blob: 25c1801b67bcf5cd1337b3325af7b1931f04ebed [file] [log] [blame]
Scott Bakere7144bc2019-10-01 14:16:47 -07001/*
2Copyright 2014 The Kubernetes Authors.
3
4Licensed under the Apache License, Version 2.0 (the "License");
5you may not use this file except in compliance with the License.
6You may obtain a copy of the License at
7
8 http://www.apache.org/licenses/LICENSE-2.0
9
10Unless required by applicable law or agreed to in writing, software
11distributed under the License is distributed on an "AS IS" BASIS,
12WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13See the License for the specific language governing permissions and
14limitations under the License.
15*/
16
17package rest
18
19import (
20 "crypto/tls"
21 "errors"
22 "net/http"
23
24 "k8s.io/client-go/plugin/pkg/client/auth/exec"
25 "k8s.io/client-go/transport"
26)
27
28// TLSConfigFor returns a tls.Config that will provide the transport level security defined
29// by the provided Config. Will return nil if no transport level security is requested.
30func TLSConfigFor(config *Config) (*tls.Config, error) {
31 cfg, err := config.TransportConfig()
32 if err != nil {
33 return nil, err
34 }
35 return transport.TLSConfigFor(cfg)
36}
37
38// TransportFor returns an http.RoundTripper that will provide the authentication
39// or transport level security defined by the provided Config. Will return the
40// default http.DefaultTransport if no special case behavior is needed.
41func TransportFor(config *Config) (http.RoundTripper, error) {
42 cfg, err := config.TransportConfig()
43 if err != nil {
44 return nil, err
45 }
46 return transport.New(cfg)
47}
48
49// HTTPWrappersForConfig wraps a round tripper with any relevant layered behavior from the
50// config. Exposed to allow more clients that need HTTP-like behavior but then must hijack
51// the underlying connection (like WebSocket or HTTP2 clients). Pure HTTP clients should use
52// the higher level TransportFor or RESTClientFor methods.
53func HTTPWrappersForConfig(config *Config, rt http.RoundTripper) (http.RoundTripper, error) {
54 cfg, err := config.TransportConfig()
55 if err != nil {
56 return nil, err
57 }
58 return transport.HTTPWrappersForConfig(cfg, rt)
59}
60
61// TransportConfig converts a client config to an appropriate transport config.
62func (c *Config) TransportConfig() (*transport.Config, error) {
63 conf := &transport.Config{
64 UserAgent: c.UserAgent,
65 Transport: c.Transport,
66 WrapTransport: c.WrapTransport,
67 TLS: transport.TLSConfig{
68 Insecure: c.Insecure,
69 ServerName: c.ServerName,
70 CAFile: c.CAFile,
71 CAData: c.CAData,
72 CertFile: c.CertFile,
73 CertData: c.CertData,
74 KeyFile: c.KeyFile,
75 KeyData: c.KeyData,
76 },
77 Username: c.Username,
78 Password: c.Password,
79 BearerToken: c.BearerToken,
80 Impersonate: transport.ImpersonationConfig{
81 UserName: c.Impersonate.UserName,
82 Groups: c.Impersonate.Groups,
83 Extra: c.Impersonate.Extra,
84 },
85 Dial: c.Dial,
86 }
87
88 if c.ExecProvider != nil && c.AuthProvider != nil {
89 return nil, errors.New("execProvider and authProvider cannot be used in combination")
90 }
91
92 if c.ExecProvider != nil {
93 provider, err := exec.GetAuthenticator(c.ExecProvider)
94 if err != nil {
95 return nil, err
96 }
97 if err := provider.UpdateTransportConfig(conf); err != nil {
98 return nil, err
99 }
100 }
101 if c.AuthProvider != nil {
102 provider, err := GetAuthProvider(c.Host, c.AuthProvider, c.AuthConfigPersister)
103 if err != nil {
104 return nil, err
105 }
106 wt := conf.WrapTransport
107 if wt != nil {
108 conf.WrapTransport = func(rt http.RoundTripper) http.RoundTripper {
109 return provider.WrapTransport(wt(rt))
110 }
111 } else {
112 conf.WrapTransport = provider.WrapTransport
113 }
114 }
115 return conf, nil
116}