mirror of
https://github.com/lensapp/lens.git
synced 2025-05-20 05:10:56 +00:00
Refactor dashboard server logic to electron main (#146)
Signed-off-by: Jari Kolehmainen <jari.kolehmainen@gmail.com>
This commit is contained in:
Jari Kolehmainen authored and 
GitHub committed
1 parent
e54b79b56a
commit
1aaa695cfe
38 files changed
+430
-1323
No files matched your search
@@ -1,23 +0,0 @@
|
||||
// Get certificate auth data
|
||||
|
||||
import * as fs from "fs";
|
||||
import * as util from "util";
|
||||
import config from "../config";
|
||||
|
||||
let caData: string = null
|
||||
|
||||
export async function getCertificateAuthorityData(encoding = 'utf8'): Promise<string> {
|
||||
if (caData) {
|
||||
return caData
|
||||
}
|
||||
if (!fs.existsSync(config.KUBERNETES_CA_CERT)) {
|
||||
caData = config.KUBERNETES_CA_CERT
|
||||
return caData
|
||||
}
|
||||
try {
|
||||
const ca = await util.promisify(fs.readFile)(config.KUBERNETES_CA_CERT);
|
||||
return Buffer.from(ca).toString(encoding);
|
||||
} catch (error) {
|
||||
return ''
|
||||
}
|
||||
}
|
||||
@@ -1,39 +0,0 @@
|
||||
// Get cluster info
|
||||
|
||||
import config from "../config"
|
||||
import { kubeRequest } from "./kube-request";
|
||||
import { IClusterInfo, IClusterConfigMap } from "../common/cluster"
|
||||
|
||||
export async function getClusterInfo(): Promise<IClusterInfo> {
|
||||
const [configMap, kubeVersion, pharosVersion] = await Promise.all([
|
||||
getClusterConfigMap().catch(() => ({} as IClusterConfigMap)),
|
||||
getKubeVersion().catch(() => null),
|
||||
getPharosVersion().catch(() => null),
|
||||
]);
|
||||
return {
|
||||
...configMap,
|
||||
kubeVersion,
|
||||
pharosVersion,
|
||||
};
|
||||
}
|
||||
|
||||
export async function getClusterConfigMap() {
|
||||
const res = await kubeRequest<{ data: IClusterConfigMap }>({
|
||||
path: `/api/v1/namespaces/${config.LENS_NAMESPACE}/configmaps/config`,
|
||||
});
|
||||
return res.data;
|
||||
}
|
||||
|
||||
export async function getKubeVersion() {
|
||||
const res = await kubeRequest<{ gitVersion: string }>({
|
||||
path: "/version",
|
||||
});
|
||||
return res.gitVersion.slice(1);
|
||||
}
|
||||
|
||||
export async function getPharosVersion() {
|
||||
const res = await kubeRequest<{ data: { "pharos-version": string } }>({
|
||||
path: `/api/v1/namespaces/kube-system/configmaps/pharos-config`,
|
||||
});
|
||||
return res ? res.data["pharos-version"] : null;
|
||||
}
|
||||
@@ -1,59 +0,0 @@
|
||||
// Get namespaces
|
||||
|
||||
import config from "../config";
|
||||
import { KubeJsonApiDataList } from "../../client/api/kube-json-api";
|
||||
import { IKubeRequestParams, kubeRequest } from "./kube-request";
|
||||
import { reviewResourceAccess } from "./review-resource-access";
|
||||
import { getServiceAccountToken } from "./get-service-account-token"
|
||||
|
||||
export async function getNamespaces(params: Partial<IKubeRequestParams> = {}) {
|
||||
return kubeRequest<KubeJsonApiDataList>({
|
||||
...params,
|
||||
path: "/api/v1/namespaces",
|
||||
});
|
||||
}
|
||||
|
||||
export async function getAllowedNamespaces(
|
||||
params: Partial<IKubeRequestParams>,
|
||||
fallbackNs = config.KUBERNETES_NAMESPACE,
|
||||
): Promise<string[]> {
|
||||
try {
|
||||
const allNamespaces = await getNamespaces(params);
|
||||
const nsAccessStatuses = await Promise.all(
|
||||
allNamespaces.items.map(ns => {
|
||||
const { name } = ns.metadata;
|
||||
return reviewResourceAccess(params, {
|
||||
namespace: name,
|
||||
resource: "pods",
|
||||
verb: "list",
|
||||
});
|
||||
})
|
||||
);
|
||||
return allNamespaces.items
|
||||
.filter((ns, i) => nsAccessStatuses[i].allowed)
|
||||
.map(ns => ns.metadata.name);
|
||||
} catch (e) {
|
||||
const serviceToken = await getServiceAccountToken();
|
||||
if (!serviceToken) {
|
||||
return fallbackNs ? [fallbackNs] : [];
|
||||
}
|
||||
// fetch namespaces with service-account token (cluster-wide)
|
||||
// and for every namespace make additional request to check if namespace available for user-token
|
||||
const allNamespaces = await getNamespaces({
|
||||
authHeader: `Bearer ${serviceToken}`
|
||||
});
|
||||
const nsAccessStatuses = await Promise.all(
|
||||
allNamespaces.items.map(ns => {
|
||||
const { name } = ns.metadata;
|
||||
return reviewResourceAccess(params, {
|
||||
namespace: name,
|
||||
resource: "pods",
|
||||
verb: "list",
|
||||
});
|
||||
})
|
||||
);
|
||||
return allNamespaces.items
|
||||
.filter((ns, i) => nsAccessStatuses[i].allowed)
|
||||
.map(ns => ns.metadata.name);
|
||||
}
|
||||
}
|
||||
@@ -1,22 +0,0 @@
|
||||
// Get service-account token
|
||||
|
||||
import { existsSync, readFile } from "fs";
|
||||
import { promisify } from "util";
|
||||
import config from "../config"
|
||||
|
||||
const tokenPath = "/var/run/secrets/kubernetes.io/serviceaccount/token";
|
||||
|
||||
export async function getServiceAccountToken() {
|
||||
const { SERVICE_ACCOUNT_TOKEN } = config;
|
||||
|
||||
if (SERVICE_ACCOUNT_TOKEN) {
|
||||
return SERVICE_ACCOUNT_TOKEN;
|
||||
}
|
||||
|
||||
if (existsSync(tokenPath)) {
|
||||
const token = await promisify(readFile)(tokenPath);
|
||||
return token.toString().trim();
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
@@ -1,19 +0,0 @@
|
||||
// Check cluster-admin rights for auth-token
|
||||
// CLI: kubectl auth can-i '*' '*' --all-namespaces
|
||||
|
||||
import { reviewResourceAccess } from "./review-resource-access";
|
||||
import { IKubeRequestParams } from "./kube-request";
|
||||
|
||||
export async function isClusterAdmin(params: Partial<IKubeRequestParams>): Promise<boolean> {
|
||||
try {
|
||||
const accessCheck = await reviewResourceAccess(params, {
|
||||
resource: "*",
|
||||
namespace: "*",
|
||||
group: "*",
|
||||
verb: "*",
|
||||
});
|
||||
return accessCheck.allowed;
|
||||
} catch (err) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
@@ -1,58 +0,0 @@
|
||||
// Kubernetes request api helper
|
||||
|
||||
import config, { isSecure } from "../config";
|
||||
import axios, { AxiosError, AxiosRequestConfig } from "axios"
|
||||
import * as https from "https";
|
||||
import { getCertificateAuthorityData } from "./get-cert-auth-data";
|
||||
import { logger, sanitizeHeaders } from "../utils/logger";
|
||||
import { getServiceAccountToken } from "./get-service-account-token";
|
||||
|
||||
export interface IKubeRequestParams extends AxiosRequestConfig {
|
||||
path: string;
|
||||
authHeader?: string;
|
||||
}
|
||||
|
||||
export async function kubeRequest<T>(params: IKubeRequestParams): Promise<T> {
|
||||
const { KUBE_CLUSTER_URL, KUBERNETES_CLIENT_CERT, KUBERNETES_CLIENT_KEY } = config;
|
||||
const serviceToken = await getServiceAccountToken();
|
||||
const defaultAuthHeader = serviceToken ? `Bearer ${serviceToken}` : "";
|
||||
const {
|
||||
authHeader = defaultAuthHeader,
|
||||
url = KUBE_CLUSTER_URL,
|
||||
path = "",
|
||||
...reqConfig
|
||||
} = params;
|
||||
|
||||
// add access token
|
||||
reqConfig.headers = Object.assign({}, reqConfig.headers, {
|
||||
"Content-type": "application/json",
|
||||
});
|
||||
|
||||
if (!KUBERNETES_CLIENT_CERT && authHeader) {
|
||||
reqConfig.headers["Authorization"] = authHeader;
|
||||
}
|
||||
|
||||
// allow requests to kube-cluster without valid ssl certs..
|
||||
reqConfig.httpsAgent = new https.Agent({
|
||||
rejectUnauthorized: isSecure(),
|
||||
cert: KUBERNETES_CLIENT_CERT,
|
||||
key: KUBERNETES_CLIENT_KEY,
|
||||
ca: await getCertificateAuthorityData(),
|
||||
});
|
||||
|
||||
const reqUrl = url + path;
|
||||
|
||||
return axios(reqUrl, reqConfig)
|
||||
.then(res => res.data)
|
||||
.catch((error: AxiosError<T>) => {
|
||||
const { message, config } = error;
|
||||
logger.error(`[KUBE-REQUEST]: ${message}`, {
|
||||
code: error.code,
|
||||
method: config.method,
|
||||
url: config.url,
|
||||
headers: sanitizeHeaders(config.headers),
|
||||
params: config.params,
|
||||
});
|
||||
throw error;
|
||||
});
|
||||
}
|
||||
@@ -1,47 +0,0 @@
|
||||
// Get resource access review
|
||||
// Docs: https://kubernetes.io/docs/reference/access-authn-authz/authorization/
|
||||
import { IKubeRequestParams, kubeRequest } from "./kube-request";
|
||||
|
||||
interface IResourceAccess {
|
||||
apiVersion: string;
|
||||
kind: string;
|
||||
status: IResourceAccessStatus;
|
||||
}
|
||||
|
||||
export interface IResourceAccessStatus {
|
||||
allowed: boolean;
|
||||
denied?: boolean;
|
||||
reason?: string;
|
||||
evaluationError?: string;
|
||||
}
|
||||
|
||||
interface IResourceAccessAttributes {
|
||||
group?: string | "*";
|
||||
resource?: string | "*";
|
||||
verb?: "get" | "list" | "create" | "update" | "patch" | "watch" | "proxy" | "redirect" | "delete" | "deletecollection" | "*";
|
||||
namespace?: string | "*";
|
||||
}
|
||||
|
||||
export async function reviewResourceAccess(
|
||||
params: Partial<IKubeRequestParams> = {},
|
||||
attrs: IResourceAccessAttributes
|
||||
): Promise<IResourceAccessStatus> {
|
||||
try {
|
||||
const accessReview = await kubeRequest<IResourceAccess>({
|
||||
...params,
|
||||
method: "POST",
|
||||
path: "/apis/authorization.k8s.io/v1/selfsubjectaccessreviews",
|
||||
data: {
|
||||
spec: {
|
||||
resourceAttributes: attrs
|
||||
}
|
||||
}
|
||||
});
|
||||
return accessReview.status;
|
||||
} catch (err) {
|
||||
return {
|
||||
allowed: false,
|
||||
reason: err.toString(),
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,39 +0,0 @@
|
||||
// Check validity of auth-token
|
||||
import { kubeRequest } from "./kube-request";
|
||||
|
||||
export interface ITokenReview {
|
||||
apiVersion: string;
|
||||
kind: string;
|
||||
status: ITokenReviewStatus;
|
||||
}
|
||||
|
||||
export interface ITokenReviewStatus {
|
||||
authenticated: boolean;
|
||||
user: {
|
||||
username?: string;
|
||||
uid?: string;
|
||||
groups?: string[];
|
||||
};
|
||||
error?: string[];
|
||||
}
|
||||
|
||||
export async function reviewToken(authToken: string): Promise<ITokenReviewStatus> {
|
||||
try {
|
||||
const tokenReview = await kubeRequest<ITokenReview>({
|
||||
path: "/apis/authentication.k8s.io/v1/tokenreviews",
|
||||
method: "POST",
|
||||
data: {
|
||||
spec: {
|
||||
token: authToken
|
||||
}
|
||||
}
|
||||
});
|
||||
return tokenReview.status;
|
||||
} catch (err) {
|
||||
return {
|
||||
authenticated: false,
|
||||
user: {},
|
||||
error: [err.toString()],
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,76 +0,0 @@
|
||||
import config, { BUILD_DIR, CLIENT_DIR } from "../server/config"
|
||||
|
||||
import path from "path"
|
||||
import fs from "fs"
|
||||
import express from "express"
|
||||
import cookieSession from "cookie-session"
|
||||
import compression from "compression"
|
||||
import helmet from "helmet"
|
||||
import morgan from "morgan"
|
||||
import { logger } from "../server/utils/logger"
|
||||
import { configRoute, kubeconfigRoute, kubewatchRoute, metricsRoute, readyStateRoute } from "../server/routes";
|
||||
import { useRequestHeaderToken } from "../server/middlewares";
|
||||
|
||||
const {
|
||||
IS_PRODUCTION, LOCAL_SERVER_PORT, API_PREFIX,
|
||||
SESSION_NAME, SESSION_SECRET,
|
||||
} = config;
|
||||
|
||||
const app = express();
|
||||
const localApis = express.Router();
|
||||
const outputDir = path.resolve(process.cwd(), BUILD_DIR, CLIENT_DIR);
|
||||
|
||||
app.set('trust proxy', 1); // trust first proxy
|
||||
|
||||
localApis.use(
|
||||
configRoute(),
|
||||
readyStateRoute(),
|
||||
kubeconfigRoute(),
|
||||
kubewatchRoute(),
|
||||
metricsRoute()
|
||||
);
|
||||
|
||||
// https://github.com/expressjs/cookie-session
|
||||
app.use(cookieSession({
|
||||
name: SESSION_NAME,
|
||||
secret: SESSION_SECRET,
|
||||
secure: IS_PRODUCTION,
|
||||
httpOnly: true,
|
||||
maxAge: 365 * 24 * 60 * 60 * 1000, // 1 year
|
||||
}));
|
||||
|
||||
// protect from well-known web vulnerabilities by setting HTTP headers appropriately
|
||||
// https://github.com/helmetjs/helmet
|
||||
app.use(helmet({
|
||||
hsts: {
|
||||
includeSubDomains: false,
|
||||
}
|
||||
}));
|
||||
|
||||
// use auth-token from request headers (if applicable via proxy)
|
||||
app.use(useRequestHeaderToken());
|
||||
|
||||
// requests logging
|
||||
app.use(morgan('tiny'));
|
||||
|
||||
// enable gzip compression
|
||||
app.use(compression());
|
||||
|
||||
app.use(express.urlencoded({ extended: true })); // for parsing application/x-www-form-urlencoded
|
||||
app.use("/", express.static(outputDir)); // handle static files (assets)
|
||||
|
||||
app.use(API_PREFIX.BASE, express.json({ limit: "10mb" }), localApis);
|
||||
|
||||
// handle all page requests via index.html, in development mode it's managed by webpack-dev-server
|
||||
app.all('*', (req, res) => {
|
||||
const indexHtml = path.resolve(outputDir, 'index.html');
|
||||
if (fs.existsSync(indexHtml)) res.sendFile(indexHtml);
|
||||
else {
|
||||
res.send("Error: build/index.html doesn't exists");
|
||||
}
|
||||
});
|
||||
|
||||
// run server
|
||||
const server = app.listen(LOCAL_SERVER_PORT, "127.0.0.1", () => {
|
||||
logger.appStarted(LOCAL_SERVER_PORT, 'Server started');
|
||||
});
|
||||
@@ -1,9 +1,4 @@
|
||||
export interface IClusterConfigMap {
|
||||
clusterName: string;
|
||||
clusterUrl: string;
|
||||
}
|
||||
|
||||
export interface IClusterInfo extends IClusterConfigMap {
|
||||
export interface IClusterInfo {
|
||||
kubeVersion?: string;
|
||||
pharosVersion?: string;
|
||||
clusterName?: string;
|
||||
}
|
||||
@@ -1,3 +0,0 @@
|
||||
export * from "./kube-proxy"
|
||||
export * from "./terminal-proxy"
|
||||
export * from "./use-header-token"
|
||||
@@ -1,24 +0,0 @@
|
||||
import { Request } from "express";
|
||||
import proxy from "http-proxy-middleware"
|
||||
import { userSession } from "../user-session";
|
||||
import config, { isSecure } from "../config";
|
||||
|
||||
export function kubeProxy(serviceUrl: string, proxyConfig: proxy.Config = {}) {
|
||||
const { IS_PRODUCTION } = config;
|
||||
return proxy({
|
||||
target: serviceUrl,
|
||||
secure: isSecure(), // verify the ssl certs
|
||||
logLevel: IS_PRODUCTION ? "info" : "debug",
|
||||
changeOrigin: true, // needed for virtual hosted sites
|
||||
pathRewrite: (path, req: Request) => {
|
||||
return path.replace(req.baseUrl, ""); // remove client-prefix, e.g "/api-kube"
|
||||
},
|
||||
onProxyReq(proxyReq, req: Request, res) {
|
||||
const { authHeader } = userSession.get(req);
|
||||
if (authHeader) {
|
||||
proxyReq.setHeader("Authorization", authHeader);
|
||||
}
|
||||
},
|
||||
...proxyConfig,
|
||||
})
|
||||
}
|
||||
@@ -1,19 +0,0 @@
|
||||
import { NextFunction } from "express";
|
||||
import proxy from "http-proxy-middleware"
|
||||
import appConfig from "../config"
|
||||
|
||||
const { KUBE_TERMINAL_URL, API_PREFIX, IS_PRODUCTION } = appConfig;
|
||||
|
||||
interface ITerminalProxy extends NextFunction {
|
||||
upgrade: () => void;
|
||||
}
|
||||
|
||||
export const terminalProxy = proxy({
|
||||
target: KUBE_TERMINAL_URL,
|
||||
ws: true,
|
||||
changeOrigin: true,
|
||||
logLevel: IS_PRODUCTION ? "info" : "debug",
|
||||
pathRewrite: {
|
||||
["^" + API_PREFIX.TERMINAL]: "" // remove api-prefix
|
||||
}
|
||||
}) as ITerminalProxy;
|
||||
@@ -1,20 +0,0 @@
|
||||
// Allow to use "Authorization" from request for auto-login (when provided by proxy)
|
||||
import { NextFunction, Request, Response } from "express"
|
||||
import { userSession } from "../user-session";
|
||||
|
||||
export function useRequestHeaderToken() {
|
||||
return (req: Request, res: Response, next: NextFunction) => {
|
||||
const authorization = req.headers["authorization"] || req.headers["x-lens-kubectl-token"];
|
||||
const { authHeader, isUserLogin } = userSession.get(req);
|
||||
const userHasOwnToken = authHeader && isUserLogin;
|
||||
|
||||
// don't overwrite user's login credentials
|
||||
if (authorization && !userHasOwnToken && authHeader !== authorization) {
|
||||
userSession.save(req, {
|
||||
authHeader: authorization.toString(),
|
||||
});
|
||||
}
|
||||
|
||||
next();
|
||||
}
|
||||
}
|
||||
@@ -1,48 +0,0 @@
|
||||
//-- Config route
|
||||
|
||||
import config from "../config";
|
||||
import { IConfig } from "../common/config"
|
||||
import { Router } from "express";
|
||||
import { userSession } from "../user-session";
|
||||
import { getClusterInfo } from "../api/get-cluster-info";
|
||||
import { isClusterAdmin } from "../api/is-cluster-admin";
|
||||
import { getAllowedNamespaces } from "../api/get-namespaces";
|
||||
import { parseJwt } from "../utils/parse-jwt";
|
||||
|
||||
export function configRoute() {
|
||||
const router = Router();
|
||||
|
||||
router.route('/config')
|
||||
.get(async (req, res) => {
|
||||
const { username, authHeader } = userSession.get(req);
|
||||
const authToken = userSession.getToken(req);
|
||||
|
||||
const data: IConfig = {
|
||||
clusterName: config.KUBE_CLUSTER_NAME,
|
||||
lensVersion: config.LENS_VERSION,
|
||||
lensTheme: config.LENS_THEME,
|
||||
chartsEnabled: !!config.CHARTS_ENABLED,
|
||||
kubectlAccess: !!req.headers["x-lens-kubectl-token"]
|
||||
};
|
||||
|
||||
// load config data from other places
|
||||
const loading: Promise<any>[] = [
|
||||
getClusterInfo().then(info => Object.assign(data, info)),
|
||||
];
|
||||
|
||||
// validate user token from session and fetch more config data
|
||||
if (authToken) {
|
||||
const { sub, email } = parseJwt(authToken);
|
||||
data.username = email || sub || username;
|
||||
data.token = authToken;
|
||||
loading.push(
|
||||
isClusterAdmin({ authHeader }).then(isAdmin => data.isClusterAdmin = isAdmin),
|
||||
getAllowedNamespaces({ authHeader }).then(list => data.allowedNamespaces = list),
|
||||
);
|
||||
}
|
||||
await Promise.all(loading);
|
||||
res.json(data);
|
||||
});
|
||||
|
||||
return router;
|
||||
}
|
||||
@@ -1,5 +0,0 @@
|
||||
export * from "./config-route"
|
||||
export * from "./kubeconfig-route"
|
||||
export * from "./kubewatch-route"
|
||||
export * from "./metrics-route"
|
||||
export * from "./ready-state-route"
|
||||
@@ -1,100 +0,0 @@
|
||||
//-- Kubeconfig route
|
||||
|
||||
import { Router } from "express";
|
||||
import { AxiosError } from "axios";
|
||||
import { userSession } from "../user-session";
|
||||
import { kubeRequest } from "../api/kube-request";
|
||||
import { Secret } from "../../client/api/endpoints";
|
||||
import { base64 } from "../../client/utils/base64";
|
||||
import { getCertificateAuthorityData } from "../api/get-cert-auth-data";
|
||||
import { getClusterConfigMap } from "../api/get-cluster-info";
|
||||
|
||||
interface IKubeConfigParams {
|
||||
username: string;
|
||||
authToken: string;
|
||||
certificateAuthority: string;
|
||||
namespace?: string;
|
||||
}
|
||||
|
||||
export function kubeconfigRoute() {
|
||||
const router = Router();
|
||||
|
||||
router.route('/kubeconfig/user')
|
||||
.get(async (req, res) => {
|
||||
const { username = "kubernetes" } = userSession.get(req);
|
||||
const authToken = userSession.getToken(req);
|
||||
const cert = await getCertificateAuthorityData('base64');
|
||||
const data = await generateKubeConfig({
|
||||
username,
|
||||
authToken: authToken,
|
||||
certificateAuthority: cert
|
||||
});
|
||||
res.json(data);
|
||||
});
|
||||
|
||||
router.route('/kubeconfig/service-account/:namespace/:account')
|
||||
.get(async (req, res) => {
|
||||
const { authHeader } = userSession.get(req);
|
||||
const { namespace, account } = req.params;
|
||||
try {
|
||||
const secret = await kubeRequest<{ items: Secret[] }>({
|
||||
path: `/api/v1/namespaces/${namespace}/secrets`,
|
||||
authHeader: authHeader,
|
||||
}).then(secrets => {
|
||||
return secrets.items.find(secret => {
|
||||
const { annotations } = secret.metadata;
|
||||
return annotations && annotations["kubernetes.io/service-account.name"] == account;
|
||||
});
|
||||
});
|
||||
const data = await generateKubeConfig({
|
||||
username: account,
|
||||
namespace: namespace,
|
||||
authToken: base64.decode(secret.data.token),
|
||||
certificateAuthority: secret.data["ca.crt"],
|
||||
});
|
||||
res.json(data);
|
||||
} catch (err) {
|
||||
const { response }: AxiosError = err;
|
||||
res.status(403).json(response ? response.data : err.toString());
|
||||
}
|
||||
});
|
||||
|
||||
return router;
|
||||
}
|
||||
|
||||
async function generateKubeConfig(params: IKubeConfigParams) {
|
||||
const { clusterName, clusterUrl } = await getClusterConfigMap();
|
||||
const { authToken, username, certificateAuthority, namespace = "" } = params;
|
||||
return {
|
||||
'apiVersion': 'v1',
|
||||
'kind': 'Config',
|
||||
'clusters': [
|
||||
{
|
||||
'name': clusterName,
|
||||
'cluster': {
|
||||
'server': clusterUrl,
|
||||
'certificate-authority-data': certificateAuthority
|
||||
}
|
||||
}
|
||||
],
|
||||
'users': [
|
||||
{
|
||||
'name': username,
|
||||
'user': {
|
||||
'token': authToken,
|
||||
}
|
||||
}
|
||||
],
|
||||
'contexts': [
|
||||
{
|
||||
'name': clusterName,
|
||||
'context': {
|
||||
'user': username,
|
||||
'cluster': clusterName,
|
||||
'namespace': namespace,
|
||||
}
|
||||
}
|
||||
],
|
||||
'current-context': clusterName
|
||||
}
|
||||
}
|
||||
@@ -1,139 +0,0 @@
|
||||
//-- Streaming k8s watch-api events
|
||||
|
||||
import axios from "axios"
|
||||
import { Router } from "express";
|
||||
import { IncomingMessage } from "http";
|
||||
import { kubeRequest } from "../api/kube-request";
|
||||
import { IKubeWatchEvent, IKubeWatchRouteEvent, IKubeWatchRouteQuery} from "../common/kubewatch"
|
||||
import { userSession } from "../user-session";
|
||||
import { logger } from "../utils/logger";
|
||||
|
||||
export function kubewatchRoute() {
|
||||
const router = Router();
|
||||
|
||||
router.route('/watch')
|
||||
.get(async (req, res) => {
|
||||
const { authHeader } = userSession.get(req);
|
||||
const queryParams: IKubeWatchRouteQuery = req.query;
|
||||
const apis: string[] = [].concat(queryParams.api || []);
|
||||
const streams = new Map<string, IncomingMessage>();
|
||||
const eventsBuffer = new Map<string, IKubeWatchEvent>();
|
||||
let isClosing = false;
|
||||
|
||||
if (!apis.length) {
|
||||
res.status(400).json({
|
||||
message: "Empty request. Query params 'api' are not provided.",
|
||||
example: "?api=/api/v1/pods&api=/api/v1/nodes",
|
||||
});
|
||||
return;
|
||||
}
|
||||
|
||||
res.header({
|
||||
'Content-Type': 'text/event-stream',
|
||||
'Cache-Control': 'no-cache',
|
||||
'Connection': 'keep-alive'
|
||||
});
|
||||
|
||||
// init streams
|
||||
const cancelToken = axios.CancelToken.source();
|
||||
apis.forEach(apiUrl => {
|
||||
console.log("[KUBE-WATCH] init stream", apiUrl);
|
||||
const connecting = kubeRequest<IncomingMessage>({
|
||||
path: apiUrl,
|
||||
responseType: "stream",
|
||||
authHeader: authHeader,
|
||||
cancelToken: cancelToken.token,
|
||||
});
|
||||
connecting.then(stream => {
|
||||
streams.set(apiUrl, stream); // save connection for clean up
|
||||
stream.socket.setKeepAlive(true); // keep connection alive
|
||||
let lastUnusedBuffer = ""
|
||||
return stream
|
||||
.on("data", (buffer: Buffer) => {
|
||||
const data = lastUnusedBuffer + buffer.toString().trim();
|
||||
data.split("\n").map(str => {
|
||||
try {
|
||||
const eventObj = JSON.parse(str);
|
||||
bufferEvent(eventObj); // handle
|
||||
lastUnusedBuffer = ""; // clean up since parsing was successful
|
||||
} catch (err) {
|
||||
lastUnusedBuffer = str; // invalid json, tail must wait next incoming data
|
||||
}
|
||||
});
|
||||
})
|
||||
.on("end", () => {
|
||||
// client must update resource-version and try to reconnect
|
||||
console.log(`[KUBE-WATCH] stream ended ${apiUrl}`)
|
||||
sendEvent({
|
||||
type: "STREAM_END",
|
||||
url: apiUrl,
|
||||
status: stream.statusCode,
|
||||
})
|
||||
});
|
||||
}, err => {
|
||||
logger.error(`[KUBE-WATCH] error ${apiUrl}`, err);
|
||||
sendEvent({
|
||||
type: "STREAM_END",
|
||||
url: apiUrl,
|
||||
status: 410,
|
||||
})
|
||||
});
|
||||
});
|
||||
|
||||
function getEventBufferId(evt: IKubeWatchEvent) {
|
||||
const { object, type } = evt;
|
||||
const { kind } = object;
|
||||
let { metadata: { uid } } = object;
|
||||
if (kind === "Event") {
|
||||
uid = (object as any).involvedObject.uid; // reason: uid for events always unique
|
||||
}
|
||||
return `${type}:${kind}-${uid}`
|
||||
}
|
||||
|
||||
function bufferEvent(evt: IKubeWatchEvent) {
|
||||
const id = getEventBufferId(evt);
|
||||
if (eventsBuffer.has(id)) {
|
||||
eventsBuffer.delete(id); // clear to move event to the end in map's "timeline"
|
||||
}
|
||||
eventsBuffer.set(id, evt); // save latest event by object's identity
|
||||
}
|
||||
|
||||
function sendEvent(evt: IKubeWatchEvent | IKubeWatchRouteEvent, autoFlush = true) {
|
||||
if (isClosing) return;
|
||||
// convert to "text/event-stream" format
|
||||
res.write(`data: ${JSON.stringify(evt)}\n\n`);
|
||||
if (autoFlush) {
|
||||
// @ts-ignore
|
||||
res.flush();
|
||||
}
|
||||
}
|
||||
|
||||
// process sending events
|
||||
const flushInterval = setInterval(() => {
|
||||
const eventsPack = Array.from(eventsBuffer.entries())
|
||||
.slice(0, 100) // max limit per sending
|
||||
.map(([id, evt]) => {
|
||||
eventsBuffer.delete(id); // clean up used event
|
||||
return evt;
|
||||
});
|
||||
if (eventsPack.length > 0) {
|
||||
eventsPack.forEach(evt => sendEvent(evt, false));
|
||||
// @ts-ignore
|
||||
res.flush();
|
||||
}
|
||||
}, 1000);
|
||||
|
||||
function onClose() {
|
||||
if (isClosing) return;
|
||||
isClosing = true;
|
||||
clearInterval(flushInterval);
|
||||
streams.forEach(stream => stream.removeAllListeners("end"));
|
||||
cancelToken.cancel();
|
||||
}
|
||||
|
||||
req.on("close", onClose);
|
||||
res.on("finish", onClose);
|
||||
});
|
||||
|
||||
return router;
|
||||
}
|
||||
@@ -1,82 +0,0 @@
|
||||
//-- Metrics
|
||||
// https://prometheus.io/docs/prometheus/latest/querying/api/
|
||||
|
||||
import { Router } from "express";
|
||||
import config from "../config";
|
||||
import { kubeRequest } from "../api/kube-request";
|
||||
import { userSession } from "../user-session";
|
||||
import { AxiosError } from "axios";
|
||||
import { IMetrics } from "../../client/api/endpoints/metrics.api";
|
||||
import { IMetricsQuery } from "../common/metrics"
|
||||
|
||||
|
||||
export function metricsRoute() {
|
||||
const router = Router();
|
||||
|
||||
router.post("/metrics", async (req, res, next) => {
|
||||
const { authHeader } = userSession.get(req);
|
||||
const { namespace, ...queryParams } = req.query;
|
||||
const query: IMetricsQuery = req.body;
|
||||
|
||||
/*eslint-disable */
|
||||
// add default namespace for rbac-proxy validation
|
||||
if (!queryParams.kubernetes_namespace) {
|
||||
queryParams.kubernetes_namespace = config.STATS_NAMESPACE;
|
||||
}
|
||||
/*eslint-enble */
|
||||
|
||||
// prometheus metrics loader
|
||||
const attempts: { [query: string]: number } = {};
|
||||
const maxAttempts = 5;
|
||||
const loadMetrics = (query: string): Promise<IMetrics> => {
|
||||
const attempt = attempts[query] = (attempts[query] || 0) + 1;
|
||||
return kubeRequest<IMetrics>({
|
||||
url: config.KUBE_METRICS_URL,
|
||||
path: "/api/v1/query_range",
|
||||
authHeader: authHeader,
|
||||
params: {
|
||||
query: query,
|
||||
...queryParams,
|
||||
},
|
||||
}).catch(async (err: AxiosError) => {
|
||||
// https://github.com/axios/axios#handling-errors
|
||||
if (!err.response && attempt < maxAttempts) {
|
||||
await new Promise(resolve => setTimeout(resolve, attempt * 1000)); // add delay before repeating request
|
||||
return loadMetrics(query);
|
||||
}
|
||||
return {
|
||||
status: err.toString(),
|
||||
data: {
|
||||
result: []
|
||||
},
|
||||
} as IMetrics;
|
||||
})
|
||||
};
|
||||
|
||||
// return data in same structure as query
|
||||
let data: any;
|
||||
try {
|
||||
if (typeof query === "string") {
|
||||
data = await loadMetrics(query)
|
||||
}
|
||||
else if (Array.isArray(query)) {
|
||||
data = await Promise.all(query.map(loadMetrics));
|
||||
}
|
||||
else {
|
||||
data = {};
|
||||
const result = await Promise.all(
|
||||
Object.values(query).map(loadMetrics)
|
||||
);
|
||||
Object.keys(query).forEach((metricName, index) => {
|
||||
data[metricName] = result[index];
|
||||
});
|
||||
}
|
||||
|
||||
res.json(data);
|
||||
} catch (err) {
|
||||
next(err);
|
||||
}
|
||||
});
|
||||
|
||||
return router;
|
||||
}
|
||||
@@ -1,16 +0,0 @@
|
||||
//-- App readiness checker
|
||||
|
||||
import { Router } from "express";
|
||||
|
||||
export function readyStateRoute() {
|
||||
const router = Router();
|
||||
|
||||
router.route('/ready')
|
||||
.get(async (req, res) => {
|
||||
const serviceWaitingList: string[] = [];
|
||||
|
||||
res.json(serviceWaitingList);
|
||||
});
|
||||
|
||||
return router;
|
||||
}
|
||||
@@ -1,24 +0,0 @@
|
||||
//-- User sessions helper
|
||||
|
||||
import { Request } from "express";
|
||||
import CookieSessionObject = CookieSessionInterfaces.CookieSessionObject;
|
||||
|
||||
interface IUserSession extends CookieSessionObject {
|
||||
authHeader: string;
|
||||
username?: string;
|
||||
isUserLogin?: boolean; // authorization via user's manual login with credentials
|
||||
}
|
||||
|
||||
export const userSession = {
|
||||
get(req: Request): Partial<IUserSession> {
|
||||
return req.session;
|
||||
},
|
||||
save(req: Request, data: Partial<IUserSession> = {}) {
|
||||
Object.assign(req.session, data);
|
||||
},
|
||||
getToken(req: Request): string {
|
||||
const { authHeader = "" } = this.get(req);
|
||||
const [type, token = ""] = authHeader.split(" ");
|
||||
return token;
|
||||
}
|
||||
};
|
||||
@@ -1,32 +0,0 @@
|
||||
// Load & parse local kubernetes config (dev-only)
|
||||
|
||||
import * as jsYaml from "js-yaml"
|
||||
import * as fs from "fs"
|
||||
import * as os from "os"
|
||||
import chalk from "chalk";
|
||||
import { logger } from "./logger";
|
||||
|
||||
interface IKubeConfigParams {
|
||||
clusterUrl: string;
|
||||
userToken: string;
|
||||
}
|
||||
|
||||
export function getKubeConfigDev(): Partial<IKubeConfigParams> {
|
||||
const KUBE_CONFIG_FILE = process.env.KUBE_CONFIG_FILE;
|
||||
if (!KUBE_CONFIG_FILE) {
|
||||
return {}
|
||||
}
|
||||
let filePath = ""
|
||||
try {
|
||||
filePath = KUBE_CONFIG_FILE.replace("~", os.homedir());
|
||||
const yaml = fs.readFileSync(filePath).toString();
|
||||
const config = jsYaml.safeLoad(yaml);
|
||||
return {
|
||||
clusterUrl: config.clusters[0].cluster.server,
|
||||
userToken: config.users[0].user.token,
|
||||
}
|
||||
} catch (err) {
|
||||
logger.error(`[KUBE-CONFIG] Parsing config file ${chalk.bold(filePath)} failed.`, err)
|
||||
return {};
|
||||
}
|
||||
}
|
||||
@@ -1,36 +0,0 @@
|
||||
import chalk from "chalk";
|
||||
import * as ip from "ip"
|
||||
|
||||
const divider = chalk.gray('-----------------------------------');
|
||||
|
||||
export const logger = {
|
||||
// Called when express.js app starts on given port w/o errors
|
||||
appStarted: (port: string | number, title = 'Server started ') => {
|
||||
console.log(chalk.underline.bold(title) + ` ${chalk.green('✓')}`);
|
||||
console.log(`
|
||||
${chalk.bold('Access URLs:')}
|
||||
${divider}
|
||||
Localhost: ${chalk.magenta(`http://localhost:${port}`)}
|
||||
LAN: ${chalk.magenta(`http://${ip.address()}:${port}`)}
|
||||
${divider}
|
||||
`);
|
||||
},
|
||||
|
||||
error(message: string, error: any) {
|
||||
let errString = ""
|
||||
try {
|
||||
errString = JSON.stringify(error, null, 2);
|
||||
} catch (e) {
|
||||
errString = String(error);
|
||||
}
|
||||
console.error(chalk.bold.red(`[ERROR] -> ${message}`), errString);
|
||||
}
|
||||
};
|
||||
|
||||
export function sanitizeHeaders(headers: { [name: string]: string }) {
|
||||
if (headers.Authorization) {
|
||||
const [authType, authToken] = headers.Authorization.split(" ");
|
||||
headers.Authorization = `${authType} *****`
|
||||
}
|
||||
return headers;
|
||||
}
|
||||
@@ -1,30 +0,0 @@
|
||||
// Parse payload from jwt token
|
||||
// Format: https://github.com/kontena/kube-oidc#openid-connect-and-kubernetes
|
||||
import { base64 } from "../../client/utils/base64";
|
||||
|
||||
interface JwtPayload {
|
||||
"azp": string;// "1077841816959-kkdh0lvq1au80qv4gtubotvgs9am4a95.apps.googleusercontent.com",
|
||||
"aud": string;// "1077841816959-kkdh0lvq1au80qv4gtubotvgs9am4a95.apps.googleusercontent.com",
|
||||
"sub": string;// "103613003764490648449",
|
||||
"hd": string;// "redhat.com",
|
||||
"email": string;// "echiang@redhat.com",
|
||||
"email_verified": boolean; // true,
|
||||
"at_hash": string;// "OGDOjIJ92FkatDBoCm8ydg",
|
||||
"exp": number;// 1527203940,
|
||||
"iss": string;// "https://accounts.google.com",
|
||||
"iat": number;// 1527200340,
|
||||
"name": string; // "Eric Chiang",
|
||||
"picture": string; // "https://lh5.googleusercontent.com/-Cs2iHTXiETs/AAAAAAAAAAI/AAAAAAAAACM/0Q85UhZizjg/s96-c/photo.jpg",
|
||||
"given_name": string; // "Eric",
|
||||
"family_name": string; //"Chiang",
|
||||
"locale": string; // "en"
|
||||
}
|
||||
|
||||
export function parseJwt(token: string): Partial<JwtPayload> {
|
||||
try {
|
||||
const [header, payload, signature] = token.split(".");
|
||||
return base64.decode(payload);
|
||||
} catch (e) {
|
||||
return {}
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user