feat: shoot admin kubeconfig

README.md

@@ -14,9 +14,9 @@ This repository contains shared roles, modules and plugins for metal-stack.
 
 ## Modules
 
-| Module Name                               | Description                                                  | Requirements      |
-| ----------------------------------------- | ------------------------------------------------------------ | ----------------- |
-| [setup_yaml](library/setup_yaml.py)       | Setup plugin that resolves variables from a remote YAML file |                   |
+| Module Name                         | Description                                                  | Requirements |
+| ----------------------------------- | ------------------------------------------------------------ | ------------ |
+| [setup_yaml](library/setup_yaml.py) | Setup plugin that resolves variables from a remote YAML file |              |
 
 ## Roles
 
@@ -38,6 +38,7 @@ This repository contains shared roles, modules and plugins for metal-stack.
 | humanfriendly             | [humanfriendly](https://github.com/xolox/python-humanfriendly)             | Converts sizes into human-friendly formats                            |
 | transpile_ignition_config | [ct](https://github.com/coreos/container-linux-config-transpiler/releases) | Transforming a human-friendly Container Linux Config into a JSON file |
 | metal_lb_config           |                                                                            | Generates the config map for metal-lb                                 |
+| shoot_admin_kubeconfig    |                                                                            | Generates a kubeconfig for a namespace and shoot name.                |
 
 ## Usage
 

filter_plugins/gardener.py

@@ -0,0 +1,43 @@
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
+import base64
+import yaml
+import json
+
+from kubernetes import config, client
+
+
+def shoot_admin_kubeconfig(kubeconfig, project_namespace, shoot_name, expiry_seconds=28800):
+    data = yaml.safe_load(kubeconfig)
+
+    configuration = client.Configuration()
+    config.load_kube_config_from_dict(data, client_configuration=configuration)
+
+    api = client.ApiClient(configuration=configuration)
+
+    kubeconfig_request = {
+        'apiVersion': 'authentication.gardener.cloud/v1alpha1',
+        'kind': 'AdminKubeconfigRequest',
+        'spec': {
+        'expirationSeconds': expiry_seconds
+        }
+    }
+
+    response = api.call_api(resource_path=f'/apis/core.gardener.cloud/v1beta1/namespaces/{project_namespace}/shoots/{shoot_name}/adminkubeconfig',
+                            method='POST',
+                            body=kubeconfig_request,
+                            auth_settings=['BearerToken'],
+                            _preload_content=False,
+                            _return_http_data_only=True,
+                        )
+
+    return base64.b64decode(json.loads(response.data)["status"]["kubeconfig"]).decode('utf-8')
+
+
+class FilterModule(object):
+    def filters(self):
+        return {
+            'shoot_admin_kubeconfig': shoot_admin_kubeconfig,
+        }