This is a Kubernetes controller intended to be used within an OpenShift cluster that adds additional functionality to the oc
command to install and manage additional CLI plugins via krew
in a disconnected environment.
This project is currently under development, however, comments and feedback are always welcome!
In disconnected environments, it is more difficult to install and manage CLI plugins. The existing mechanism within OpenShift for providing additional CLI tools (i.e. ConsoleCLIDownload
) provides a local copy of oc
, but for other tools it provides internet-facing links that are unreachable in disconnected environments.
This controller leverages images and registries for providing krew
plugins. This works by including any plugins desired into an image that is reachable from the cluster. This controller will pull this image, and extract the desired plugin from the image's filesystem. Cluster administrators define Plugin
custom resources which describe the plugin, the image:tag, and the paths within the image to extract. Users can then download plugins via this controller's REST API or using Git's HTTP protocol (i.e krew
). Consuming this API is made more convenient with krew
integration into oc
.
By default, this controller will watch Plugin
resources in all namespaces. To restrict watching to a single namespace, set the WATCH_NAMESPACE
environment variable.
The spec has the following fields:
shortDescription
: Short, user-friendly description of the plugindescription
: Long, user-friendly description of the plugincaveats
: Known caveats of using the pluginhomepage
: The homepage of the pluginversion
: The version of this pluginplatforms
: List of binaries available for this plugins based on platform each binary is compiled forplatform
: Operating system and CPU architecture for binary, in formatos/arch
(i.e.linux/amd64
)image
: Image name with tag to pullimagePullSecret
: If authentication to the image registry is required, provide the name of thedockercfg
Secret where the authentication information can be foundfiles
: List of files to pull from the image using absolute paths and where they should be installed relative to the installation's root directoryfrom
: Absolute path to a file, directories and wildcards are not yet supportedto
: Relative path to install the file, or.
for installation root directory
bin
: Name of the binary to execute
Example:
apiVersion: config.openshift.io/v1alpha1
kind: Plugin
metadata:
name: bash
spec:
shortDescription: just a test
description: just a test
version: v4.4.20
platforms:
- platform: linux/amd64
image: redhat/ubi8-micro:latest
files:
- from: /usr/bin/bash
to: "."
bin: bash
In order to configure CLI Manager;
- oc (or kubectl) is installed
- Krew is installed. More details can be found https://krew.sigs.k8s.io/docs/user-guide/setup/install/
- Custom index provided by OpenShift CLI Manager is defined in Krew;
$ ROUTE=$(oc get route/openshift-cli-manager -n openshift-cli-manager-operator -o=jsonpath='{.spec.host}')
$ CUSTOM_INDEX_NAME=ocp
$ oc krew index add $CUSTOM_INDEX_NAME https://$ROUTE/cli-manager
To search, install or remove a plugin;
$ oc krew search test
$ oc krew install $CUSTOM_INDEX_NAME/test
$ oc krew remove test
To update to the latest version of plugin;
$ oc krew update
The most common are:
darwin/amd64
(i.e. MacOS)linux/amd64
windows/amd64
A complete list of all supported platforms (i.e operating systems and architectures) can be found here: https://github.com/golang/go/blob/master/src/go/build/syslist.go
Download a plugin as a tar.gz archive.
The following query parameters are required:
name
: Name of the Plugin resourceplatform
: Platform for the binary
Example:
GET /v1/plugins/download/?name=bash&platform=linux/amd64
A successful response will contain the tar.gz archive of the plugin's files for the requested platform.
OpenShift serves endpoints with the CA bundles that is self-signed within the cluster. Certificate authority field in kubeconfig is used to interact with these components. However, Krew does not provide a similar functionality to pass self-signed CA certificates explicitly as trusted to tackle unknown certificate errors. As a result, it is up to user to define these self-signed certificates as trusted in their local environments.
$ echo "$(oc config view --minify --flatten -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' | base64 --decode)" | sudo tee /etc/pki/ca-trust/source/anchors/cli.crt > /dev/null
$ sudo update-ca-trust