kubectl 源码分析之config set-cluster

 欢迎关注我的公众号：

 目前刚开始写一个月，一共写了18篇原创文章，文章目录如下：

istio多集群探秘，部署了50次多集群后我得出的结论

istio多集群链路追踪，附实操视频

istio防故障利器，你知道几个,istio新手不要读，太难！

istio业务权限控制，原来可以这么玩

istio实现非侵入压缩，微服务之间如何实现压缩

不懂envoyfilter也敢说精通istio系列-http-rbac-不要只会用AuthorizationPolicy配置权限

不懂envoyfilter也敢说精通istio系列-02-http-corsFilter-不要只会vs

不懂envoyfilter也敢说精通istio系列-03-http-csrf filter-再也不用再代码里写csrf逻辑了

不懂envoyfilter也敢说精通istio系列http-jwt_authn-不要只会RequestAuthorization

不懂envoyfilter也敢说精通istio系列-05-fault-filter-故障注入不止是vs

不懂envoyfilter也敢说精通istio系列-06-http-match-配置路由不只是vs

不懂envoyfilter也敢说精通istio系列-07-负载均衡配置不止是dr

不懂envoyfilter也敢说精通istio系列-08-连接池和断路器

不懂envoyfilter也敢说精通istio系列-09-http-route filter

不懂envoyfilter也敢说精通istio系列-network filter-redis proxy

不懂envoyfilter也敢说精通istio系列-network filter-HttpConnectionManager

不懂envoyfilter也敢说精通istio系列-ratelimit-istio ratelimit完全手册

 

————————————————

type createClusterOptions struct {//set-cluster结构体
	configAccess          clientcmd.ConfigAccess
	name                  string
	server                cliflag.StringFlag
	insecureSkipTLSVerify cliflag.Tristate
	certificateAuthority  cliflag.StringFlag
	embedCAData           cliflag.Tristate
}

//创建set-cluster命令
func NewCmdConfigSetCluster(out io.Writer, configAccess clientcmd.ConfigAccess) *cobra.Command {
	options := &createClusterOptions{configAccess: configAccess}//初始化结构体

	cmd := &cobra.Command{//创建cobra命令
		Use:                   fmt.Sprintf("set-cluster NAME [--%v=server] [--%v=path/to/certificate/authority] [--%v=true]", clientcmd.FlagAPIServer, clientcmd.FlagCAFile, clientcmd.FlagInsecure),
		DisableFlagsInUseLine: true,
		Short:                 i18n.T("Sets a cluster entry in kubeconfig"),
		Long:                  createClusterLong,
		Example:               createClusterExample,
		Run: func(cmd *cobra.Command, args []string) {
			cmdutil.CheckErr(options.complete(cmd))//准备
			cmdutil.CheckErr(options.run())//运行
			fmt.Fprintf(out, "Cluster %q set.\n", options.name)//打印结果
		},
	}

	options.insecureSkipTLSVerify.Default(false)//是否跳过tls校验

	cmd.Flags().Var(&options.server, clientcmd.FlagAPIServer, clientcmd.FlagAPIServer+" for the cluster entry in kubeconfig")//server选项
	f := cmd.Flags().VarPF(&options.insecureSkipTLSVerify, clientcmd.FlagInsecure, "", clientcmd.FlagInsecure+" for the cluster entry in kubeconfig")//insecure-skip-tls-verify选项
	f.NoOptDefVal = "true"
	cmd.Flags().Var(&options.certificateAuthority, clientcmd.FlagCAFile, "Path to "+clientcmd.FlagCAFile+" file for the cluster entry in kubeconfig")/certificate-authority选项
	cmd.MarkFlagFilename(clientcmd.FlagCAFile)
	f = cmd.Flags().VarPF(&options.embedCAData, clientcmd.FlagEmbedCerts, "", clientcmd.FlagEmbedCerts+" for the cluster entry in kubeconfig")//embedCAData选项
	f.NoOptDefVal = "true"

	return cmd
}

func (o *createClusterOptions) complete(cmd *cobra.Command) error {//准备
	args := cmd.Flags().Args()//获取参数
	if len(args) != 1 {//参数不为1个报错
		return helpErrorf(cmd, "Unexpected args: %v", args)
	}

	o.name = args[0]//设置cluster名称
	return nil
}

func (o createClusterOptions) run() error {//运行
	err := o.validate()//校验
	if err != nil {
		return err
	}

	config, err := o.configAccess.GetStartingConfig()//获取config
	if err != nil {
		return err
	}

	startingStanza, exists := config.Clusters[o.name]//判断cluster是否存在
	if !exists {//不存在，创建cluster
		startingStanza = clientcmdapi.NewCluster()
	}
	cluster := o.modifyCluster(*startingStanza)//修改cluster
	config.Clusters[o.name] = &cluster//设置cluster

	if err := clientcmd.ModifyConfig(o.configAccess, *config, true); err != nil {//修改配置
		return err
	}

	return nil
}

func (o createClusterOptions) validate() error {//校验
	if len(o.name) == 0 {//名称不能为空
		return errors.New("you must specify a non-empty cluster name")
	}
	if o.insecureSkipTLSVerify.Value() && o.certificateAuthority.Value() != "" {
//不能同时指定insecureSkipTLSVerify和certificateAuthority
		return errors.New("you cannot specify a certificate authority and insecure mode at the same time")
	}
	if o.embedCAData.Value() {//如果embed-data为true
		caPath := o.certificateAuthority.Value()//certificateAuthority路径
		if caPath == "" {//路径为空报错
			return fmt.Errorf("you must specify a --%s to embed", clientcmd.FlagCAFile)
		}
		if _, err := ioutil.ReadFile(caPath); err != nil {//判断路径是否可读取
			return fmt.Errorf("could not read %s data from %s: %v", clientcmd.FlagCAFile, caPath, err)
		}
	}

	return nil
}

//修改cluster
func (o *createClusterOptions) modifyCluster(existingCluster clientcmdapi.Cluster) clientcmdapi.Cluster {
	modifiedCluster := existingCluster

	if o.server.Provided() {//如果指定了--server，则设置cluster的server
		modifiedCluster.Server = o.server.Value()
	}
	if o.insecureSkipTLSVerify.Provided() {//如果设置了insecureSkipTLSVerify
		modifiedCluster.InsecureSkipTLSVerify = o.insecureSkipTLSVerify.Value()//设置insecureSkipTLSVerify
		// Specifying insecure mode clears any certificate authority
		if modifiedCluster.InsecureSkipTLSVerify {// 如果insecureSkipTLSVerify为true
			modifiedCluster.CertificateAuthority = ""//CertificateAuthority 设为空
			modifiedCluster.CertificateAuthorityData = nil//CertificateAuthorityData 设为nil
		}
	}
	if o.certificateAuthority.Provided() {//如果certificateAuthority有值
		caPath := o.certificateAuthority.Value()//获取路径
		if o.embedCAData.Value() {// 如果embed-data为true
			modifiedCluster.CertificateAuthorityData, _ = ioutil.ReadFile(caPath)//设置CertificateAuthorityData为读取的值
			modifiedCluster.InsecureSkipTLSVerify = false//InsecureSkipTLSVerify 设为false
			modifiedCluster.CertificateAuthority = ""//CertificateAuthority 设为空
		} else {
			caPath, _ = filepath.Abs(caPath)//获取绝对路径
			modifiedCluster.CertificateAuthority = caPath//CertificateAuthority 设为路径
			// Specifying a certificate authority file clears certificate authority data and insecure mode
			if caPath != "" {//路径不为空
				modifiedCluster.InsecureSkipTLSVerify = false//InsecureSkipTLSVerify 设为false
				modifiedCluster.CertificateAuthorityData = nil//CertificateAuthorityData 设为nil
			}
		}
	}

	return modifiedCluster
}