From ce9fea2b23435d04b2d06480b17d8d94afb3ba7f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Petazzoni?= <jerome.petazzoni@gmail.com>
Date: Thu, 4 Nov 2021 12:26:16 +0100
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=91=20Add=20cluster-admin=20certificat?=
 =?UTF-8?q?e-based=20kubeconfig?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 prepare-tf/stage2.tmpl | 47 +++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 46 insertions(+), 1 deletion(-)

diff --git a/prepare-tf/stage2.tmpl b/prepare-tf/stage2.tmpl
index c7d32582..1179b51d 100644
--- a/prepare-tf/stage2.tmpl
+++ b/prepare-tf/stage2.tmpl
@@ -162,10 +162,55 @@ resource "kubernetes_config_map" "kubeconfig_${index}" {
     namespace = kubernetes_namespace.shpod_${index}.metadata.0.name
   }
   data = {
-    kubeconfig = file("./kubeconfig.${index}")
+    kubeconfig_from_provider = file("./kubeconfig.${index}")
+    kubeconfig_cluster_admin = <<-EOT
+      kind: Config
+      apiVersion: v1
+      current-context: cluster-admin@k8s-${index}
+      clusters:
+      - name: k8s-${index}
+        cluster:
+          certificate-authority-data: $${yamldecode(file("./kubeconfig.${index}")).clusters.0.cluster.certificate-authority-data}
+          server: $${yamldecode(file("./kubeconfig.${index}")).clusters.0.cluster.server}
+      contexts:
+      - name: cluster-admin@k8s-${index}
+        context:
+          cluster: k8s-${index}
+          user: cluster-admin
+      users:
+      - name: cluster-admin
+        user:
+          client-key-data: $${base64encode(tls_private_key.cluster_admin_${index}.private_key_pem)}
+          client-certificate-data: $${base64encode(kubernetes_certificate_signing_request.cluster_admin_${index}.certificate)}
+    EOT
   }
 }
 
+resource "tls_private_key" "cluster_admin_${index}" {
+  algorithm = "RSA"
+}
+
+resource "tls_cert_request" "cluster_admin_${index}" {
+  key_algorithm = tls_private_key.cluster_admin_${index}.algorithm
+  private_key_pem = tls_private_key.cluster_admin_${index}.private_key_pem
+  subject {
+    common_name = "cluster-admin"
+    organization = "system:masters"
+  }
+}
+
+resource "kubernetes_certificate_signing_request" "cluster_admin_${index}" {
+  provider = kubernetes.cluster_${index}
+  metadata {
+    name = "cluster-admin"
+  }
+  spec {
+    usages = ["client auth"]
+    request = tls_cert_request.cluster_admin_${index}.cert_request_pem
+  }
+  auto_approve = true
+}
+
 %{ endfor ~}
 
 output "ip_addresses_of_nodes" {