kubectl 源码分析之config set-cluster

古城微笑少年丶 2023-02-21 02:24 57阅读 0赞

#  欢迎关注我的公众号： #

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAaHhwamF2YTE_size_8_color_FFFFFF_t_70_g_se_x_16][]

目前刚开始写一个月，一共写了18篇原创文章，文章目录如下：

[istio多集群探秘，部署了50次多集群后我得出的结论][istio_50]

[istio多集群链路追踪，附实操视频][istio]

[istio防故障利器，你知道几个,istio新手不要读，太难！][istio_istio]

[istio业务权限控制，原来可以这么玩][istio 1]

[istio实现非侵入压缩，微服务之间如何实现压缩][istio 2]

[不懂envoyfilter也敢说精通istio系列-http-rbac-不要只会用AuthorizationPolicy配置权限][envoyfilter_istio_-http-rbac-_AuthorizationPolicy]

[不懂envoyfilter也敢说精通istio系列-02-http-corsFilter-不要只会vs][envoyfilter_istio_-02-http-corsFilter-_vs]

[不懂envoyfilter也敢说精通istio系列-03-http-csrf filter-再也不用再代码里写csrf逻辑了][envoyfilter_istio_-03-http-csrf filter-_csrf]

[不懂envoyfilter也敢说精通istio系列http-jwt\_authn-不要只会RequestAuthorization][envoyfilter_istio_http-jwt_authn-_RequestAuthorization]

[不懂envoyfilter也敢说精通istio系列-05-fault-filter-故障注入不止是vs][envoyfilter_istio_-05-fault-filter-_vs]

[不懂envoyfilter也敢说精通istio系列-06-http-match-配置路由不只是vs][envoyfilter_istio_-06-http-match-_vs]

[不懂envoyfilter也敢说精通istio系列-07-负载均衡配置不止是dr][envoyfilter_istio_-07-_dr]

[不懂envoyfilter也敢说精通istio系列-08-连接池和断路器][envoyfilter_istio_-08-]

[不懂envoyfilter也敢说精通istio系列-09-http-route filter][envoyfilter_istio_-09-http-route filter]

[不懂envoyfilter也敢说精通istio系列-network filter-redis proxy][envoyfilter_istio_-network filter-redis proxy]

[不懂envoyfilter也敢说精通istio系列-network filter-HttpConnectionManager][envoyfilter_istio_-network filter-HttpConnectionManager]

[不懂envoyfilter也敢说精通istio系列-ratelimit-istio ratelimit完全手册][envoyfilter_istio_-ratelimit-istio ratelimit]

————————————————

type createClusterOptions struct {//set-cluster结构体
    	configAccess          clientcmd.ConfigAccess
    	name                  string
    	server                cliflag.StringFlag
    	insecureSkipTLSVerify cliflag.Tristate
    	certificateAuthority  cliflag.StringFlag
    	embedCAData           cliflag.Tristate
    }

//创建set-cluster命令
    func NewCmdConfigSetCluster(out io.Writer, configAccess clientcmd.ConfigAccess) *cobra.Command {
    	options := &createClusterOptions{configAccess: configAccess}//初始化结构体
    
    	cmd := &cobra.Command{//创建cobra命令
    		Use:                   fmt.Sprintf("set-cluster NAME [--%v=server] [--%v=path/to/certificate/authority] [--%v=true]", clientcmd.FlagAPIServer, clientcmd.FlagCAFile, clientcmd.FlagInsecure),
    		DisableFlagsInUseLine: true,
    		Short:                 i18n.T("Sets a cluster entry in kubeconfig"),
    		Long:                  createClusterLong,
    		Example:               createClusterExample,
    		Run: func(cmd *cobra.Command, args []string) {
    			cmdutil.CheckErr(options.complete(cmd))//准备
    			cmdutil.CheckErr(options.run())//运行
    			fmt.Fprintf(out, "Cluster %q set.\n", options.name)//打印结果
    		},
    	}
    
    	options.insecureSkipTLSVerify.Default(false)//是否跳过tls校验
    
    	cmd.Flags().Var(&options.server, clientcmd.FlagAPIServer, clientcmd.FlagAPIServer+" for the cluster entry in kubeconfig")//server选项
    	f := cmd.Flags().VarPF(&options.insecureSkipTLSVerify, clientcmd.FlagInsecure, "", clientcmd.FlagInsecure+" for the cluster entry in kubeconfig")//insecure-skip-tls-verify选项
    	f.NoOptDefVal = "true"
    	cmd.Flags().Var(&options.certificateAuthority, clientcmd.FlagCAFile, "Path to "+clientcmd.FlagCAFile+" file for the cluster entry in kubeconfig")/certificate-authority选项
    	cmd.MarkFlagFilename(clientcmd.FlagCAFile)
    	f = cmd.Flags().VarPF(&options.embedCAData, clientcmd.FlagEmbedCerts, "", clientcmd.FlagEmbedCerts+" for the cluster entry in kubeconfig")//embedCAData选项
    	f.NoOptDefVal = "true"
    
    	return cmd
    }

func (o *createClusterOptions) complete(cmd *cobra.Command) error {//准备
    	args := cmd.Flags().Args()//获取参数
    	if len(args) != 1 {//参数不为1个报错
    		return helpErrorf(cmd, "Unexpected args: %v", args)
    	}
    
    	o.name = args[0]//设置cluster名称
    	return nil
    }

func (o createClusterOptions) run() error {//运行
    	err := o.validate()//校验
    	if err != nil {
    		return err
    	}
    
    	config, err := o.configAccess.GetStartingConfig()//获取config
    	if err != nil {
    		return err
    	}
    
    	startingStanza, exists := config.Clusters[o.name]//判断cluster是否存在
    	if !exists {//不存在，创建cluster
    		startingStanza = clientcmdapi.NewCluster()
    	}
    	cluster := o.modifyCluster(*startingStanza)//修改cluster
    	config.Clusters[o.name] = &cluster//设置cluster
    
    	if err := clientcmd.ModifyConfig(o.configAccess, *config, true); err != nil {//修改配置
    		return err
    	}
    
    	return nil
    }

func (o createClusterOptions) validate() error {//校验
    	if len(o.name) == 0 {//名称不能为空
    		return errors.New("you must specify a non-empty cluster name")
    	}
    	if o.insecureSkipTLSVerify.Value() && o.certificateAuthority.Value() != "" {
    //不能同时指定insecureSkipTLSVerify和certificateAuthority
    		return errors.New("you cannot specify a certificate authority and insecure mode at the same time")
    	}
    	if o.embedCAData.Value() {//如果embed-data为true
    		caPath := o.certificateAuthority.Value()//certificateAuthority路径
    		if caPath == "" {//路径为空报错
    			return fmt.Errorf("you must specify a --%s to embed", clientcmd.FlagCAFile)
    		}
    		if _, err := ioutil.ReadFile(caPath); err != nil {//判断路径是否可读取
    			return fmt.Errorf("could not read %s data from %s: %v", clientcmd.FlagCAFile, caPath, err)
    		}
    	}
    
    	return nil
    }

//修改cluster
    func (o *createClusterOptions) modifyCluster(existingCluster clientcmdapi.Cluster) clientcmdapi.Cluster {
    	modifiedCluster := existingCluster
    
    	if o.server.Provided() {//如果指定了--server，则设置cluster的server
    		modifiedCluster.Server = o.server.Value()
    	}
    	if o.insecureSkipTLSVerify.Provided() {//如果设置了insecureSkipTLSVerify
    		modifiedCluster.InsecureSkipTLSVerify = o.insecureSkipTLSVerify.Value()//设置insecureSkipTLSVerify
    		// Specifying insecure mode clears any certificate authority
    		if modifiedCluster.InsecureSkipTLSVerify {// 如果insecureSkipTLSVerify为true
    			modifiedCluster.CertificateAuthority = ""//CertificateAuthority 设为空
    			modifiedCluster.CertificateAuthorityData = nil//CertificateAuthorityData 设为nil
    		}
    	}
    	if o.certificateAuthority.Provided() {//如果certificateAuthority有值
    		caPath := o.certificateAuthority.Value()//获取路径
    		if o.embedCAData.Value() {// 如果embed-data为true
    			modifiedCluster.CertificateAuthorityData, _ = ioutil.ReadFile(caPath)//设置CertificateAuthorityData为读取的值
    			modifiedCluster.InsecureSkipTLSVerify = false//InsecureSkipTLSVerify 设为false
    			modifiedCluster.CertificateAuthority = ""//CertificateAuthority 设为空
    		} else {
    			caPath, _ = filepath.Abs(caPath)//获取绝对路径
    			modifiedCluster.CertificateAuthority = caPath//CertificateAuthority 设为路径
    			// Specifying a certificate authority file clears certificate authority data and insecure mode
    			if caPath != "" {//路径不为空
    				modifiedCluster.InsecureSkipTLSVerify = false//InsecureSkipTLSVerify 设为false
    				modifiedCluster.CertificateAuthorityData = nil//CertificateAuthorityData 设为nil
    			}
    		}
    	}
    
    	return modifiedCluster
    }

[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAaHhwamF2YTE_size_8_color_FFFFFF_t_70_g_se_x_16]: https://img-blog.csdnimg.cn/20211007094240106.jpg?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAaHhwamF2YTE=,size_8,color_FFFFFF,t_70,g_se,x_16
[istio_50]: https://mp.weixin.qq.com/s/_OPMjmWCDSTlmbAxytg33A
[istio]: https://mp.weixin.qq.com/s/kjvtno_UzJAGr1joxm3tvw
[istio_istio]: https://mp.weixin.qq.com/s/e2-p_NY31Mc5y07S4Bb1JQ
[istio 1]: https://mp.weixin.qq.com/s/iTV0SCQLhSOTYncp3PxoHQ
[istio 2]: https://mp.weixin.qq.com/s/eINlrT242RlAwfuZu1_PcA
[envoyfilter_istio_-http-rbac-_AuthorizationPolicy]: https://mp.weixin.qq.com/s/Q-yTGBNqkjOov49LTXPrPA
[envoyfilter_istio_-02-http-corsFilter-_vs]: https://mp.weixin.qq.com/s/bFMdrT7OKSqoWv8pDXOIqQ
[envoyfilter_istio_-03-http-csrf filter-_csrf]: https://mp.weixin.qq.com/s/dlG9phV-kMMxs4UPzuRNYg
[envoyfilter_istio_http-jwt_authn-_RequestAuthorization]: https://mp.weixin.qq.com/s/IfrJ-FdLYsdhPkDrcO_YXA
[envoyfilter_istio_-05-fault-filter-_vs]: https://mp.weixin.qq.com/s/a4gDXqD8uswgglMwkUph2Q
[envoyfilter_istio_-06-http-match-_vs]: https://mp.weixin.qq.com/s/TpS3DHdcaJiPivIS_jsIGw
[envoyfilter_istio_-07-_dr]: https://mp.weixin.qq.com/s/k-zJm7n7OOKg6MotQJYPAA
[envoyfilter_istio_-08-]: https://mp.weixin.qq.com/s/n_bJ3saNeTtXRprIymhwzg
[envoyfilter_istio_-09-http-route filter]: https://mp.weixin.qq.com/s/JAeZr0BMVQxIrB3S_7Ru0A
[envoyfilter_istio_-network filter-redis proxy]: https://mp.weixin.qq.com/s/B9IPTI8F3q42nVkqbQRlPw
[envoyfilter_istio_-network filter-HttpConnectionManager]: https://mp.weixin.qq.com/s/W3OPQWkCVvuHGS49cTNhlg
[envoyfilter_istio_-ratelimit-istio ratelimit]: https://mp.weixin.qq.com/s/KgiDsELNol27mgZvDbFsqw