spinifex/cmd/eks-gateway-fetch/main.go

// eks-gateway-fetch runs inside the EKS K3s control-plane VM and fetches a
// control-plane resource from the host through the AWS gateway, instead of
// dialing core NATS directly. It is the read-side companion to
// eks-gateway-publish.
//
// It SigV4-signs (service "eks") an HTTPS GET to the gateway, retrying with
// backoff until the gateway returns 2xx or the attempt budget is exhausted (so
// a degraded link surfaces as a non-zero exit), then emits the staged add-ons
// as tab-separated lines the on-VM addon-sync shell agent consumes without a
// JSON parser:
//
//	<addonName>\t<addonVersion>\t<serviceAccountRoleArn>\t<base64(configurationValues)>
//
// The configuration values are base64-encoded so embedded tabs/newlines cannot
// break the line framing.
//
// Usage:
//
//	eks-gateway-fetch -resource addons   # GET /clusters/{cluster}/internal-addons/{accountId}
//
// Flags default to environment variables seeded by cloud-init:
// EKS_GATEWAY_URL, EKS_GATEWAY_CA, EKS_ACCESS_KEY, EKS_SECRET_KEY, EKS_REGION,
// EKS_ACCOUNT_ID, EKS_CLUSTER_NAME.
package main

import (
	"bufio"
	"encoding/base64"
	"encoding/json"
	"flag"
	"fmt"
	"io"
	"log/slog"
	"os"
	"time"

	"github.com/mulgadc/spinifex/internal/eksgw"

	_ "github.com/mulgadc/spinifex/internal/fipsboot"
)

// stagedAddon mirrors the gateway's StagedAddonManifest wire shape; duplicated
// here to keep this tiny VM binary free of the handler package's dependency
// graph.
type stagedAddon struct {
	AddonName             string `json:"addonName"`
	AddonVersion          string `json:"addonVersion"`
	ServiceAccountRoleArn string `json:"serviceAccountRoleArn"`
	ConfigurationValues   string `json:"configurationValues"`
}

type internalAddonsResponse struct {
	Addons []stagedAddon `json:"addons"`
}

const (
	maxAttempts = 30
	retryDelay  = 5 * time.Second
)

func main() {
	var (
		gatewayURL  string
		gatewayCA   string
		accessKey   string
		secretKey   string
		region      string
		accountID   string
		clusterName string
		resource    string
	)

	flag.StringVar(&gatewayURL, "gateway", os.Getenv("EKS_GATEWAY_URL"), "Gateway URL (e.g. https://10.15.8.1:9999)")
	flag.StringVar(&gatewayCA, "gateway-ca", os.Getenv("EKS_GATEWAY_CA"), "Path to gateway TLS CA PEM (optional; falls back to system trust)")
	flag.StringVar(&accessKey, "access-key", os.Getenv("EKS_ACCESS_KEY"), "AWS access key ID")
	flag.StringVar(&secretKey, "secret-key", os.Getenv("EKS_SECRET_KEY"), "AWS secret access key")
	flag.StringVar(&region, "region", os.Getenv("EKS_REGION"), "AWS region for SigV4 signing")
	flag.StringVar(&accountID, "account-id", os.Getenv("EKS_ACCOUNT_ID"), "Cluster account ID")
	flag.StringVar(&clusterName, "cluster", os.Getenv("EKS_CLUSTER_NAME"), "Cluster name")
	flag.StringVar(&resource, "resource", "addons", "Resource to fetch: addons")
	flag.Parse()

	switch {
	case accountID == "":
		fatal("--account-id is required (or set EKS_ACCOUNT_ID)")
	case clusterName == "":
		fatal("--cluster is required (or set EKS_CLUSTER_NAME)")
	case resource != "addons":
		fatal("--resource must be addons")
	}

	client, err := eksgw.New(gatewayURL, gatewayCA, accessKey, secretKey, region)
	if err != nil {
		fatal(fmt.Sprintf("build gateway client: %v", err))
	}
	path := "/clusters/" + clusterName + "/internal-addons/" + accountID

	var lastErr error
	for attempt := 1; attempt <= maxAttempts; attempt++ {
		body, err := client.Get(path)
		if err != nil {
			lastErr = err
			slog.Warn("eks-gateway-fetch: attempt failed", "resource", resource, "attempt", attempt, "err", err)
			if attempt < maxAttempts {
				time.Sleep(retryDelay)
			}
			continue
		}
		if werr := emitAddonsTSV(os.Stdout, body); werr != nil {
			fatal(fmt.Sprintf("render response: %v", werr))
		}
		return
	}
	fatal(fmt.Sprintf("fetch failed after %d attempts: %v", maxAttempts, lastErr))
}

// emitAddonsTSV decodes the internal-addons response and writes one TSV line per
// staged add-on to w. An empty add-on set writes nothing (the agent then GCs
// every locally-rendered manifest), which is the correct steady state for a
// cluster with no managed add-ons.
func emitAddonsTSV(out io.Writer, body []byte) error {
	var resp internalAddonsResponse
	if err := json.Unmarshal(body, &resp); err != nil {
		return fmt.Errorf("unmarshal internal-addons response: %w", err)
	}
	w := bufio.NewWriter(out)
	for _, a := range resp.Addons {
		cfg := base64.StdEncoding.EncodeToString([]byte(a.ConfigurationValues))
		if _, err := fmt.Fprintf(w, "%s\t%s\t%s\t%s\n", a.AddonName, a.AddonVersion, a.ServiceAccountRoleArn, cfg); err != nil {
			return err
		}
	}
	return w.Flush()
}

func fatal(msg string) {
	slog.Error("eks-gateway-fetch: " + msg)
	os.Exit(1)
}