The Kubeconfig operator is meant to ease generation of Kubeconfig files for users of the cluster. Cluster-admins can create a
custom resource Kubeconfig
, and the operator will handle the steps required to create a fully-signed and bound kubeconfig
YAML to be delivered to the new cluster user (because some of the steps can get a bit tedious, like handling OpenSSL certificate signing
requests by hand).
The operator consists of a Custom Resource Definition for the Kubeconfig request, and two controllers.
The custom resource serves as a request for a new Kubeconfig, which on top of all includes a username.
You can also add further configuration, such as toggling auto-approval and selecting other parameters for the certificate
request. Have a look at ./config/samples
for some example Kubeconfigs.
The first controller reconciles all Kubeconfig custom resources, and acts as the manager of the workflow. It creates secrets, certificate signing requests and cluster role bindings for the Kubeconfig object and is the owner of all created resources such that garbage collection works as expected. The second controller reconciles all certificate signing requests and auto-approves requests that where annotated to be automatically approved.
You’ll need a Kubernetes cluster to run against. You can use KIND to get a local cluster for testing, or run against a remote cluster.
Note: Your controller will automatically use the current context in your kubeconfig file (i.e. whatever cluster kubectl cluster-info
shows).
kubectl apply -f config/samples/
IMG
:make docker-build docker-push IMG=<some-registry>/kubeconfig-operator:tag
IMG
:make deploy IMG=<some-registry>/kubeconfig-operator:tag
To delete the CRDs from the cluster:
make uninstall
UnDeploy the controller to the cluster:
make undeploy
Contribution is welcome, and I'm up for any feature requests. Just fork the project and open a pull request with an accompanying issue marked accordingly.
This project aims to follow the Kubernetes Operator pattern
It uses Controllers which provides a reconcile function responsible for synchronizing resources untile the desired state is reached on the cluster
make install
make run
NOTE: You can also run this in one step by running: make install run
If you are editing the API definitions, generate the manifests such as CRs or CRDs using:
make manifests
NOTE: Run make --help
for more information on all potential make
targets
More information can be found via the Kubebuilder Documentation
Copyright 2022 zoomoid.
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.