https://github.com/ryodocx/kube-credential-cache
Accelerator cache for kubernetes access
https://github.com/ryodocx/kube-credential-cache
cache go kubectl kubernetes
Last synced: 6 months ago
JSON representation
Accelerator cache for kubernetes access
- Host: GitHub
- URL: https://github.com/ryodocx/kube-credential-cache
- Owner: ryodocx
- License: mit
- Created: 2022-08-11T02:18:28.000Z (almost 4 years ago)
- Default Branch: main
- Last Pushed: 2024-06-12T20:29:24.000Z (about 2 years ago)
- Last Synced: 2024-06-21T18:11:43.465Z (about 2 years ago)
- Topics: cache, go, kubectl, kubernetes
- Language: Go
- Homepage:
- Size: 428 KB
- Stars: 12
- Watchers: 1
- Forks: 0
- Open Issues: 3
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# kcc: kube-credential-cache
[](https://github.com/ryodocx/kube-credential-cache/actions/workflows/golangci-lint.yaml)
[](https://github.com/ryodocx/kube-credential-cache/actions/workflows/codeql-analysis.yml)
[](https://github.com/ryodocx/kube-credential-cache/actions/workflows/asdf-test.yml)
[](https://github.com/ryodocx/kube-credential-cache/actions/workflows/goreleaser.yaml)
[](https://goreportcard.com/report/github.com/ryodocx/kube-credential-cache)
Fast access to Kubernetes!
Especially effective with kubectl + EKS, about 3~4x faster!
```sh
# first time access
$ time kubectl version &>/dev/null
kubectl version &> /dev/null 0.42s user 0.10s system 59% cpu 0.868 total
# cache effective
$ time kubectl version &>/dev/null
kubectl version &> /dev/null 0.05s user 0.02s system 24% cpu 0.308 total
```
## Architecture
[](./docs)
details is [here](./docs) (includes sequence diagram)
## Features
Work as caching proxy of [ExecCredential](https://kubernetes.io/docs/reference/config-api/client-authentication.v1/#client-authentication-k8s-io-v1-ExecCredential) object, when use [credential plugins](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins) of Kubernetes. (e.g. kubectl)
- kcc-cache
- [x] Cache [ExecCredential](https://kubernetes.io/docs/reference/config-api/client-authentication.v1/#client-authentication-k8s-io-v1-ExecCredential) object
- [x] Concern Command, Args, Env as cache-key
- [ ] Cache file encryption
- [ ] kubeconfig automated maintenance
- kcc-injector
- [x] kubeconfig optimize (inject kcc-cache command automatically)
- [x] kubeconfig recovery (remove injected commands)
## Effects
A one of notable effect is, when used [`aws eks update-kubeconfig`](https://docs.aws.amazon.com/eks/latest/userguide/create-kubeconfig.html) to access EKS. about 500ms(about 3~4x) faster!
benchmark is [here](./benchmark/)
## Installation
```sh
# go install
go install github.com/ryodocx/kube-credential-cache/cmd/kcc-cache@latest
go install github.com/ryodocx/kube-credential-cache/cmd/kcc-injector@latest
# asdf-vm: https://asdf-vm.com
asdf plugin add kube-credential-cache
# aqua: https://aquaproj.github.io
aqua g -i ryodocx/kube-credential-cache
```
or download from [releases](https://github.com/ryodocx/kube-credential-cache/releases)
## Usage(edit kubeconfig)
:running: install & just run `kcc-injector -i ~/.kube/config`
:ambulance: restore kubeconfig: `kcc-injector -i -r `
manual setup
if manually edit kubeconfig,
* set `kcc-cache` to command
* original command move to args
* :warning: **Do not use the same pattern for command, args and env**
* :warning:U sing the same pattern presents the risk of mixing up credentials
* :warning: env is ignored if not in `KUBE_CREDENTIAL_CACHE_CACHEKEY_ENV_LIST`
* if use `kcc-injector`, generate unique env `KUBE_CREDENTIAL_CACHE_USER` from user's name
EKS (same effect as `kcc-injector -i `)
```diff
kind: Config
apiVersion: v1
clusters: [...]
contexts: [...]
current-context:
preferences: {}
users:
- name: user-name
user:
exec:
apiVersion: client.authentication.k8s.io/v1beta1
- command: aws
+ command: kcc-cache
args:
+ - aws
- --region
-
- eks
- get-token
- --cluster-name
-
env:
- name: AWS_PROFILE
value:
```
EKS with [aws-vault](https://github.com/99designs/aws-vault)
```diff
kind: Config
apiVersion: v1
clusters: [...]
contexts: [...]
current-context:
preferences: {}
users:
- name: user-name
user:
exec:
apiVersion: client.authentication.k8s.io/v1beta1
- command: aws
+ command: kcc-cache
args:
+ - aws-vault
+ - exec
+ -
+ - --
+ - aws
- --region
-
- eks
- get-token
- --cluster-name
-
- env:
- - name: AWS_PROFILE
- value:
```
kubeconfig specification
* https://kubernetes.io/docs/tasks/access-application-cluster/configure-access-multiple-clusters/
* https://pkg.go.dev/k8s.io/client-go/tools/clientcmd/api/v1#Config
## Troubleshooting
###### `error: You must be logged in to the server (the server has asked for the client to provide credentials)` at kubectl
Incorrect credentials may be cached.
For example, occur when using the wrong pair of aws-vault context and kubecontext.
The root cause is aws command return invalid credential without error.
**Try remove cache file!** In macOS: `rm ~/Library/Caches/kube-credential-cache/cache.json`
※see below `kcc-cache` configuration for other environment
###### `...Corruption detected, recreate cache file`
Detected broken cachefile.
The cause is unknown. However, we ignore error by recreating the cache currently.
## Configration
### kcc-cache
| Environment variable | default | description |
|-----------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------|
| KUBE_CREDENTIAL_CACHE_FILE | macOS:`~/Library/Caches/kube-credential-cache/cache.json`Linux:`$XDG_CACHE_HOME/kube-credential-cache/cache.json``~/.cache/kube-credential-cache/cache.json`Windows:`%AppData%\kube-credential-cache\cache.json` | path of Cache file |
| KUBE_CREDENTIAL_CACHE_REFRESH_MARGIN | `30s` | margin of credential refresh |
| KUBE_CREDENTIAL_CACHE_CACHEKEY_ENV_LIST | `KUBE_CREDENTIAL_CACHE_USER,AWS_PROFILE,AWS_REGION,AWS_VAULT` | comma separated env names for additional cache-key |
### kcc-injector
```sh
$ kcc-injector -h
Usage: kcc-injector [flags]
-c string
injection command (default "kcc-cache")
-i edit file in-place
-r restore kubeconfig to original
```