lade 0.17.2

Automatically load secrets from your preferred vault as environment variables, and clear them once your shell command is over.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117

use anyhow::{Result, bail};
use serde::Deserialize;
use std::process::Command;

/// Resolves a kube context for `cluster_endpoint`. `kubectl config view` is a
/// local, read-only, idempotent operation (no network call, no write), so
/// this is safe to call concurrently from multiple threads without any
/// shared cache or lock: caching would only save a cheap subprocess call at
/// the cost of serializing unrelated bindings against each other.
pub(crate) fn resolve_kube_context(
    cluster_endpoint: &str,
    selector: Option<&str>,
) -> Result<String> {
    let output = Command::new("kubectl")
        .args(["config", "view", "-o", "json"])
        .output()?;
    if !output.status.success() {
        bail!(
            "could not resolve kube context for '{}': {}",
            cluster_endpoint,
            String::from_utf8_lossy(&output.stderr)
        );
    }
    let config: KubeConfig = serde_json::from_slice(&output.stdout)?;
    let clusters = config
        .clusters
        .unwrap_or_default()
        .into_iter()
        .filter_map(|cluster| {
            let server = cluster.cluster.server?;
            (normalize_cluster_endpoint(&server).as_deref() == Some(cluster_endpoint))
                .then_some(cluster.name)
        })
        .collect::<Vec<_>>();
    if clusters.is_empty() {
        bail!(
            "no kubeconfig cluster matches endpoint '{}'",
            cluster_endpoint
        );
    }
    let matching_contexts = config
        .contexts
        .unwrap_or_default()
        .into_iter()
        .filter(|ctx| clusters.contains(&ctx.context.cluster))
        .map(|ctx| ctx.name)
        .collect::<Vec<_>>();
    if let Some(selected) = selector {
        if !matching_contexts.iter().any(|ctx| ctx == selected) {
            bail!(
                "selected kube context '{}' does not match endpoint '{}' (available: {})",
                selected,
                cluster_endpoint,
                matching_contexts.join(", ")
            );
        }
        return Ok(selected.to_string());
    }
    match matching_contexts.as_slice() {
        [only] => Ok(only.clone()),
        [] => bail!(
            "no kubeconfig context references endpoint '{}'",
            cluster_endpoint
        ),
        _ => bail!(
            "ambiguous kubeconfig contexts for endpoint '{}': {}",
            cluster_endpoint,
            matching_contexts.join(", ")
        ),
    }
}

fn normalize_cluster_endpoint(server: &str) -> Option<String> {
    let (scheme, rest) = match server.split_once("://") {
        Some((scheme, rest)) => (Some(scheme), rest),
        None => (None, server),
    };
    let authority = rest.split('/').next()?;
    if authority.contains(':') {
        return Some(authority.to_string());
    }
    match scheme {
        Some("https") => Some(format!("{authority}:443")),
        Some("http") => Some(format!("{authority}:80")),
        _ => Some(authority.to_string()),
    }
}

#[derive(Deserialize)]
struct KubeConfig {
    #[serde(default)]
    clusters: Option<Vec<NamedCluster>>,
    #[serde(default)]
    contexts: Option<Vec<NamedContext>>,
}

#[derive(Deserialize)]
struct NamedCluster {
    name: String,
    cluster: ClusterInner,
}

#[derive(Deserialize)]
struct ClusterInner {
    server: Option<String>,
}

#[derive(Deserialize)]
struct NamedContext {
    name: String,
    context: ContextInner,
}

#[derive(Deserialize)]
struct ContextInner {
    cluster: String,
}