ def create_cluster(self):
             sops = _ShootOps(self.namespace, self.config['name'])
             sops.create(co_api=co_api, shoot_dict=shoot_dict)
             sops.wait_for_shoot_ready(co_api)
-            self._write_kubeconfig(sops.get_kubeconfig(core_api))
+            self._write_kubeconfig(sops.get_kubeconfig(api_client))
 
     def delete_cluster(self):
         with ApiClient(self.client_config) as api_client: