feat(auth): add GKE kubeconfig integration

cmd/gcp/gcp.go

@@ -0,0 +1,34 @@
+package gcp
+
+import (
+	"github.com/spf13/cobra"
+
+	"github.com/cloudposse/atmos/cmd/gcp/gke"
+	"github.com/cloudposse/atmos/cmd/internal"
+	"github.com/cloudposse/atmos/pkg/flags"
+	"github.com/cloudposse/atmos/pkg/flags/compat"
+)
+
+var gcpCmd = &cobra.Command{
+	Use:   "gcp",
+	Short: "Run GCP-specific commands for interacting with cloud resources",
+	Long:  "This command allows interaction with Google Cloud resources through native Atmos commands.",
+	Args:  cobra.NoArgs,
+}
+
+func init() {
+	gcpCmd.AddCommand(gke.GkeCmd)
+	internal.Register(&GCPCommandProvider{})
+}
+
+// GCPCommandProvider registers the gcp command.
+type GCPCommandProvider struct{}
+
+func (*GCPCommandProvider) GetCommand() *cobra.Command                                 { return gcpCmd }
+func (*GCPCommandProvider) GetName() string                                            { return "gcp" }
+func (*GCPCommandProvider) GetGroup() string                                           { return "Cloud Integration" }
+func (*GCPCommandProvider) GetAliases() []internal.CommandAlias                        { return nil }
+func (*GCPCommandProvider) GetFlagsBuilder() flags.Builder                             { return nil }
+func (*GCPCommandProvider) GetPositionalArgsBuilder() *flags.PositionalArgsBuilder     { return nil }
+func (*GCPCommandProvider) GetCompatibilityFlags() map[string]compat.CompatibilityFlag { return nil }
+func (*GCPCommandProvider) IsExperimental() bool                                       { return false }

cmd/gcp/gcp_test.go

@@ -0,0 +1,32 @@
+package gcp
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGCPCommandProvider(t *testing.T) {
+	provider := &GCPCommandProvider{}
+	assert.Equal(t, "gcp", provider.GetName())
+	assert.Equal(t, "Cloud Integration", provider.GetGroup())
+	assert.False(t, provider.IsExperimental())
+	assert.Nil(t, provider.GetAliases())
+	assert.Nil(t, provider.GetFlagsBuilder())
+	assert.Nil(t, provider.GetPositionalArgsBuilder())
+	assert.Nil(t, provider.GetCompatibilityFlags())
+	assert.Same(t, gcpCmd, provider.GetCommand())
+}
+
+func TestGCPCommandHierarchyAndHelp(t *testing.T) {
+	assert.Equal(t, "gcp", gcpCmd.Use)
+	assert.Contains(t, gcpCmd.Short, "GCP-specific")
+	gkeCmd, _, err := gcpCmd.Find([]string{"gke"})
+	require.NoError(t, err)
+	assert.Equal(t, "gke", gkeCmd.Name())
+	token, _, err := gcpCmd.Find([]string{"gke", "token"})
+	require.NoError(t, err)
+	assert.Equal(t, "token", token.Name())
+	assert.Contains(t, token.Long, "ExecCredential")
+}

cmd/gcp/gke/gke.go

@@ -0,0 +1,11 @@
+package gke
+
+import "github.com/spf13/cobra"
+
+// GkeCmd executes gcp gke commands.
+var GkeCmd = &cobra.Command{
+	Use:   "gke",
+	Short: "Manage GKE authentication",
+	Long:  "Generate short-lived Google Cloud credentials for GKE through Atmos Auth.",
+	Args:  cobra.NoArgs,
+}

cmd/gcp/gke/token.go

@@ -0,0 +1,141 @@
+package gke
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/spf13/cobra"
+
+	errUtils "github.com/cloudposse/atmos/errors"
+	"github.com/cloudposse/atmos/pkg/auth"
+	gcpCloud "github.com/cloudposse/atmos/pkg/auth/cloud/gcp"
+	"github.com/cloudposse/atmos/pkg/auth/credentials"
+	"github.com/cloudposse/atmos/pkg/auth/types"
+	"github.com/cloudposse/atmos/pkg/auth/validation"
+	cfg "github.com/cloudposse/atmos/pkg/config"
+	"github.com/cloudposse/atmos/pkg/data"
+	"github.com/cloudposse/atmos/pkg/perf"
+	"github.com/cloudposse/atmos/pkg/schema"
+)
+
+const execCredentialAPIVersion = "client.authentication.k8s.io/v1beta1"
+
+var (
+	initCliConfigFn        = cfg.InitCliConfig
+	authenticateForTokenFn = authenticateForToken
+	getGKETokenFn          = gcpCloud.GetToken
+	newAuthManagerFn       = auth.NewAuthManager
+)
+
+var tokenCmd = &cobra.Command{
+	Use:          "token",
+	Short:        "Generate a GKE bearer token for kubectl",
+	Long:         "Generate a Kubernetes ExecCredential from an Atmos-managed GCP identity. This command is normally invoked by kubectl from an Atmos-generated kubeconfig.",
+	Args:         cobra.NoArgs,
+	RunE:         executeTokenCommand,
+	SilenceUsage: true,
+}
+
+type execCredential struct {
+	APIVersion string               `json:"apiVersion"`
+	Kind       string               `json:"kind"`
+	Status     execCredentialStatus `json:"status"`
+}
+
+type execCredentialStatus struct {
+	ExpirationTimestamp string `json:"expirationTimestamp,omitempty"`
+	Token               string `json:"token"`
+}
+
+func executeTokenCommand(cmd *cobra.Command, _ []string) error {
+	atmosConfig, err := initCliConfigFn(schema.ConfigAndStacksInfo{}, false)
+	if err != nil {
+		return fmt.Errorf(errUtils.ErrWrapFormat, errUtils.ErrFailedToInitConfig, err)
+	}
+	defer perf.Track(&atmosConfig, "gke.executeTokenCommand")()
+
+	identityName := resolveIdentity(cmd)
+	ctx := auth.ContextWithSkipIntegrations(context.Background())
+	creds, err := authenticateForTokenFn(ctx, &atmosConfig.Auth, atmosConfig.CliConfigPath, identityName)
+	if err != nil {
+		return fmt.Errorf("%w: %w", errUtils.ErrGKETokenGeneration, err)
+	}
+	token, expiresAt, err := getGKETokenFn(creds)
+	if err != nil {
+		return fmt.Errorf("%w: %w", errUtils.ErrGKETokenGeneration, err)
+	}
+	return writeExecCredential(token, expiresAt)
+}
+
+func writeExecCredential(token string, expiresAt time.Time) error {
+	status := execCredentialStatus{Token: token}
+	if !expiresAt.IsZero() {
+		status.ExpirationTimestamp = expiresAt.UTC().Format(time.RFC3339)
+	}
+	payload, err := json.Marshal(execCredential{
+		APIVersion: execCredentialAPIVersion,
+		Kind:       "ExecCredential",
+		Status:     status,
+	})
+	if err != nil {
+		return fmt.Errorf("%w: failed to marshal ExecCredential: %w", errUtils.ErrGKETokenGeneration, err)
+	}
+	return data.Write(string(payload))
+}
+
+func resolveIdentity(cmd *cobra.Command) string {
+	identityName, _ := cmd.Flags().GetString("identity")
+	if identityName != "" {
+		return identityName
+	}
+	return os.Getenv("ATMOS_IDENTITY") //nolint:forbidigo // Exec plugins inherit this explicit identity selector.
+}
+
+func authenticateForToken(ctx context.Context, authConfig *schema.AuthConfig, cliConfigPath, identityName string) (types.ICredentials, error) {
+	authStackInfo := &schema.ConfigAndStacksInfo{AuthContext: &schema.AuthContext{}}
+	mgr, err := newAuthManagerFn(
+		authConfig,
+		credentials.NewCredentialStoreWithConfig(authConfig),
+		validation.NewValidator(),
+		authStackInfo,
+		cliConfigPath,
+	)
+	if err != nil {
+		return nil, fmt.Errorf(errUtils.ErrWrapFormat, errUtils.ErrFailedToInitializeAuthManager, err)
+	}
+	if identityName == "" {
+		identityName = resolveDefaultIdentity(authConfig)
+		if identityName == "" {
+			return nil, fmt.Errorf("%w: no identity specified and no default identity found", errUtils.ErrGKETokenGeneration)
+		}
+	}
+	whoami, err := mgr.Authenticate(ctx, identityName)
+	if err != nil {
+		return nil, fmt.Errorf(errUtils.ErrWrapWithNameAndCauseFormat, errUtils.ErrIdentityAuthFailed, identityName, err)
+	}
+	if whoami.Credentials == nil {
+		return nil, fmt.Errorf(errUtils.ErrWrapWithNameAndCauseFormat, errUtils.ErrIdentityAuthFailed, identityName, errUtils.ErrIdentityCredentialsNone)
+	}
+	if _, ok := whoami.Credentials.(*types.GCPCredentials); !ok {
+		return nil, fmt.Errorf("%w: identity %q returned non-GCP credentials", errUtils.ErrGKETokenGeneration, identityName)
+	}
+	return whoami.Credentials, nil
+}
+
+func resolveDefaultIdentity(authConfig *schema.AuthConfig) string {
+	if authConfig == nil || len(authConfig.Identities) != 1 {
+		return ""
+	}
+	for name := range authConfig.Identities {
+		return name
+	}
+	return ""
+}
+
+func init() {
+	tokenCmd.Flags().StringP("identity", "i", "", "Atmos GCP identity to authenticate with")
+	GkeCmd.AddCommand(tokenCmd)
+}