[WIP] Refactoring the provider-kubeconfig.py

[chiukapoor]

Issue

• Fixes: Refactor the provider-kubeconfig.py to use python Kubernetes Client #1325

Updates

• Use python kube-client
• Modularize delete functionality
• Add -n, --namespace parameter for namespace
• Error handling

TODO

• Test UPDATE functionality
• Use logger
• Need refactor the below code blocks once the JSON format is provided by @devdattakulkarni

  kubeplus/provider-kubeconfig.py

  Lines 346 to 391 in d4d61ce

  	def _update_rbac(self, permissionfile, sa, namespace, kubeconfig):
  	rbac_v1 = client.RbacAuthorizationV1Api()
  	role = {}
  	role["apiVersion"] = "rbac.authorization.k8s.io/v1"
  	role["kind"] = "ClusterRole"
  	metadata = {}
  	metadata["name"] = sa + "-update"
  	role["metadata"] = metadata
  	ruleList = []
  	ruleGroup = {}
  	fp = open(permissionfile, "r")
  	data = fp.read()
  	perms_data = json.loads(data)
  	perms = perms_data["perms"]
  	new_resources_set = set()
  	for apiGroup, res_actions in perms.items():
  	for res in res_actions:
  	for resource, verbs in res.items():
  	print(apiGroup + " " + resource + " " + str(verbs))
  	if resource not in new_resources_set:
  	new_resources_set.add(resource.strip())
  	ruleGroup = {}
  	if apiGroup == "non-apigroup":
  	if 'nonResourceURL' in resource:
  	parts = resource.split("nonResourceURL::")
  	nonRes = parts[0].strip()
  	ruleGroup['nonResourceURLs'] = [nonRes]
  	ruleGroup['verbs'] = verbs
  	else:
  	ruleGroup["apiGroups"] = [apiGroup]
  	ruleGroup["verbs"] = verbs
  	if 'resourceName' in resource:
  	parts = resource.split("/resourceName::")
  	resNameParent = parts[0].strip()
  	resName = parts[1].strip()
  	ruleGroup["resources"] = [resNameParent]
  	ruleGroup["resourceNames"] = [resName]
  	else:
  	ruleGroup["resources"] = [resource]
  	ruleList.append(ruleGroup)
  	role["rules"] = ruleList

  kubeplus/provider-kubeconfig.py

  Lines 421 to 439 in d4d61ce

  	# Read configmap to get earlier permissions; delete it and create it with all new permissions:
  	cmd = "kubectl get configmap kubeplus-saas-provider-perms -o json -n " + namespace
  	out1, err1 = self.run_command(cmd)
  	print("Original Perms Out:" + str(out1))
  	print("Perms Err:" + str(err1))
  	kubeplus_perms = []
  	if out1 != '':
  	json_op = json.loads(out1)
  	perms = json_op['data']['kubeplus-saas-provider-perms.txt']
  	print(perms)
  	k_perms = perms.split(",")
  	for p in k_perms:
  	p = p.replace("'","")
  	p = p.replace("[","")
  	p = p.replace("]","")
  	p = p.strip()
  	kubeplus_perms.append(p)
  	new_resources_set.extend(kubeplus_perms)

[devdattakulkarni]

Looks like CI has failed:
https://github.com/cloud-ark/kubeplus/actions/runs/9838082051/job/27157203380?pr=1326#step:5:1896

[devdattakulkarni]

https://github.com/cloud-ark/kubeplus/actions/runs/9838401881/job/27158227902?pr=1326#step:5:1901

Need to add kubernetes to requirements.txt.

[chiukapoor]

@devdattakulkarni I would like to propose that we move the provider-kubeconfig.py and requirements.txt to a new folder (ex kubeconfig-generator)?

[chiukapoor]

Rebased with master

[devdattakulkarni]

About putting Namespace as a parameter under a flag - the problem is it will make Namespace an optional parameter. We want to keep Namespace a required parameter. Keeping it a positional parameter achieves this. So I suggest we keep Namespace as a positional parameter.

[chiukapoor]

Updated to keep namespace as a positional parameter.

[devdattakulkarni]

@chiukapoor I have started testing the changes. Here is a gist with early results.

https://gist.github.com/devdattakulkarni/bb3833c9589ca3139c971da43ac2fa62

I would suggest you try all the flags with all the commands to verify whether all combinations of commands and flags are working correctly.

[chiukapoor]

@devdattakulkarni

Test 2: "Namespace does not exist" is working fine for me.

❯ kubectl get namespaces -A
NAME                 STATUS   AGE
default              Active   7m7s
kube-node-lease      Active   7m7s
kube-public          Active   7m7s
kube-system          Active   7m7s
local-path-storage   Active   7m4s
testkubeconfig2      Active   53s
❯ python3 provider-kubeconfig.py create -n testkubeconfig3 -s $apiserver
API Server IP: https://127.0.0.1:36921
Namespace 'testkubeconfig3' created successfully.
Namespace 'testkubeconfig3' labeled successfully.
ServiceAccount 'kubeplus-saas-provider' created successfully.
Secret 'kubeplus-saas-provider' created successfully.
Kubeconfig file 'kubeplus-saas-provider.json' created successfully.
ClusterRole 'kubeplus-saas-provider' replaced successfully.
ClusterRole 'kubeplus-saas-provider' replaced successfully.
Provider kubeconfig created: kubeplus-saas-provider.json

Rest of the issues are resolved in latest commit.

[chiukapoor]

Rebased the PR @devdattakulkarni