Rewriting create-user.sh in pure GO functions

[9trocode]

package main

import (
	"context"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/base64"
	"encoding/json"
	"encoding/pem"
	"fmt"
	"io/ioutil"
	certificatesv1 "k8s.io/api/certificates/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/util/wait"
	"k8s.io/client-go/kubernetes"
	"k8s.io/client-go/tools/clientcmd"
	"k8s.io/client-go/util/homedir"
	"os"
	"path/filepath"
	"strings"
	"time"
)

// KubeConfig represents the kubeconfig structure
type KubeConfig struct {
	APIVersion     string      `json:"apiVersion"`
	Kind           string      `json:"kind"`
	Clusters       []Cluster   `json:"clusters"`
	Contexts       []Context   `json:"contexts"`
	CurrentContext string      `json:"current-context"`
	Preferences    interface{} `json:"preferences"`
	Users          []User      `json:"users"`
}

// Cluster represents the cluster configuration
type Cluster struct {
	Name    string `json:"name"`
	Cluster struct {
		CertificateAuthorityData string `json:"certificate-authority-data"`
		Server                   string `json:"server"`
	} `json:"cluster"`
}

// Context represents the context configuration
type Context struct {
	Name    string `json:"name"`
	Context struct {
		Cluster   string `json:"cluster"`
		User      string `json:"user"`
		Namespace string `json:"namespace,omitempty"`
	} `json:"context"`
}

// User represents the user configuration
type User struct {
	Name string `json:"name"`
	User struct {
		ClientCertificateData string `json:"client-certificate-data"`
		ClientKeyData         string `json:"client-key-data"`
	} `json:"user"`
}

func createKubeconfigFile(user, tenant string, caData, certData, keyData []byte) {
	context := fmt.Sprintf("%s-%s", user, tenant)
	cluster := "orbstack"
	serverURL := "https://127.0.0.1:26443"

	kubeconfig := KubeConfig{
		APIVersion:     "v1",
		Kind:           "Config",
		CurrentContext: context,
		Clusters: []Cluster{
			{
				Name: cluster,
				Cluster: struct {
					CertificateAuthorityData string `json:"certificate-authority-data"`
					Server                   string `json:"server"`
				}{
					CertificateAuthorityData: base64.StdEncoding.EncodeToString(caData),
					Server:                   serverURL,
				},
			},
		},
		Contexts: []Context{
			{
				Name: context,
				Context: struct {
					Cluster   string `json:"cluster"`
					User      string `json:"user"`
					Namespace string `json:"namespace,omitempty"`
				}{
					Cluster: cluster,
					User:    user,
				},
			},
		},
		Users: []User{
			{
				Name: user,
				User: struct {
					ClientCertificateData string `json:"client-certificate-data"`
					ClientKeyData         string `json:"client-key-data"`
				}{
					ClientCertificateData: base64.StdEncoding.EncodeToString(certData),
					ClientKeyData:         base64.StdEncoding.EncodeToString(keyData),
				},
			},
		},
	}

	// Embed CA certificate data directly
	kubeconfig.Clusters[0].Cluster.CertificateAuthorityData = string(caData)

	kubeconfigJSON, err := json.MarshalIndent(kubeconfig, "", "  ")
	if err != nil {
		fmt.Println("Error marshaling kubeconfig to JSON:", err)
		os.Exit(1)
	}

	kubeconfigFileName := fmt.Sprintf("%s-%s.kubeconfig", user, tenant)
	err = ioutil.WriteFile(kubeconfigFileName, kubeconfigJSON, 0644)
	if err != nil {
		fmt.Println("Error creating kubeconfig file:", err)
		os.Exit(1)
	}

	fmt.Printf("kubeconfig file is: %s\n", kubeconfigFileName)
	fmt.Printf("To use it as %s, export KUBECONFIG=%s\n", user, kubeconfigFileName)
}

func fetchCertificate(clientset *kubernetes.Clientset, user, tenant string) {
	csrObj, err := clientset.CertificatesV1().CertificateSigningRequests().Get(context.TODO(), fmt.Sprintf("%s-%s", user, tenant), metav1.GetOptions{})
	if err != nil {
		fmt.Println("Error getting CSR object:", err)
		os.Exit(1)
	}

	//err = wait.PollImmediate(time.Second, time.Minute*0, func() (bool, error) {
	if len(csrObj.Status.Certificate) > 0 {
		//return true, nil
	}
	csrObj, err = clientset.CertificatesV1().CertificateSigningRequests().Get(context.TODO(), fmt.Sprintf("%s-%s", user, tenant), metav1.GetOptions{})
	if err != nil {
		fmt.Println("Error getting CSR object:", err)
		os.Exit(1)
	}

	certData, err := base64.StdEncoding.DecodeString(strings.TrimSpace(string(csrObj.Status.Certificate)))
	if err != nil {
		fmt.Println("Error decoding certificate data:", err)
		os.Exit(1)
	}

	err = ioutil.WriteFile(fmt.Sprintf("%s-%s.crt", user, tenant), certData, 0644)
	if err != nil {
		fmt.Println("Error writing signed certificate to file:", err)
		os.Exit(1)
	}
}

func main() {

	user := "oil"
	tenant := "oil"
	group := ""

	if user == "" || tenant == "" {
		fmt.Println("User and Tenant must be specified!")
		os.Exit(1)
	}

	if group == "" {
		group = "capsule.clastix.io"
	}

	config, err := clientcmd.BuildConfigFromFlags("", filepath.Join(homedir.HomeDir(), ".kube", "config"))
	if err != nil {
		fmt.Println("Error building Kubernetes client config:", err)
		os.Exit(1)
	}

	clientset, err := kubernetes.NewForConfig(config)
	if err != nil {
		fmt.Println("Error creating Kubernetes client:", err)
		os.Exit(1)
	}

	fmt.Printf("Creating certs in memory\n")

	mergedGroups := fmt.Sprintf("/O=%s", group)
	mergedGroups = strings.ReplaceAll(mergedGroups, ",", "/O=")
	fmt.Printf("Merging groups %s\n", mergedGroups)

	key, csrDER, err := generateKeyAndCSR(user, mergedGroups)
	if err != nil {
		fmt.Println("Error generating key and CSR:", err)
		os.Exit(1)
	}

	// Save CSR to CertificateSigningRequest object
	_, err = createCSRObject(clientset, user, tenant, csrDER)
	if err != nil {
		fmt.Println("Error creating CSR object:", err)
		os.Exit(1)
	}

	approveCSR(clientset, user, tenant)

	fetchCertificate(clientset, user, tenant)

	// Updated code to get CA certificate
	var caData []byte

	// Check if TLSClientConfig is not nil
	if config.TLSClientConfig.CAFile != "" || config.TLSClientConfig.CertFile != "" || config.TLSClientConfig.KeyFile != "" {
		// Extract CA certificate from the Kubernetes config file
		caFile := config.TLSClientConfig.CAFile
		caData, err = ioutil.ReadFile(caFile)
		if err != nil {
			fmt.Println("Error reading cluster CA certificate:", err)
			os.Exit(1)
		}
	} else if len(config.TLSClientConfig.CAData) > 0 {
		// Use CA data directly if provided in the config
		caData = config.TLSClientConfig.CAData
	} else {
		fmt.Println("CA certificate information not found in the Kubernetes config")
		os.Exit(1)
	}

	// Base64 encode CA data
	encodedCAData := base64.StdEncoding.EncodeToString(caData)

	// Convert the private key to a byte slice
	keyBytes := x509.MarshalPKCS1PrivateKey(key)

	// Base64 encode key data
	encodedKeyData := base64.StdEncoding.EncodeToString(keyBytes)

	csrObj, _ := clientset.CertificatesV1().CertificateSigningRequests().Get(context.TODO(), fmt.Sprintf("%s-%s", user, tenant), metav1.GetOptions{})

	fmt.Println(csrObj)

	encodedCertificate := base64.StdEncoding.EncodeToString(csrObj.Status.Certificate)

	createKubeconfigFile(user, tenant, []byte(encodedCAData), []byte(encodedCertificate), []byte(encodedKeyData))
}

// generateKeyAndCSR generates a new RSA private key and a Certificate Signing Request (CSR).
func generateKeyAndCSR(user, mergedGroups string) (*rsa.PrivateKey, []byte, error) {
	// Generate RSA private key
	key, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, nil, err
	}

	// Generate CSR
	template := x509.CertificateRequest{
		Subject: pkix.Name{
			CommonName:   fmt.Sprintf("%s%s", user, mergedGroups),
			Organization: []string{"system:authenticated"},
		},
		SignatureAlgorithm: x509.SHA256WithRSA,
	}

	csrDER, err := x509.CreateCertificateRequest(rand.Reader, &template, key)
	if err != nil {
		return nil, nil, err
	}

	return key, csrDER, nil
}

func createCSRObject(clientset *kubernetes.Clientset, user, tenant string, csrDER []byte) (*certificatesv1.CertificateSigningRequest, error) {
	csrPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE REQUEST", Bytes: csrDER})

	csrObj := &certificatesv1.CertificateSigningRequest{
		ObjectMeta: metav1.ObjectMeta{
			Name: fmt.Sprintf("%s-%s", user, tenant),
		},
		Spec: certificatesv1.CertificateSigningRequestSpec{
			Groups:     []string{"system:authenticated"},
			Request:    csrPEM,
			SignerName: "kubernetes.io/kube-apiserver-client",
			Usages: []certificatesv1.KeyUsage{
				certificatesv1.UsageDigitalSignature,
				certificatesv1.UsageKeyEncipherment,
				certificatesv1.UsageClientAuth,
			},
		},
	}

	return clientset.CertificatesV1().CertificateSigningRequests().Create(context.TODO(), csrObj, metav1.CreateOptions{})
}

func approveCSR(clientset *kubernetes.Clientset, user, tenant string) {
	err := wait.PollImmediate(time.Second, time.Second*10, func() (bool, error) {
		csrObj, _ := clientset.CertificatesV1().CertificateSigningRequests().Get(context.TODO(), fmt.Sprintf("%s-%s", user, tenant), metav1.GetOptions{})

		fmt.Println(csrObj)

		csrObj.Status = certificatesv1.CertificateSigningRequestStatus{
			Conditions: append(csrObj.Status.Conditions, certificatesv1.CertificateSigningRequestCondition{
				Type:           certificatesv1.CertificateApproved,
				Reason:         "KubectlApprove",
				Status:         "True",
				LastUpdateTime: metav1.Now(),
			}),
		}

		_, err := clientset.CertificatesV1().CertificateSigningRequests().UpdateApproval(context.TODO(), fmt.Sprintf("%s-%s", user, tenant), csrObj, metav1.UpdateOptions{})
		if err != nil {
			fmt.Println("Error approving the CSR:", err)
			os.Exit(1)
		}

		return true, nil
	})

	if err != nil {
		fmt.Println("Error waiting for CSR approval:", err)
		os.Exit(1)
	}
}

[9trocode]

The result of this code would look like this it generates ${tenant}-${user}.kubeconfig

{
  "apiVersion": "v1",
  "kind": "Config",
  "clusters": [
    {
      "name": "orbstack",
      "cluster": {
        "certificate-authority-data": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJkekNDQVIyZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWpNU0V3SHdZRFZRUUREQmhyTTNNdGMyVnkKZG1WeUxXTmhRREUzTURnNE1UYzFOREl3SGhjTk1qUXdNakkwTWpNek1qSXlXaGNOTXpRd01qSXhNak16TWpJeQpXakFqTVNFd0h3WURWUVFEREJock0zTXRjMlZ5ZG1WeUxXTmhRREUzTURnNE1UYzFOREl3V1RBVEJnY3Foa2pPClBRSUJCZ2dxaGtqT1BRTUJCd05DQUFUN0NFMGJkczEyQnIyQkxmbTNRU1owNHNlVCsvVlF4NHlEVmxHTXBVNzIKZ2YycFlienF3czE4OE1PQkFSbnVoWXh2NjQ0dSt6UGsxUVZFeStqVVZrekhvMEl3UURBT0JnTlZIUThCQWY4RQpCQU1DQXFRd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVVJjU052RmtzanRHMUxLMXNyTk5WCjVqT0hZMGt3Q2dZSUtvWkl6ajBFQXdJRFNBQXdSUUlnVStORGUxbjRlZnJkWEgwRjRPVVByU3FMK2dmMWJUZ20KaWJrN24ycDgrZnNDSVFEQzlqR1F2UHQvUThiNVFrcVFtdkVWVnVyYTN4b1hZVFRpT3QrU1BYU0Jzdz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K",
        "server": "https://127.0.0.1:26443"
      }
    }
  ],
  "contexts": [
    {
      "name": "oil-oil",
      "context": {
        "cluster": "orbstack",
        "user": "oil"
      }
    }
  ],
  "current-context": "oil-oil",
  "preferences": null,
  "users": [
    {
      "name": "oil",
      "user": {
        "client-certificate-data": "TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTm9WRU5EUVdsMVowRjNTVUpCWjBsU1FVNHJXV1Z1TjAwMFpXZEpPR3BtV1ZscGRsazRWVlYzUTJkWlNVdHZXa2w2YWpCRlFYZEpkMGw2UldnS1RVSTRSMEV4VlVWQmQzZFpZWHBPZWt4WFRuTmhWMVoxWkVNeGFsbFZRWGhPZWtFMFQwUkZNMDVVVVhsTlFqUllSRlJKTUUxRVNYbE9WRUV6VFVSbmVBcE5WbTlZUkZSSk1VMUVTWGxPUkVFelRVUm5lRTFXYjNkUmFrVmtUVUp6UjBFeFZVVkRhRTFWWXpOc2VtUkhWblJQYlVZeFpFZG9iR0p1VW5CWk1rWXdDbHBYVVhoSlZFRm1RbWRPVmtKQlRWUkhSemx3WWtNNVVGQlhUbWhqU0U0eFlrZFZkVmt5ZUdoak0xSndaVU0xY0dKNlEwTkJVMGwzUkZGWlNrdHZXa2tLYUhaalRrRlJSVUpDVVVGRVoyZEZVRUZFUTBOQlVXOURaMmRGUWtGTk9UWkhjakZFUzBsMFRHVkRSMDVQYnpFdlRHWkpZbEp2UVdkT2VrSmxhbWxTYWdwNWVXcFpNbVpRZW5salRYTldWVUkwV2pSMWFtUlRaMnhGYWtKalUydFdVamxMWTFaUmNHOWpNR3RIUTA5eGIwbHdVbHBpYkhSUGNXUXdVRTVTWlRWaUNqWXdSSEZrVWxZNWVGUTVUVmgxY25STFNHOVdhVXR6TjFsMFNqbE5ZVmhwYlhwNGVtaFNTMmRpVUhsTVR5OVpaV2x0WW5oSVJIUTNiSGhFU0hwbVJsY0taV0Y2Y1hVMFRGZFFkVTB4T1hreVpYUkRUWHB0WmxwbVYySkZUV2hFVGtkcU9WUklPVlkyYzNvdmEwbEdlblZJUkhRclVXRXZhemhMTTBzd1VqZHRhQXBuU2tGWVJVOXBWMGR5ZG1OR1QyOXlSazV0UWpsUmVtOWhSSGRHYTFSRE5qTXdibEpKU1dGRFMzYzFVVWhGTjNsM1YwVnVhVVpUU25GNFZ5dGpTaTkxQ2t4UlNrNTZSbWh3WjI1allYQkhPWFpwT0dsYWFHd3JMMjFpTUV4aGFGWnVabHBZU25waWNVSTNkMDFKY1dSQk1GcFVUVU5CZDBWQlFXRk9WMDFHVVhjS1JHZFpSRlpTTUZCQlVVZ3ZRa0ZSUkVGblYyZE5RazFIUVRGVlpFcFJVVTFOUVc5SFEwTnpSMEZSVlVaQ2QwMURUVUYzUjBFeFZXUkZkMFZDTDNkUlF3cE5RVUYzU0hkWlJGWlNNR3BDUW1kM1JtOUJWVzUyYkhCV2VsaFZiR2Q0WTBnMVJWQlpSbWRzTDJoR1YwUnJjM2REWjFsSlMyOWFTWHBxTUVWQmQwbEVDbE5CUVhkU1VVbG9RVTFtVFZacFRHZEViRmRPYlRWaksxZ3dibHBDUldKU2IxVm9SMFZ1V25oeVJHdHJURVJ0ZVZOSE4zRkJhVUpKT0ZsU01rTmtkM0VLZURNM1YyMWphVWROU2pBNVZWUnRZVnBRWXpZNVZHcEtjMjF2ZFhNcmFUaHlaejA5Q2kwdExTMHRSVTVFSUVORlVsUkpSa2xEUVZSRkxTMHRMUzBL",
        "client-key-data": "TUlJRW9nSUJBQUtDQVFFQXozb2F2VU1vaTB0NElZMDZqWDh0OGh0R2dDQTNNRjZPSkdQTEtOalo4L1BKd3l4VlFIaG5pNk4xS0NVU01GeEtSVkgwcHhWQ21oelNRWUk2cWdpbEZsdVcwNnAzUTgxRjdsdnJRT3AxRlgzRlAweGU2dTBvZWhXSXF6dGkwbjB4cGVLYlBIT0ZFcUJzL0lzNzloNktadkVjTzN1WEVNZk44Vlo1ck9xN2d0WSs0elgzTFo2MEl6T1o5bDlac1F5RU0wYVAxTWYxWHF6UCtRZ1hPNGNPMzVCcitUd3JjclJIdWFHQWtCY1E2SllhdTl3VTZpc1UyWUgxRE9ob1BBV1JNTHJmU2RFZ2hvSXJEbEFjVHZMQllTZUlWSW1yRmI1d24rNHRBazNNV0dtQ2R4cWtiMitMeUptR1g3K1p2UXRxRldkOWxjbk51b0h2QXdpcDBEUmxNd0lEQVFBQkFvSUJBQ2xGdy8zMFZ5Tm1qdTQxdHZrZzNKWDE0UTlwMlRDeERwdWtrbXg4dnRhdG4yeEk3R2lYeXhsWEdkNHppYXUvSURNciszd2xXWXRvd2xhdnZsWEd4SGh2SGREYmIwQTRuSG12SlZ4VGg1a1AzT1libmlJanJWS2o1LzBRSWpkM0dpSkNzdGpTcmgwbmRxYkNWOW84OXhGRlUzVnR2MzVpRU5DNmdCZnExZ1JQbUYvMzB3QW5IWHRVdXB5QjMwdmhDbDllMnh4dU1reWt6MVI3ZEVNOEhHTjRKNXNtdjRiUHJpQTErblhjc2NhMUNkcGdoMldBUldMVlNGNTBOQWZRYS90dWYwWWc3eE95OVkzcmZYZXFMcHkwR29hM2ZBSnBvVTJhaTY0S1AxK3lQeWRHZy9sbDJwVzc2UjdUV1FqcTEyeis3ZEhkRld4R045VDRRVkk1dU9rQ2dZRUErQmpqS1BYZTdxVTFxN3Uwa2dWVHU1NUN2bFBKK2VwTFl2VEE5d0lUak1QR1gxZTRvbGJWY3NrR0JiNFZMOSsycVE4UGdSZWRHdmtDZHRlRjAySmR5eGdUOWxNMHRVeXZhb2NmZTVOcG5FMUpBcDBRNjZWb1Qxa0JlNHIyeURSWmJUbUhQM2Q5KzVoQVlULzh3YThkSkZJTlUyeEtpSjBCS25aVFkzZzBmNDhDZ1lFQTFoWDZpbHJSUmxGa3VuYUNhVTJVQk9xdkl2MUkzSGl5ekxnSXF0MFlBb242YVpCblRnTUx3dHRiMHkvMjdkUm9iN1FFa0xnbWIzbzM2ZzZTZ1NLSmNJWU9oSDI1b2tFYmp4WUJOOHJnN3c5Z3lTdmJST1BUUjBuZmZmTEdueGZNS2Q0L1dIdEJkdE9pakg3UDA0MXV0U1RoSEJ0RFBGNjQvQmp1R013bDdoMENnWUFHdFVXUEdmYkpKUlpxYWt6YmxlRkp0V0hBbTZ0ZVlvTmZUWmJhRnVoSWFoSzNDVHdveDRoRjdrR0hiamhNYnhRVlJoNzVNcFpBNEhLOG05ODJjL1p0UTExbXo2RWhOYzJZWjhibUpIbzZpNnhwc2ExL2NaMThaNyt1ZzNkZ3VtbWdsbW1kd2JGYVdDZUZlYUZ2NnpneWZ6VjFCL3lMN1JMVy94UUtJSG5xNlFLQmdIUVVnTCtxRkpVTEp4SFBsbENncHVTdmwzemlWekpzSTQ3TExxL3VwOGtncFcyOXhiWFFBdjJKMFZWR1NaNlZNSGQ0NVl6T3ZOQnZOWWdzbEpWK2M0Vld1dUp1QlV5TC92UnJtd2QwY3RoTXYwNzAvN1J2ejZ4MHlzRFE5WTluNk9TK3hCd200TTBjWGFQT1VzUERpVWFoRTRvWTRqRUdyMGpKLzdma1lhQ2xBb0dBSE1PNmFWNW9EbndMUlJMVVE4QVdzbXh3dGh5STdSVXU4SVJUU0t6VTBwUnl3bFlKYUtuczd2N3ZIMEZUSlpiS3BQZW10UTg3d3Z4Q1E1cVhQemhmT0ZBdzRJYkpCR1BDS0E4a1dRUVdRd3FxSm50V0lGWUNidGt0UkhzSUJxMXNoaGlOeW44aXpUVGJ5S3FxYU9OWjdoZVh3ZUpmVHJNeEtQbkx0YmxSbXM0PQ=="
      }
    }
  ]
}