in pkg/internal/converter/convert.go [200:460]
func Convert(o Options, pathOptions *clientcmd.PathOptions) error {
clientConfig := o.configFlags.ToRawKubeConfigLoader()
var kubeconfigs []string
klog.V(5).Info(o.ToString())
if clientConfig.ConfigAccess() != nil {
if clientConfig.ConfigAccess().GetExplicitFile() != "" {
kubeconfigs = append(kubeconfigs, clientConfig.ConfigAccess().GetExplicitFile())
} else {
kubeconfigs = append(kubeconfigs, clientConfig.ConfigAccess().GetLoadingPrecedence()...)
}
}
klog.V(5).Infof("Loading kubeconfig from %s", strings.Join(kubeconfigs, ":"))
config, err := clientConfig.RawConfig()
if err != nil {
return fmt.Errorf("unable to load kubeconfig: %s", err)
}
targetAuthInfo := ""
if o.context != "" {
if config.Contexts[o.context] == nil {
return fmt.Errorf("no context exists with the name: %q", o.context)
}
targetAuthInfo = config.Contexts[o.context].AuthInfo
}
for name, authInfo := range config.AuthInfos {
if targetAuthInfo != "" && name != targetAuthInfo {
continue
}
klog.V(5).Infof("context: %q", name)
// is it legacy aad auth or is it exec using kubelogin?
if !isExecUsingkubelogin(authInfo) && !isLegacyAzureAuth(authInfo) {
continue
}
klog.V(5).Info("converting...")
argServerIDVal,
argClientIDVal,
argEnvironmentVal,
argTenantIDVal,
argAuthRecordCacheDirVal,
argPoPTokenClaimsVal,
argRedirectURLVal,
isLegacyConfigMode,
isPoPTokenEnabled := getArgValues(o, authInfo)
exec := &api.ExecConfig{
Command: execName,
Args: []string{
getTokenCommand,
},
APIVersion: execAPIVersion,
InstallHint: execInstallHint,
}
// Preserve any existing install hint
if authInfo.Exec != nil && authInfo.Exec.InstallHint != "" {
exec.InstallHint = authInfo.Exec.InstallHint
}
exec.Args = append(exec.Args, argLoginMethod, o.TokenOptions.LoginMethod)
// all login methods require --server-id specified
if argServerIDVal == "" {
return fmt.Errorf("%s is required", argServerID)
}
exec.Args = append(exec.Args, argServerID, argServerIDVal)
if argAuthRecordCacheDirVal != "" {
exec.Args = append(exec.Args, argAuthRecordCacheDir, argAuthRecordCacheDirVal)
}
switch o.TokenOptions.LoginMethod {
case token.AzureDeveloperCLILogin:
if o.isSet(flagTenantID) {
exec.Args = append(exec.Args, argTenantID, o.TokenOptions.TenantID)
}
case token.AzureCLILogin:
if o.azureConfigDir != "" {
exec.Env = append(exec.Env, api.ExecEnvVar{Name: azureConfigDir, Value: o.azureConfigDir})
}
// when convert to azurecli login, tenantID from the input kubeconfig will be disregarded and
// will have to come from explicit flag `--tenant-id`.
// this is because azure cli logged in using MSI does not allow specifying tenant ID
// see https://github.com/Azure/kubelogin/issues/123#issuecomment-1209652342
if o.isSet(flagTenantID) {
exec.Args = append(exec.Args, argTenantID, o.TokenOptions.TenantID)
}
case token.DeviceCodeLogin:
if argClientIDVal == "" {
return fmt.Errorf("%s is required", argClientID)
}
exec.Args = append(exec.Args, argClientID, argClientIDVal)
if argTenantIDVal == "" {
return fmt.Errorf("%s is required", argTenantID)
}
exec.Args = append(exec.Args, argTenantID, argTenantIDVal)
if argEnvironmentVal != "" {
// environment is optional
exec.Args = append(exec.Args, argEnvironment, argEnvironmentVal)
}
if isLegacyConfigMode {
exec.Args = append(exec.Args, argIsLegacy)
}
case token.InteractiveLogin:
if argClientIDVal == "" {
return fmt.Errorf("%s is required", argClientID)
}
exec.Args = append(exec.Args, argClientID, argClientIDVal)
if argTenantIDVal == "" {
return fmt.Errorf("%s is required", argTenantID)
}
exec.Args = append(exec.Args, argTenantID, argTenantIDVal)
if argEnvironmentVal != "" {
// environment is optional
exec.Args = append(exec.Args, argEnvironment, argEnvironmentVal)
}
// PoP token flags are optional but must be provided together
exec.Args, err = validatePoPClaims(exec.Args, isPoPTokenEnabled, argPoPTokenClaims, argPoPTokenClaimsVal)
if err != nil {
return err
}
if argRedirectURLVal != "" {
exec.Args = append(exec.Args, argRedirectURL, argRedirectURLVal)
}
case token.ServicePrincipalLogin:
if argClientIDVal == "" {
return fmt.Errorf("%s is required", argClientID)
}
exec.Args = append(exec.Args, argClientID, argClientIDVal)
if argTenantIDVal == "" {
return fmt.Errorf("%s is required", argTenantID)
}
exec.Args = append(exec.Args, argTenantID, argTenantIDVal)
if argEnvironmentVal != "" {
// environment is optional
exec.Args = append(exec.Args, argEnvironment, argEnvironmentVal)
}
if o.isSet(flagClientSecret) {
exec.Args = append(exec.Args, argClientSecret, o.TokenOptions.ClientSecret)
}
if o.isSet(flagClientCert) {
exec.Args = append(exec.Args, argClientCert, o.TokenOptions.ClientCert)
}
if o.isSet(flagClientCertPassword) {
exec.Args = append(exec.Args, argClientCertPassword, o.TokenOptions.ClientCertPassword)
}
if isLegacyConfigMode {
exec.Args = append(exec.Args, argIsLegacy)
}
// PoP token flags are optional but must be provided together
exec.Args, err = validatePoPClaims(exec.Args, isPoPTokenEnabled, argPoPTokenClaims, argPoPTokenClaimsVal)
if err != nil {
return err
}
if o.isSet(flagDisableEnvironmentOverride) {
exec.Args = append(exec.Args, argDisableEnvironmentOverride)
}
case token.MSILogin:
if o.isSet(flagClientID) {
exec.Args = append(exec.Args, argClientID, o.TokenOptions.ClientID)
} else if o.isSet(flagIdentityResourceID) {
exec.Args = append(exec.Args, argIdentityResourceID, o.TokenOptions.IdentityResourceID)
}
case token.ROPCLogin:
if argClientIDVal == "" {
return fmt.Errorf("%s is required", argClientID)
}
exec.Args = append(exec.Args, argClientID, argClientIDVal)
if argTenantIDVal == "" {
return fmt.Errorf("%s is required", argTenantID)
}
exec.Args = append(exec.Args, argTenantID, argTenantIDVal)
if argEnvironmentVal != "" {
// environment is optional
exec.Args = append(exec.Args, argEnvironment, argEnvironmentVal)
}
if o.isSet(flagUsername) {
exec.Args = append(exec.Args, argUsername, o.TokenOptions.Username)
}
if o.isSet(flagPassword) {
exec.Args = append(exec.Args, argPassword, o.TokenOptions.Password)
}
if isLegacyConfigMode {
exec.Args = append(exec.Args, argIsLegacy)
}
case token.WorkloadIdentityLogin:
if o.isSet(flagClientID) {
exec.Args = append(exec.Args, argClientID, o.TokenOptions.ClientID)
}
if o.isSet(flagTenantID) {
exec.Args = append(exec.Args, argTenantID, o.TokenOptions.TenantID)
}
if o.isSet(flagAuthorityHost) {
exec.Args = append(exec.Args, argAuthorityHost, o.TokenOptions.AuthorityHost)
}
if o.isSet(flagFederatedTokenFile) {
exec.Args = append(exec.Args, argFederatedTokenFile, o.TokenOptions.FederatedTokenFile)
}
}
authInfo.Exec = exec
authInfo.AuthProvider = nil
}
err = clientcmd.ModifyConfig(pathOptions, config, true)
return err
}