Use kubeconfig secret to fetch cluster CA

Signed-off-by: Dinar Valeev <[email protected]>

Author: k0da

bootstrap/eks/controllers/eksconfig_controller.go

@@ -20,19 +20,18 @@ package controllers
 import (
 	"bytes"
 	"context"
+	"encoding/base64"
 	"fmt"
 	"os"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/eks"
 	"github.com/pkg/errors"
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/tools/clientcmd"
 	"k8s.io/klog/v2"
 	"k8s.io/utils/ptr"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -53,6 +52,7 @@ import (
 	"sigs.k8s.io/cluster-api/util"
 	"sigs.k8s.io/cluster-api/util/annotations"
 	"sigs.k8s.io/cluster-api/util/conditions"
+	kubeconfigutil "sigs.k8s.io/cluster-api/util/kubeconfig"
 	"sigs.k8s.io/cluster-api/util/patch"
 	"sigs.k8s.io/cluster-api/util/predicates"
 )
@@ -324,36 +324,25 @@ func (r *EKSConfigReconciler) joinWorker(ctx context.Context, cluster *clusterv1
 			log.Info("Using mock CA certificate for test environment")
 			nodeInput.CACert = "mock-ca-certificate-for-testing"
 		} else {
-			// Fetch CA cert from EKS API
-			sess, err := session.NewSession(&aws.Config{Region: aws.String(controlPlane.Spec.Region)})
+			// Fetch CA cert from KubeConfig secrtet
+			capiOwner, err := extractClusterOwner(&config.ObjectMeta)
 			if err != nil {
-				log.Error(err, "Failed to create AWS session for EKS API")
-				conditions.MarkFalse(config, eksbootstrapv1.DataSecretAvailableCondition,
-					eksbootstrapv1.DataSecretGenerationFailedReason,
-					clusterv1.ConditionSeverityWarning,
-					"Failed to create AWS session: %v", err)
-				return ctrl.Result{}, err
+				return ctrl.Result{}, errors.Wrap(err, "failed to extract cluster owner from EKSConfig metadata")
+			}
+			obj := client.ObjectKey{
+				Namespace: config.Namespace,
+				Name:      capiOwner,
 			}
-			eksClient := eks.New(sess)
-			describeInput := &eks.DescribeClusterInput{Name: aws.String(controlPlane.Spec.EKSClusterName)}
-			clusterOut, err := eksClient.DescribeCluster(describeInput)
+			ca, err := extractCAFromSecret(ctx, r.Client, obj)
 			if err != nil {
-				log.Error(err, "Failed to describe EKS cluster for CA cert fetch")
+				log.Error(err, "Failed to extract CA from kubeconfig secret")
 				conditions.MarkFalse(config, eksbootstrapv1.DataSecretAvailableCondition,
 					eksbootstrapv1.DataSecretGenerationFailedReason,
 					clusterv1.ConditionSeverityWarning,
-					"Failed to describe EKS cluster: %v", err)
+					"Failed to extract CA from kubeconfig secret: %v", err)
 				return ctrl.Result{}, err
-			} else if clusterOut.Cluster != nil && clusterOut.Cluster.CertificateAuthority != nil && clusterOut.Cluster.CertificateAuthority.Data != nil {
-				nodeInput.CACert = *clusterOut.Cluster.CertificateAuthority.Data
-			} else {
-				log.Error(nil, "CA certificate not found in EKS cluster response")
-				conditions.MarkFalse(config, eksbootstrapv1.DataSecretAvailableCondition,
-					eksbootstrapv1.DataSecretGenerationFailedReason,
-					clusterv1.ConditionSeverityWarning,
-					"CA certificate not found in EKS cluster response")
-				return ctrl.Result{}, fmt.Errorf("CA certificate not found in EKS cluster response")
 			}
+			nodeInput.CACert = ca
 		}
 
 		// Get AMI ID from AWSManagedMachinePool's launch template if specified
@@ -405,6 +394,31 @@ func (r *EKSConfigReconciler) joinWorker(ctx context.Context, cluster *clusterv1
 	return ctrl.Result{}, nil
 }
 
+func extractClusterOwner(meta *metav1.ObjectMeta) (string, error) {
+	for _, owner := range meta.OwnerReferences {
+		if owner.Kind == "Cluster" {
+			return owner.Name, nil
+		}
+	}
+	return "", fmt.Errorf("no Cluster owner found in metadata")
+}
+
+func extractCAFromSecret(ctx context.Context, c client.Client, obj client.ObjectKey) (string, error) {
+	data, err := kubeconfigutil.FromSecret(ctx, c, obj)
+	if err != nil {
+		return "", errors.Wrapf(err, "failed to get kubeconfig secret %s", obj.Name)
+	}
+	config, err := clientcmd.Load(data)
+	if err != nil {
+		return "", errors.Wrapf(err, "failed to parse kubeconfig data from secret %s", obj.Name)
+	}
+	cluster, ok := config.Clusters[obj.Name]
+	if !ok {
+		return "", fmt.Errorf("cluster %q not found", obj.Name)
+	}
+	return base64.StdEncoding.EncodeToString(cluster.CertificateAuthorityData), nil
+}
+
 func (r *EKSConfigReconciler) SetupWithManager(ctx context.Context, mgr ctrl.Manager, option controller.Options) error {
 	b := ctrl.NewControllerManagedBy(mgr).
 		For(&eksbootstrapv1.EKSConfig{}).