Refactor/fix kubeconfig management in `opsctl`

giantswarm / roadmap

Giant Swarm Product Roadmap

https://github.com/orgs/giantswarm/projects/273

Apache License 2.0

3 stars 0 forks source link

Refactor/fix kubeconfig management in `opsctl` #1657

Open anvddriesch opened 1 year ago

anvddriesch commented 1 year ago

Kubeconfig management in opsctl has grown over time and by now is quite convoluted and hard to follow. Furthermore, with CAPI installations not running vault and client certificate creation therefore not being possible, some commands fail. Let's have a thorough look at the current state, do a refactor and fix the broken commands.

erkanerol commented 1 year ago

opsctl create etcdbackup doesn't work for CAPI clusters because of this reason.

➜ opsctl create etcdbackup -i guppy --workloadcluster etcd1
Error: Invalid config: k8srestconfig.Config.Address must not be empty when not using k8srestconfig.Config.InCluster or k8srestconfig.Config.KubeConfig
    /home/runner/go/pkg/mod/github.com/giantswarm/k8sclient/v7@v7.0.1/pkg/k8srestconfig/rest_config.go:108
    /home/runner/work/opsctl/opsctl/pkg/k8sclient/k8sclient.go:158
    /home/runner/work/opsctl/opsctl/command/create/etcdbackup/command.go:201
    /home/runner/work/opsctl/opsctl/command/create/etcdbackup/command.go:124
    /home/runner/work/opsctl/opsctl/main.go:57

To increase verbosity, re-run with --level=debug

and we don't have --kubeconfig flag for this command, which is the workaround for opsctl deploy command. Should I create a separate issue for this?

marians commented 1 year ago

We talked about this in the team and think we can work on it after current projects, ~ in a few weeks.

weatherhog commented 1 year ago

[ ] Create RFC for a design of methods of authentication in opsctl (different authentication methods for automation and human access)
[ ] decide which methods is the right method for which command, based on examples
[ ] introduce new services, so that they can be used by us or by other teams
[ ] have Fallback to old methods
[ ] go through each opsctl command to find out which ones are working and which ones are not
[ ] refactor how kubeconfigs are managed in opsctl
[ ] https://github.com/giantswarm/giantswarm/issues/25316

gawertm commented 1 year ago

revisit this after cert management for capi is done (potentially including vault)

gawertm commented 3 days ago

@anvddriesch do you believe this is relevant enough that someone would work on it anytime soon? otherwise I#d say we can close it