Question

我已经创建了一个AWS EKS集群。为了获得其kubeconfig，我通常使用shell运行aws eks update-kubeconfig --name cluster-name --region us-west-2。

但是，我现在希望在Go中获得kubeconfig，而不必在外壳中运行任何东西（目标是在Go测试中创建然后操作EKS集群）。我可以使用以下代码描述EKS集群：

package main

import (
    "fmt"

    "github.com/aws/aws-sdk-go/aws"
    "github.com/aws/aws-sdk-go/aws/session"
    "github.com/aws/aws-sdk-go/service/eks"
)

func main() {
    sess := session.Must(session.NewSession(&aws.Config{
        Region: aws.String("us-west-2"),
    }))
    eksSvc := eks.New(sess, aws.NewConfig().WithRegion("us-west-2"))


    clusterOutput, err := eksSvc.DescribeCluster(&eks.DescribeClusterInput{
        Name: aws.String("cluster-name"),
    })
    if err != nil {
        panic(err)
    }
    fmt.Printf("%#v\n", clusterOutput)
}

在那之后，我目前不知道如何获取该集群的kubeconfig，然后将其与Kubernetes的Go客户端一起使用，而不必分别使用aws eks。

到目前为止，我没有检查过AWS文档，AWS CLI代码库和eksctl代码库。与EKS群集的连接仅在此网页中记录，并且使用外壳程序：https://aws.amazon.com/premiumsupport/knowledge-center/eks-cluster-connection/

有什么想法吗？

Answer 1

一般流程如下：

DescribeCluster（已完成）并提取一些必要的数据
使用必要的数据，使用aws-iam-authenticator的package token
使用该令牌，在client-go的帮助下创建一个Kubernetes客户端集。

package main

import (
    "encoding/base64"
    "log"

    "github.com/aws/aws-sdk-go/aws"
    "github.com/aws/aws-sdk-go/aws/session"

    "github.com/aws/aws-sdk-go/service/eks"
    metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
    "k8s.io/client-go/kubernetes"
    "k8s.io/client-go/rest"

    "sigs.k8s.io/aws-iam-authenticator/pkg/token"
)

func newClientset(cluster *eks.Cluster) (*kubernetes.Clientset, error) {
    log.Printf("%+v", cluster)
    gen, err := token.NewGenerator(true, false)
    if err != nil {
        return nil, err
    }
    opts := &token.GetTokenOptions{
        ClusterID: aws.StringValue(cluster.Name),
    }
    tok, err := gen.GetWithOptions(opts)
    if err != nil {
        return nil, err
    }
    ca, err := base64.StdEncoding.DecodeString(aws.StringValue(cluster.CertificateAuthority.Data))
    if err != nil {
        return nil, err
    }
    clientset, err := kubernetes.NewForConfig(
        &rest.Config{
            Host:        aws.StringValue(cluster.Endpoint),
            BearerToken: tok.Token,
            TLSClientConfig: rest.TLSClientConfig{
                CAData: ca,
            },
        },
    )
    if err != nil {
        return nil, err
    }
    return clientset, nil
}

func main() {
    name := "wonderful-outfit-1583362361"
    region := "us-east-2"
    sess := session.Must(session.NewSession(&aws.Config{
        Region: aws.String(region),
    }))
    eksSvc := eks.New(sess)

    input := &eks.DescribeClusterInput{
        Name: aws.String(name),
    }
    result, err := eksSvc.DescribeCluster(input)
    if err != nil {
        log.Fatalf("Error calling DescribeCluster: %v", err)
    }
    clientset, err := newClientset(result.Cluster)
    if err != nil {
        log.Fatalf("Error creating clientset: %v", err)
    }
    nodes, err := clientset.CoreV1().Nodes().List(metav1.ListOptions{})
    if err != nil {
        log.Fatalf("Error getting EKS nodes: %v", err)
    }
    log.Printf("There are %d nodes associated with cluster %s", len(nodes.Items), name)
}

这是我的go.mod版本：

module github.com/swoldemi/sandbox

go 1.14

require (
    github.com/aws/aws-sdk-go v1.29.19
    k8s.io/apimachinery v0.0.0-20190612125636-6a5db36e93ad
    k8s.io/client-go v0.0.0-20190425172711-65184652c889
    sigs.k8s.io/aws-iam-authenticator v0.5.0
)

Answer 2

除了添加到Simon's great answer之外，您可能还希望通过GetTokenOptions结构传递会话，如下所示：

opts := &token.GetTokenOptions{
        ClusterID: aws.StringValue(cluster.Name),
        Session: sess,
    }
    tok, err := gen.GetWithOptions(opts)

否则，gen.GetWithOptions(opts)调用将尝试从本地来源（例如~/.aws/credentials）读取您的AWS凭证，并且可能会出现以下错误：

NoCredentialProviders: no valid providers in chain. Deprecated.
    For verbose messaging see aws.Config.CredentialsChainVerboseErrors

无法在Go代码中获取AWS EKS集群的kubeconfig

2 个答案: