io.kubernetes.client.apis.CoreV1Api Java Examples

private boolean checkMonitoringAgentRunning() throws IOException, ApiException
{
    ApiClient client = Config.defaultClient();
    Configuration.setDefaultApiClient(client);
    CoreV1Api api = new CoreV1Api();

    V1ServiceList serviceList = api.listServiceForAllNamespaces(
            null,
            null,
            null,
            null,
            null,
            null,
            null,
            null,
            null
    );

    for (V1Service service : serviceList.getItems()) {
        String serviceName = service.getMetadata().getName();
        if (serviceName.toUpperCase().contains(DeploymentInfo.getMonitoringAgent()))
            return true;
    }

    return false;
}
 

@Test
public void testDynamicConfigMapLoading() throws Exception {

    String changeConfigMap = "changeMap";
    String changeConfigNamespace = "changeConfigNamespace";

    KubernetesRuntimeFactory kubernetesRuntimeFactory = getKuberentesRuntimeFactory();
    CoreV1Api coreV1Api = Mockito.mock(CoreV1Api.class);
    V1ConfigMap v1ConfigMap = new V1ConfigMap();
    Mockito.doReturn(v1ConfigMap).when(coreV1Api).readNamespacedConfigMap(any(), any(), any(), any(), any());
    KubernetesRuntimeFactory.fetchConfigMap(coreV1Api, changeConfigMap, changeConfigNamespace, kubernetesRuntimeFactory);
    Mockito.verify(coreV1Api, Mockito.times(1)).readNamespacedConfigMap(eq(changeConfigMap), eq(changeConfigNamespace), eq(null), eq(true), eq(false));
    KubernetesRuntimeFactory expected = getKuberentesRuntimeFactory();
    assertEquals(kubernetesRuntimeFactory, expected);

    HashMap<String, String> configs = new HashMap<>();
    configs.put("pulsarDockerImageName", "test_dockerImage2");
    configs.put("imagePullPolicy", "test_imagePullPolicy2");
    v1ConfigMap.setData(configs);
    KubernetesRuntimeFactory.fetchConfigMap(coreV1Api, changeConfigMap, changeConfigNamespace, kubernetesRuntimeFactory);
    Mockito.verify(coreV1Api, Mockito.times(2)).readNamespacedConfigMap(eq(changeConfigMap), eq(changeConfigNamespace), eq(null), eq(true), eq(false));

   assertEquals(kubernetesRuntimeFactory.getPulsarDockerImageName(), "test_dockerImage2");
   assertEquals(kubernetesRuntimeFactory.getImagePullPolicy(), "test_imagePullPolicy2");
}
 

@Test
public void testCacheAuthData() throws ApiException {
    CoreV1Api coreV1Api = mock(CoreV1Api.class);
    doReturn(new V1Secret()).when(coreV1Api).createNamespacedSecret(anyString(), any(), anyString());
    KubernetesSecretsTokenAuthProvider kubernetesSecretsTokenAuthProvider = new KubernetesSecretsTokenAuthProvider();
    kubernetesSecretsTokenAuthProvider.initialize(coreV1Api,  null, (fd) -> "default");
    Function.FunctionDetails funcDetails = Function.FunctionDetails.newBuilder().setTenant("test-tenant").setNamespace("test-ns").setName("test-func").build();
    Optional<FunctionAuthData> functionAuthData = kubernetesSecretsTokenAuthProvider.cacheAuthData(funcDetails, new AuthenticationDataSource() {
                @Override
                public boolean hasDataFromCommand() {
                    return true;
                }

                @Override
                public String getCommandData() {
                    return "test-token";
                }
            });

    Assert.assertTrue(functionAuthData.isPresent());
    Assert.assertTrue(StringUtils.isNotBlank(new String(functionAuthData.get().getData())));
}
 

@Test
public void testConfigureAuthDataStatefulSetNoCa() {
    CoreV1Api coreV1Api = mock(CoreV1Api.class);
    KubernetesSecretsTokenAuthProvider kubernetesSecretsTokenAuthProvider = new KubernetesSecretsTokenAuthProvider();
    kubernetesSecretsTokenAuthProvider.initialize(coreV1Api, null, (fd) -> "default");


    V1StatefulSet statefulSet = new V1StatefulSet();
    statefulSet.setSpec(
            new V1StatefulSetSpec().template(
                    new V1PodTemplateSpec().spec(
                            new V1PodSpec().containers(
                                    Collections.singletonList(new V1Container())))));
    FunctionAuthData functionAuthData = FunctionAuthData.builder().data("foo".getBytes()).build();
    kubernetesSecretsTokenAuthProvider.configureAuthDataStatefulSet(statefulSet, Optional.of(functionAuthData));

    Assert.assertEquals(statefulSet.getSpec().getTemplate().getSpec().getVolumes().size(), 1);
    Assert.assertEquals(statefulSet.getSpec().getTemplate().getSpec().getVolumes().get(0).getName(), "function-auth");
    Assert.assertEquals(statefulSet.getSpec().getTemplate().getSpec().getVolumes().get(0).getSecret().getSecretName(), "pf-secret-foo");

    Assert.assertEquals(statefulSet.getSpec().getTemplate().getSpec().getContainers().size(), 1);
    Assert.assertEquals(statefulSet.getSpec().getTemplate().getSpec().getContainers().get(0).getVolumeMounts().size(), 1);
    Assert.assertEquals(statefulSet.getSpec().getTemplate().getSpec().getContainers().get(0).getVolumeMounts().get(0).getName(), "function-auth");
    Assert.assertEquals(statefulSet.getSpec().getTemplate().getSpec().getContainers().get(0).getVolumeMounts().get(0).getMountPath(), "/etc/auth");
}
 

@Override
public void doAdmissionChecks(AppsV1Api appsV1Api, CoreV1Api coreV1Api, String jobNamespace, Function.FunctionDetails functionDetails) {
    if (!StringUtils.isEmpty(functionDetails.getSecretsMap())) {
        Type type = new TypeToken<Map<String, Object>>() {
        }.getType();
        Map<String, Object> secretsMap = new Gson().fromJson(functionDetails.getSecretsMap(), type);

        for (Object object : secretsMap.values()) {
            if (object instanceof Map) {
                Map<String, String> kubernetesSecret = (Map<String, String>) object;
                if (kubernetesSecret.size() < 2) {
                    throw new IllegalArgumentException("Kubernetes Secret should contain id and key");
                }
                if (!kubernetesSecret.containsKey(ID_KEY)) {
                    throw new IllegalArgumentException("Kubernetes Secret should contain id information");
                }
                if (!kubernetesSecret.containsKey(KEY_KEY)) {
                    throw new IllegalArgumentException("Kubernetes Secret should contain key information");
                }
            } else {
                throw new IllegalArgumentException("Kubernetes Secret should be a Map containing id/key pairs");
            }
        }
    }
}
 

public KubernetesJobResource() {
    try {
        client = Config.fromCluster();
    } catch (IOException e) {
        throw new RuntimeException();
    }
    Configuration.setDefaultApiClient(client);
    this.coreApi = new CoreV1Api();
    this.batchApi = new BatchV1Api();
}
 

@Test
public void configureAuthenticationConfigNoCa() {
    CoreV1Api coreV1Api = mock(CoreV1Api.class);
    KubernetesSecretsTokenAuthProvider kubernetesSecretsTokenAuthProvider = new KubernetesSecretsTokenAuthProvider();
    kubernetesSecretsTokenAuthProvider.initialize(coreV1Api, null, (fd) -> "default");
    AuthenticationConfig authenticationConfig = AuthenticationConfig.builder().build();
    FunctionAuthData functionAuthData = FunctionAuthData.builder().data("foo".getBytes()).build();
    kubernetesSecretsTokenAuthProvider.configureAuthenticationConfig(authenticationConfig, Optional.of(functionAuthData));

    Assert.assertEquals(authenticationConfig.getClientAuthenticationPlugin(), AuthenticationToken.class.getName());
    Assert.assertEquals(authenticationConfig.getClientAuthenticationParameters(), "file:///etc/auth/token");
    Assert.assertEquals(authenticationConfig.getTlsTrustCertsFilePath(), null);
}
 

@Test
public void configureAuthenticationConfig() {
    byte[] testBytes = new byte[]{0, 1, 2, 3, 4};
    CoreV1Api coreV1Api = mock(CoreV1Api.class);
    KubernetesSecretsTokenAuthProvider kubernetesSecretsTokenAuthProvider = new KubernetesSecretsTokenAuthProvider();
    kubernetesSecretsTokenAuthProvider.initialize(coreV1Api, testBytes, (fd) -> "default");
    AuthenticationConfig authenticationConfig = AuthenticationConfig.builder().build();
    FunctionAuthData functionAuthData = FunctionAuthData.builder().data("foo".getBytes()).build();
    kubernetesSecretsTokenAuthProvider.configureAuthenticationConfig(authenticationConfig, Optional.of(functionAuthData));

    Assert.assertEquals(authenticationConfig.getClientAuthenticationPlugin(), AuthenticationToken.class.getName());
    Assert.assertEquals(authenticationConfig.getClientAuthenticationParameters(), "file:///etc/auth/token");
    Assert.assertEquals(authenticationConfig.getTlsTrustCertsFilePath(), "/etc/auth/ca.pem");
}
 

@Test
public void testConfigureAuthDataStatefulSet() {
    byte[] testBytes = new byte[]{0, 1, 2, 3, 4};

    CoreV1Api coreV1Api = mock(CoreV1Api.class);
    KubernetesSecretsTokenAuthProvider kubernetesSecretsTokenAuthProvider = new KubernetesSecretsTokenAuthProvider();
    kubernetesSecretsTokenAuthProvider.initialize(coreV1Api, testBytes, (fd) -> "default");


    V1StatefulSet statefulSet = new V1StatefulSet();
    statefulSet.setSpec(
            new V1StatefulSetSpec().template(
                    new V1PodTemplateSpec().spec(
                            new V1PodSpec().containers(
                                    Collections.singletonList(new V1Container())))));
    FunctionAuthData functionAuthData = FunctionAuthData.builder().data("foo".getBytes()).build();
    kubernetesSecretsTokenAuthProvider.configureAuthDataStatefulSet(statefulSet, Optional.of(functionAuthData));

    Assert.assertEquals(statefulSet.getSpec().getTemplate().getSpec().getVolumes().size(), 1);
    Assert.assertEquals(statefulSet.getSpec().getTemplate().getSpec().getVolumes().get(0).getName(), "function-auth");
    Assert.assertEquals(statefulSet.getSpec().getTemplate().getSpec().getVolumes().get(0).getSecret().getSecretName(), "pf-secret-foo");

    Assert.assertEquals(statefulSet.getSpec().getTemplate().getSpec().getContainers().size(), 1);
    Assert.assertEquals(statefulSet.getSpec().getTemplate().getSpec().getContainers().get(0).getVolumeMounts().size(), 1);
    Assert.assertEquals(statefulSet.getSpec().getTemplate().getSpec().getContainers().get(0).getVolumeMounts().get(0).getName(), "function-auth");
    Assert.assertEquals(statefulSet.getSpec().getTemplate().getSpec().getContainers().get(0).getVolumeMounts().get(0).getMountPath(), "/etc/auth");
}
 

static void fetchConfigMap(CoreV1Api coreClient, String changeConfigMap,
                           String changeConfigMapNamespace,
                           KubernetesRuntimeFactory kubernetesRuntimeFactory) {
    try {
        V1ConfigMap v1ConfigMap = coreClient.readNamespacedConfigMap(changeConfigMap, changeConfigMapNamespace, null, true, false);
        Map<String, String> data = v1ConfigMap.getData();
        if (data != null) {
            overRideKubernetesConfig(data, kubernetesRuntimeFactory);
        }
    } catch (Exception e) {
        log.error("Error while trying to fetch configmap {} at namespace {}", changeConfigMap, changeConfigMapNamespace, e);
    }
}
 

@Override
protected void doStart() throws NatInitializationException {
  LOG.info("Starting kubernetes NAT manager.");
  try {

    KubeConfig.registerAuthenticator(new GCPAuthenticator());

    LOG.debug("Trying to update information using Kubernetes client SDK.");
    final ApiClient client = ClientBuilder.cluster().build();

    // set the global default api-client to the in-cluster one from above
    Configuration.setDefaultApiClient(client);

    // the CoreV1Api loads default api-client from global configuration.
    final CoreV1Api api = new CoreV1Api();
    // invokes the CoreV1Api client
    final V1Service service =
        api.listServiceForAllNamespaces(null, null, null, null, null, null, null, null, null)
            .getItems().stream()
            .filter(v1Service -> v1Service.getMetadata().getName().contains(besuPodNameFilter))
            .findFirst()
            .orElseThrow(() -> new NatInitializationException("Service not found"));
    updateUsingBesuService(service);
  } catch (Exception e) {
    throw new NatInitializationException(e.getMessage(), e);
  }
}
 

public KubernetesSpyResource() {
    super(NAME);
    try {
        client = Config.fromCluster();
    } catch (IOException e) {
        throw new RuntimeException();
    }
    Configuration.setDefaultApiClient(client);
    this.api = new CoreV1Api();
    this.batchApi = new BatchV1Api();

}
 

private StorageCredentialsAccountAndKey resolveCredentialsFromK8S(final Provider<CoreV1Api> coreV1ApiProvider,
                                                                  final AbstractOperationRequest operationrequest) {
    try {
        final String namespace = operationrequest.resolveKubernetesNamespace();
        final SecretReader secretReader = new SecretReader(coreV1ApiProvider);

        return secretReader.readIntoObject(namespace,
                                           operationrequest.resolveSecretName(),
                                           secret -> {
                                               final Map<String, byte[]> data = secret.getData();

                                               final byte[] azureStorageAccount = data.get("azurestorageaccount");
                                               final byte[] azureStorageKey = data.get("azurestoragekey");

                                               if (azureStorageAccount == null) {
                                                   throw new AzureModuleException(format("Secret %s does not contain any entry with key 'azurestorageaccount'",
                                                                                         secret.getMetadata().getName()));
                                               }

                                               if (azureStorageKey == null) {
                                                   throw new AzureModuleException(format("Secret %s does not contain any entry with key 'azurestoragekey'",
                                                                                         secret.getMetadata().getName()));
                                               }

                                               return new StorageCredentialsAccountAndKey(
                                                   new String(azureStorageAccount),
                                                   new String(azureStorageKey)
                                               );
                                           });
    } catch (final Exception ex) {
        throw new AzureModuleException("Unable to resolve Azure credentials for backup / restores from Kubernetes ", ex);
    }
}
 

private void getMonitoringEndpointFromService() throws IOException, ApiException
{
    ApiClient client = Config.defaultClient();
    Configuration.setDefaultApiClient(client);
    CoreV1Api api = new CoreV1Api();

    V1ServiceList serviceList = api.listServiceForAllNamespaces(
            null,
            null,
            null,
            null,
            null,
            null,
            null,
            null,
            null
    );

    for (V1Service service : serviceList.getItems()) {
        String serviceName = service.getMetadata().getName();
        if (serviceName.toUpperCase().equals(DeploymentInfo.getMonitoringAgentService())) {
            String clusterIP = service.getSpec().getClusterIP();
            int port = service.getSpec().getPorts().get(0).getPort();
            DeploymentInfo.setMonitoringAgentEndpoint("http://" + clusterIP + ":" + port);
        }
    }
}
 

private StorageCredentialsAccountAndKey provideStorageCredentialsAccountAndKey(final Provider<CoreV1Api> coreV1ApiProvider,
                                                                               final AbstractOperationRequest operationrequest) throws AzureModuleException {
    if (isRunningInKubernetes()) {
        return resolveCredentialsFromK8S(coreV1ApiProvider, operationrequest);
    } else {
        return resolveCredentialsFromEnvProperties();
    }
}
 

public KubernetesClient(String k8sApiUrl, String k8sApiToken, String nameSpace) {
    Configuration.setDefaultApiClient(Config.fromToken(k8sApiUrl, k8sApiToken, false));
    this.coreApi = new CoreV1Api();
    this.appsApi = new AppsV1Api();
    this.networkingApi = new NetworkingV1Api();
    this.nameSpace = nameSpace;
}
 

private S3Configuration resolveS3Configuration(final Provider<CoreV1Api> coreV1ApiProvider, final AbstractOperationRequest operationRequest) {
    if (isRunningInKubernetes()) {
        try {
            return resolveS3ConfigurationFromK8S(coreV1ApiProvider, operationRequest);
        } catch (final S3ModuleException ex) {
            logger.warn(String.format("Unable to resolve credentials for S3 from Kubernetes secret %s. The last chance "
                                          + "for this container to authenticate is to use AWS instance credentials.",
                                      operationRequest.k8sSecretName), ex);
            return new S3Configuration();
        }
    } else {
        return resolveS3ConfigurationFromEnvProperties();
    }
}
 

@Provides
@Singleton
GoogleStorageFactory provideGoogleStorageFactory(final Provider<CoreV1Api> coreV1ApiProvider) {
    return new GoogleStorageFactory(coreV1ApiProvider);
}
 

@Test
public void testUpdateAuthData() throws Exception {
    CoreV1Api coreV1Api = mock(CoreV1Api.class);
    KubernetesSecretsTokenAuthProvider kubernetesSecretsTokenAuthProvider = new KubernetesSecretsTokenAuthProvider();
    kubernetesSecretsTokenAuthProvider.initialize(coreV1Api, null, (fd) -> "default");
    // test when existingFunctionAuthData is empty
    Optional<FunctionAuthData> existingFunctionAuthData = Optional.empty();
    Function.FunctionDetails funcDetails = Function.FunctionDetails.newBuilder().setTenant("test-tenant").setNamespace("test-ns").setName("test-func").build();
    Optional<FunctionAuthData> functionAuthData = kubernetesSecretsTokenAuthProvider.updateAuthData(funcDetails, existingFunctionAuthData, new AuthenticationDataSource() {
                @Override
                public boolean hasDataFromCommand() {
                    return true;
                }

                @Override
                public String getCommandData() {
                    return "test-token";
                }
            });


    Assert.assertTrue(functionAuthData.isPresent());
    Assert.assertTrue(StringUtils.isNotBlank(new String(functionAuthData.get().getData())));

    // test when existingFunctionAuthData is NOT empty
    existingFunctionAuthData = Optional.of(new FunctionAuthData("pf-secret-z7mxx".getBytes(), null));
    functionAuthData = kubernetesSecretsTokenAuthProvider.updateAuthData(funcDetails, existingFunctionAuthData, new AuthenticationDataSource() {
                @Override
                public boolean hasDataFromCommand() {
                    return true;
                }

                @Override
                public String getCommandData() {
                    return "test-token";
                }
            });


    Assert.assertTrue(functionAuthData.isPresent());
    Assert.assertEquals(new String(functionAuthData.get().getData()), "pf-secret-z7mxx");
}
 

@Provides
@Singleton
TransferManagerFactory provideTransferManagerFactory(final Provider<CoreV1Api> coreV1ApiProvider) {
    return new TransferManagerFactory(coreV1ApiProvider);
}
 

public TransferManagerFactory(final Provider<CoreV1Api> coreV1ApiProvider) {
    this.coreV1ApiProvider = coreV1ApiProvider;
}
 

private AmazonS3 provideAmazonS3(final Provider<CoreV1Api> coreV1ApiProvider, final AbstractOperationRequest operationRequest) {

            final S3Configuration s3Conf = resolveS3Configuration(coreV1ApiProvider, operationRequest);

            final AmazonS3ClientBuilder builder = AmazonS3ClientBuilder.standard();

            if (s3Conf.awsEndpoint != null) {
                // AWS_REGION must be set if AWS_ENDPOINT is set
                if (s3Conf.awsRegion == null) {
                    throw new IllegalArgumentException("AWS_REGION must be set if AWS_ENDPOINT is set.");
                }

                builder.withEndpointConfiguration(new EndpointConfiguration(s3Conf.awsEndpoint, s3Conf.awsRegion.toLowerCase()));
            } else if (s3Conf.awsRegion != null) {
                builder.withRegion(Regions.fromName(s3Conf.awsRegion.toLowerCase()));
            }

            // if we are not running against Kubernetes, credentials should be fetched from ~/.aws/...
            if (isRunningInKubernetes()) {
                // it is possible that we have not set any secrets for s3 so the last
                // resort is to fallback to AWS instance credentials.
                if (s3Conf.awsAccessKeyId != null && s3Conf.awsSecretKey != null) {
                    builder.setCredentials(new AWSCredentialsProvider() {
                        @Override
                        public AWSCredentials getCredentials() {
                            return new AWSCredentials() {
                                @Override
                                public String getAWSAccessKeyId() {
                                    return s3Conf.awsAccessKeyId;
                                }

                                @Override
                                public String getAWSSecretKey() {
                                    return s3Conf.awsSecretKey;
                                }
                            };
                        }

                        @Override
                        public void refresh() {
                        }
                    });
                }
            }

            return builder.build();
        }
 

private S3Configuration resolveS3ConfigurationFromK8S(final Provider<CoreV1Api> coreV1ApiProvider, final AbstractOperationRequest operationRequest) {

            try {

                final String namespace = resolveKubernetesKeyspace(operationRequest);
                final SecretReader secretReader = new SecretReader(coreV1ApiProvider);

                return secretReader.readIntoObject(namespace,
                                                   operationRequest.resolveSecretName(),
                                                   secret -> {
                                                       final Map<String, byte[]> data = secret.getData();

                                                       final S3Configuration s3Configuration = new S3Configuration();

                                                       final byte[] awsendpoint = data.get("awsendpoint");
                                                       final byte[] awsregion = data.get("awsregion");
                                                       final byte[] awssecretaccesskey = data.get("awssecretaccesskey");
                                                       final byte[] awsaccesskeyid = data.get("awsaccesskeyid");

                                                       if (awsendpoint != null) {
                                                           s3Configuration.awsEndpoint = new String(awsendpoint);
                                                       }

                                                       if (awsregion != null) {
                                                           s3Configuration.awsRegion = new String(awsregion);
                                                       }

                                                       if (awsaccesskeyid != null) {
                                                           s3Configuration.awsAccessKeyId = new String(awsaccesskeyid);
                                                       } else {
                                                           throw new S3ModuleException(format("Secret %s does not contain any entry with key 'awsaccesskeyid'.",
                                                                                              secret.getMetadata().getName()));
                                                       }

                                                       if (awssecretaccesskey != null) {
                                                           s3Configuration.awsSecretKey = new String(awssecretaccesskey);
                                                       } else {
                                                           throw new S3ModuleException(format("Secret %s does not contain any entry with key 'awssecretaccesskey'.",
                                                                                              secret.getMetadata().getName()));
                                                       }

                                                       return s3Configuration;
                                                   });
            } catch (final Exception ex) {
                throw new S3ModuleException("Unable to resolve S3Configuration for backup / restores from Kubernetes. ", ex);
            }
        }
 

@Override
public void initialize(CoreV1Api coreClient) {
    this.coreClient = coreClient;
}
 

default void initialize(CoreV1Api coreClient, byte[] caBytes, java.util.function.Function<Function.FunctionDetails, String> namespaceCustomizerFunc) {
    setCaBytes(caBytes);
    setNamespaceProviderFunc(namespaceCustomizerFunc);
    initialize(coreClient);
}
 

@Provides
@Singleton
CloudStorageAccountFactory provideCloudStorageAccountFactory(final Provider<CoreV1Api> coreV1ApiProvider) {
    return new CloudStorageAccountFactory(coreV1ApiProvider);
}
 

public CloudStorageAccountFactory(final Provider<CoreV1Api> coreV1ApiProvider) {
    this.coreV1ApiProvider = coreV1ApiProvider;
}
 

/**
 * Constructor
 */
public KubernetesOperation() {
    ApiClient client = Config.fromToken(API_SERVER_NAME, ACCESS_TOKEN, false);
    Configuration.setDefaultApiClient(client);
    corev1Api = new CoreV1Api(client);
}
 

public GoogleStorageFactory(final Provider<CoreV1Api> coreV1ApiProvider) {
    this.coreV1ApiProvider = coreV1ApiProvider;
}
 

/**
 * Do config checks to see whether the secrets provided are conforming.
 */
default void doAdmissionChecks(AppsV1Api appsV1Api, CoreV1Api coreV1Api, String jobNamespace, Function.FunctionDetails functionDetails) {}