kubectl源码分析之config set-credentials

关注

原创最新推荐文章于 2026-11-04 22:09:44 发布 662 阅读 AI 写同款· GEO 优化 ›

Elasticsearch 报错 error At least one unigram is required but all tokens were ngrams 【代码】Elasticsearch 报错 error At least one unigram is required but all tokens were ngrams。阅读详情

欢迎关注我的公众号：

目前刚开始写一个月，一共写了18篇原创文章，文章目录如下：

istio多集群探秘，部署了50次多集群后我得出的结论

istio多集群链路追踪，附实操视频

istio防故障利器，你知道几个,istio新手不要读，太难！

istio业务权限控制，原来可以这么玩

istio实现非侵入压缩，微服务之间如何实现压缩

不懂envoyfilter也敢说精通istio系列-http-rbac-不要只会用AuthorizationPolicy配置权限

不懂envoyfilter也敢说精通istio系列-02-http-corsFilter-不要只会vs

不懂envoyfilter也敢说精通istio系列-03-http-csrf filter-再也不用再代码里写csrf逻辑了

不懂envoyfilter也敢说精通istio系列http-jwt_authn-不要只会RequestAuthorization

不懂envoyfilter也敢说精通istio系列-05-fault-filter-故障注入不止是vs

不懂envoyfilter也敢说精通istio系列-06-http-match-配置路由不只是vs

不懂envoyfilter也敢说精通istio系列-07-负载均衡配置不止是dr

不懂envoyfilter也敢说精通istio系列-08-连接池和断路器

不懂envoyfilter也敢说精通istio系列-09-http-route filter

不懂envoyfilter也敢说精通istio系列-network filter-redis proxy

不懂envoyfilter也敢说精通istio系列-network filter-HttpConnectionManager

不懂envoyfilter也敢说精通istio系列-ratelimit-istio ratelimit完全手册

————————————————

type createAuthInfoOptions struct {//set-credentials结构体
	configAccess      clientcmd.ConfigAccess
	name              string
	authPath          cliflag.StringFlag
	clientCertificate cliflag.StringFlag
	clientKey         cliflag.StringFlag
	token             cliflag.StringFlag
	username          cliflag.StringFlag
	password          cliflag.StringFlag
	embedCertData     cliflag.Tristate
	authProvider      cliflag.StringFlag

	authProviderArgs         map[string]string
	authProviderArgsToRemove []string

	execCommand     cliflag.StringFlag
	execAPIVersion  cliflag.StringFlag
	execArgs        []string
	execEnv         map[string]string
	execEnvToRemove []string
}

//创建set-credentials命令
func NewCmdConfigSetAuthInfo(out io.Writer, configAccess clientcmd.ConfigAccess) *cobra.Command {
	options := &createAuthInfoOptions{configAccess: configAccess}//初始化结构体
	return newCmdConfigSetAuthInfo(out, options)//创建命令
}

func newCmdConfigSetAuthInfo(out io.Writer, options *createAuthInfoOptions) *cobra.Command {
	cmd := &cobra.Command{//创建cobra命令
		Use: fmt.Sprintf(
			"set-credentials NAME [--%v=path/to/certfile] "+
				"[--%v=path/to/keyfile] "+
				"[--%v=bearer_token] "+
				"[--%v=basic_user] "+
				"[--%v=basic_password] "+
				"[--%v=provider_name] "+
				"[--%v=key=value] "+
				"[--%v=exec_command] "+
				"[--%v=exec_api_version] "+
				"[--%v=arg] "+
				"[--%v=key=value]",
			clientcmd.FlagCertFile,
			clientcmd.FlagKeyFile,
			clientcmd.FlagBearerToken,
			clientcmd.FlagUsername,
			clientcmd.FlagPassword,
			flagAuthProvider,
			flagAuthProviderArg,
			flagExecCommand,
			flagExecAPIVersion,
			flagExecArg,
			flagExecEnv,
		),
		DisableFlagsInUseLine: true,
		Short:                 i18n.T("Sets a user entry in kubeconfig"),
		Long:                  createAuthInfoLong,
		Example:               createAuthInfoExample,
		Run: func(cmd *cobra.Command, args []string) {
			err := options.complete(cmd, out)//准备
			if err != nil {
				cmd.Help()
				cmdutil.CheckErr(err)
			}
			cmdutil.CheckErr(options.run())//运行
			fmt.Fprintf(out, "User %q set.\n", options.name)//打印结果
		},
	}

	cmd.Flags().Var(&options.clientCertificate, clientcmd.FlagCertFile, "Path to "+clientcmd.FlagCertFile+" file for the user entry in kubeconfig")//clientCertificate选项
	cmd.MarkFlagFilename(clientcmd.FlagCertFile)
	cmd.Flags().Var(&options.clientKey, clientcmd.FlagKeyFile, "Path to "+clientcmd.FlagKeyFile+" file for the user entry in kubeconfig")//clientKey选项
	cmd.MarkFlagFilename(clientcmd.FlagKeyFile)
	cmd.Flags().Var(&options.token, clientcmd.FlagBearerToken, clientcmd.FlagBearerToken+" for the user entry in kubeconfig")//token选项
	cmd.Flags().Var(&options.username, clientcmd.FlagUsername, clientcmd.FlagUsername+" for the user entry in kubeconfig")//username选项
	cmd.Flags().Var(&options.password, clientcmd.FlagPassword, clientcmd.FlagPassword+" for the user entry in kubeconfig")//password选项
	cmd.Flags().Var(&options.authProvider, flagAuthProvider, "Auth provider for the user entry in kubeconfig")//authProvider选项
	cmd.Flags().StringSlice(flagAuthProviderArg, nil, "'key=value' arguments for the auth provider")//AuthProviderArg选项
	cmd.Flags().Var(&options.execCommand, flagExecCommand, "Command for the exec credential plugin for the user entry in kubeconfig")//execCommand选项
	cmd.Flags().Var(&options.execAPIVersion, flagExecAPIVersion, "API version of the exec credential plugin for the user entry in kubeconfig")//execAPIVersion选项
	cmd.Flags().StringSlice(flagExecArg, nil, "New arguments for the exec credential plugin command for the user entry in kubeconfig")//ExecArg选项
	cmd.Flags().StringArray(flagExecEnv, nil, "'key=value' environment values for the exec credential plugin")//ExecEnv选项
	f := cmd.Flags().VarPF(&options.embedCertData, clientcmd.FlagEmbedCerts, "", "Embed client cert/key for the user entry in kubeconfig")//embed-certs选项
	f.NoOptDefVal = "true"

	return cmd
}

//准备
func (o *createAuthInfoOptions) complete(cmd *cobra.Command, out io.Writer) error {
	args := cmd.Flags().Args()//获取参数
	if len(args) != 1 {//参数必须是1个
		return fmt.Errorf("Unexpected args: %v", args)
	}

	authProviderArgs, err := cmd.Flags().GetStringSlice(flagAuthProviderArg)//获取authProviderArgs
	if err != nil {
		return fmt.Errorf("Error: %s", err)
	}

	if len(authProviderArgs) > 0 {
		newPairs, removePairs, err := cmdutil.ParsePairs(authProviderArgs, flagAuthProviderArg, true)//解析authProviderArgs
		if err != nil {
			return fmt.Errorf("Error: %s", err)
		}
		o.authProviderArgs = newPairs//设置要添加的authProviderArgs
		o.authProviderArgsToRemove = removePairs//设置要删除的authProviderArgs
	}

	execArgs, err := cmd.Flags().GetStringSlice(flagExecArg)//获取execArgs
	if err != nil {
		return fmt.Errorf("Error: %s", err)
	}
	if len(execArgs) > 0 {//设置execArgs
		o.execArgs = execArgs
	}

	execEnv, err := cmd.Flags().GetStringArray(flagExecEnv)//获取execEnv
	if err != nil {
		return fmt.Errorf("Error: %s", err)
	}
	if len(execEnv) > 0 {
		newPairs, removePairs, err := cmdutil.ParsePairs(execEnv, flagExecEnv, true)//解析execEnv
		if err != nil {
			return fmt.Errorf("Error: %s", err)
		}
		o.execEnv = newPairs//设置要添加的execEnv
		o.execEnvToRemove = removePairs//设置要删除的execEnv
	}

	o.name = args[0]//设置name
	return nil
}

func (o createAuthInfoOptions) run() error {//运行
	err := o.validate()//校验
	if err != nil {
		return err
	}

	config, err := o.configAccess.GetStartingConfig()//加载config
	if err != nil {
		return err
	}

	startingStanza, exists := config.AuthInfos[o.name]//获取已经存在的authinfo
	if !exists {//不存在则创建
		startingStanza = clientcmdapi.NewAuthInfo()
	}
	authInfo := o.modifyAuthInfo(*startingStanza)//修改authinfo
	config.AuthInfos[o.name] = &authInfo//设置authinfo

	if err := clientcmd.ModifyConfig(o.configAccess, *config, true); err != nil {//把配置写回文件
		return err
	}

	return nil
}

/校验
func (o createAuthInfoOptions) validate() error {
	if len(o.name) == 0 {//name不能为空
		return errors.New("you must specify a non-empty user name")
	}
	methods := []string{}//定义methods
	if len(o.token.Value()) > 0 {//如果token有值，append methods
		methods = append(methods, fmt.Sprintf("--%v", clientcmd.FlagBearerToken))
	}
	if len(o.username.Value()) > 0 || len(o.password.Value()) > 0 {//如果用户名或密码有值
		methods = append(methods, fmt.Sprintf("--%v/--%v", clientcmd.FlagUsername, clientcmd.FlagPassword))// append methods
	}
	if len(methods) > 1 {//如果methods值大于1个，则报错
		return fmt.Errorf("you cannot specify more than one authentication method at the same time: %v", strings.Join(methods, ", "))
	}
	if o.embedCertData.Value() {//如果embed-certs为true
		certPath := o.clientCertificate.Value()//获取client-certificte的值
		keyPath := o.clientKey.Value()//获取client-key的值
		if certPath == "" && keyPath == "" {//如果certPath和keyPath都为空，则报错
			return fmt.Errorf("you must specify a --%s or --%s to embed", clientcmd.FlagCertFile, clientcmd.FlagKeyFile)
		}
		if certPath != "" {// 如果certPath不为空，判断是否可读取
			if _, err := ioutil.ReadFile(certPath); err != nil {
				return fmt.Errorf("error reading %s data from %s: %v", clientcmd.FlagCertFile, certPath, err)
			}
		}
		if keyPath != "" {//如果keypath不为空，判断是否可读取
			if _, err := ioutil.ReadFile(keyPath); err != nil {
				return fmt.Errorf("error reading %s data from %s: %v", clientcmd.FlagKeyFile, keyPath, err)
			}
		}
	}

	return nil
}

//修改authinfo
func (o *createAuthInfoOptions) modifyAuthInfo(existingAuthInfo clientcmdapi.AuthInfo) clientcmdapi.AuthInfo {
	modifiedAuthInfo := existingAuthInfo

	var setToken, setBasic bool//定义变量

	if o.clientCertificate.Provided() {//如果client-certificate有值
		certPath := o.clientCertificate.Value()//获取certPath
		if o.embedCertData.Value() {//如果embed-cert为true
			modifiedAuthInfo.ClientCertificateData, _ = ioutil.ReadFile(certPath)//设置ClientCertificateData为certPath的内容
			modifiedAuthInfo.ClientCertificate = ""//设置ClientCertificate 为空
		} else {
			certPath, _ = filepath.Abs(certPath)//获取certPath绝对路径
			modifiedAuthInfo.ClientCertificate = certPath//设置ClientCertificate 
			if len(modifiedAuthInfo.ClientCertificate) > 0 {//如果ClientCertificate 有值
				modifiedAuthInfo.ClientCertificateData = nil//设置ClientCertificateData 为nil
			}
		}
	}
	if o.clientKey.Provided() {//如果client-key有值
		keyPath := o.clientKey.Value()//获取keypath
		if o.embedCertData.Value() {//如果embed-certs为true
			modifiedAuthInfo.ClientKeyData, _ = ioutil.ReadFile(keyPath)//设置ClientKeyData为keyPath的内容
			modifiedAuthInfo.ClientKey = ""//设置ClientKey 为空
		} else {
			keyPath, _ = filepath.Abs(keyPath)//获取keyPath的绝对路径
			modifiedAuthInfo.ClientKey = keyPath//设置ClientKey 
			if len(modifiedAuthInfo.ClientKey) > 0 {//如果ClientKey 有值
				modifiedAuthInfo.ClientKeyData = nil//设置ClientKeyData 为nil
			}
		}
	}

	if o.token.Provided() {//如果token有值
		modifiedAuthInfo.Token = o.token.Value()//设置token
		setToken = len(modifiedAuthInfo.Token) > 0//设置setToken 
	}

	if o.username.Provided() {//如果username有值
		modifiedAuthInfo.Username = o.username.Value()//设置Username 
		setBasic = setBasic || len(modifiedAuthInfo.Username) > 0//设置setBasic 
	}
	if o.password.Provided() {//如果password有值
		modifiedAuthInfo.Password = o.password.Value()//设置Password 
		setBasic = setBasic || len(modifiedAuthInfo.Password) > 0//设置setBasic 
	}
	if o.authProvider.Provided() {//乳沟auth-provider有值
		newName := o.authProvider.Value()//获取auth-provider

		// Only overwrite if the existing auth-provider is nil, or different than the newly specified one.
		if modifiedAuthInfo.AuthProvider == nil || modifiedAuthInfo.AuthProvider.Name != newName {//如果authProvider为空获取name不同
			modifiedAuthInfo.AuthProvider = &clientcmdapi.AuthProviderConfig{//设置authProvider
				Name: newName,
			}
		}
	}

	if modifiedAuthInfo.AuthProvider != nil {//如果authProvider不为nil
		if modifiedAuthInfo.AuthProvider.Config == nil {//如果authprovider的config为空
			modifiedAuthInfo.AuthProvider.Config = make(map[string]string)//创建config
		}
		for _, toRemove := range o.authProviderArgsToRemove {// 遍历要删除的providerargs
			delete(modifiedAuthInfo.AuthProvider.Config, toRemove)//删除provider-args
		}
		for key, value := range o.authProviderArgs {//遍历要添加的provider-args
			modifiedAuthInfo.AuthProvider.Config[key] = value//添加provider args
		}
	}

	if o.execCommand.Provided() {//如果exec-command有值
		newExecCommand := o.execCommand.Value()//获取exec-command的值

		// create new Exec if doesn't exist, otherwise just modify the command
		if modifiedAuthInfo.Exec == nil {//如果exec为空，则创建
			modifiedAuthInfo.Exec = &clientcmdapi.ExecConfig{
				Command: newExecCommand,
			}
		} else {
			modifiedAuthInfo.Exec.Command = newExecCommand// 设置command
			// explicitly reset exec arguments
			modifiedAuthInfo.Exec.Args = nil//设置args为空
		}
	}

	// modify next values only if Exec exists, ignore these changes otherwise
	if modifiedAuthInfo.Exec != nil {//如果exec不为空
		if o.execAPIVersion.Provided() {//有过exec-apiversion有值
			modifiedAuthInfo.Exec.APIVersion = o.execAPIVersion.Value()//设置apiVersion
		}

		// rewrite exec arguments list with new values
		if o.execArgs != nil {// 如果args不为空
			modifiedAuthInfo.Exec.Args = o.execArgs//设置args
		}

		// iterate over the existing exec env values and remove the specified
		if o.execEnvToRemove != nil {//如果要删除的env不为空
			newExecEnv := []clientcmdapi.ExecEnvVar{}
			for _, value := range modifiedAuthInfo.Exec.Env {//遍历authinfo的env
				needToRemove := false
				for _, elemToRemove := range o.execEnvToRemove {
					if value.Name == elemToRemove {//如果名称和要删除的相同
						needToRemove = true//设置needtoremove为true
						break
					}
				}
				if !needToRemove {//如果needtoremove为false
					newExecEnv = append(newExecEnv, value)//添加env
				}
			}
			modifiedAuthInfo.Exec.Env = newExecEnv//设置env
		}

		// update or create specified environment variables for the exec plugin
		if o.execEnv != nil {//如果要添加的env不为空
			newEnv := []clientcmdapi.ExecEnvVar{}
			for newEnvName, newEnvValue := range o.execEnv {//遍历要添加env
				needToCreate := true
				for i := 0; i < len(modifiedAuthInfo.Exec.Env); i++ {// 遍历authinfo的env
					if modifiedAuthInfo.Exec.Env[i].Name == newEnvName {// 如果名称相同
						// update the existing value
						needToCreate = false
						modifiedAuthInfo.Exec.Env[i].Value = newEnvValue//设置value
						break
					}
				}
				if needToCreate {//如果needtocreate为true
					// create a new env value
					newEnv = append(newEnv, clientcmdapi.ExecEnvVar{Name: newEnvName, Value: newEnvValue})//追加env
				}
			}
			modifiedAuthInfo.Exec.Env = append(modifiedAuthInfo.Exec.Env, newEnv...)// 追加authinfo的env
		}
	}

	// If any auth info was set, make sure any other existing auth types are cleared
	if setToken || setBasic {//如果setToken或setBasic为true
		if !setToken {// 如果settoken为false
			modifiedAuthInfo.Token = ""//设置Token 
		}
		if !setBasic {//如果setBasic 为false，设置用户名和密码
			modifiedAuthInfo.Username = ""
			modifiedAuthInfo.Password = ""
		}
	}

	return modifiedAuthInfo
}