sa-kubeconfig.sh

#!/usr/bin/bash

set -euExo pipefail
shopt -s inherit_errexit

function create-secret-for-sa {
  if [[ -z "${1}" ]]; then
    echo "missing namespace" > /dev/stderr
    return 1
  fi
  local namespace
  namespace="${1}"
  
  if [[ -z "${2}" ]]; then
    echo "missing serviceaccount name" > /dev/stderr
    return 1
  fi
  local serviceaccount
  serviceaccount="${2}"
  
  if [[ -z "${3}" ]]; then
    echo "missing secret name" > /dev/stderr
    return 1
  fi
  local secret
  secret="${3}"

  kubectl -n="${namespace}" apply --server-side -o=yaml -f=- <<EOF
apiVersion: v1
kind: Secret
metadata:
  name: ${secret}
  annotations:
    kubernetes.io/service-account.name: ${serviceaccount}
type: kubernetes.io/service-account-token
EOF
  kubectl -n="${namespace}" wait --for='jsonpath=.data.token' "secret/${secret}"
}

function setup-user {
  if [[ -e "${1}" ]]; then
    echo "can't setup empty user" > /dev/stderr
    return 1
  fi
  local user
  user="${1}"
  
  kubectl create namespace users --dry-run=client -o yaml | kubectl apply --server-side -f=-
  kubectl -n=users create sa "${user}" --dry-run=client -o=yaml | kubectl apply --server-side -f=-
  kubectl create clusterrolebinding "${user}" --clusterrole=cluster-admin --serviceaccount="users:${user}" --dry-run=client -o=yaml | kubectl apply --server-side -f=-
  create-secret-for-sa users "${user}" "${user}"
}

function print-sa-kubeconfig {
  if [[ -z "${1}" ]]; then
    echo "can't print kubeconfig without user namespace" > /dev/stderr
    return 1
  fi
  local namespace
  namespace="${1}"
  
  if [[ -z "${2}" ]]; then
    echo "can't print kubeconfig without a secret name" > /dev/stderr
    return 1
  fi
  local secret
  secret="${2}"
  
  if [[ -z "${3}" ]]; then
    echo "can't print kubeconfig without a user name" > /dev/stderr
    return 1
  fi
  local user
  user="${3}"
  
  local token
  token="$( kubectl -n="${namespace}" get "secret/${secret}" --template='{{ .data.token }}' | base64 -d )"
  kubectl config view --minify --raw -o=yaml | user="${user}" token="${token}" yq '.current-context as $ccName | ( .contexts | filter(.name == $ccName) )[0] as $cc | ( .users | filter(.name == $cc.context.user) )[0] as $ut | $ut.name = env(user) | del($ut.user) | $ut.user.token = env(token) | .users += $ut | $cc as $ct | $ct.name = ( $ct.name | sub(".*(@.*)", env(user)+"${1}") ) | $ct.context.user = env(user) | .contexts += $ct | .'
}

function print-user-sa-kubeconfig {
  print-sa-kubeconfig users "$@"
}

setup-user tnozicka
print-user-sa-kubeconfig tnozicka