Support cluster-external Kubernetes client. (#1159)

Detect whether in-cluster or cluster-external Kubernetes client should
be used based on the KUBERNETES_SERVICE_{HOST,PORT} environment
variables.

Adds bearer token and CA certificate file path parameters.

provider/k8s/client.go

@@ -1,6 +1,9 @@
 package k8s
 
 import (
+	"errors"
+	"fmt"
+	"io/ioutil"
 	"time"
 
 	"k8s.io/client-go/1.5/kubernetes"
@@ -39,32 +42,48 @@ type clientImpl struct {
 	clientset *kubernetes.Clientset
 }
 
-// NewInClusterClient returns a new Kubernetes client that expect to run inside the cluster
-func NewInClusterClient() (Client, error) {
+// NewInClusterClient returns a new Kubernetes client that is expected to run
+// inside the cluster.
+func NewInClusterClient(endpoint string) (Client, error) {
 	config, err := rest.InClusterConfig()
 	if err != nil {
-		return nil, err
-	}
-	clientset, err := kubernetes.NewForConfig(config)
-	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("failed to create in-cluster configuration: %s", err)
 	}
 
-	return &clientImpl{
-		clientset: clientset,
-	}, nil
+	if endpoint != "" {
+		config.Host = endpoint
+	}
+
+	return createClientFromConfig(config)
 }
 
-// NewInClusterClientWithEndpoint is the same as NewInClusterClient but uses the provided endpoint URL
-func NewInClusterClientWithEndpoint(endpoint string) (Client, error) {
-	config, err := rest.InClusterConfig()
-	if err != nil {
-		return nil, err
+// NewExternalClusterClient returns a new Kubernetes client that may run outside
+// of the cluster.
+// The endpoint parameter must not be empty.
+func NewExternalClusterClient(endpoint, token, caFilePath string) (Client, error) {
+	if endpoint == "" {
+		return nil, errors.New("endpoint missing for external cluster client")
 	}
 
-	config.Host = endpoint
+	config := &rest.Config{
+		Host:        endpoint,
+		BearerToken: token,
+	}
 
-	clientset, err := kubernetes.NewForConfig(config)
+	if caFilePath != "" {
+		caData, err := ioutil.ReadFile(caFilePath)
+		if err != nil {
+			return nil, fmt.Errorf("failed to read CA file %s: %s", caFilePath, err)
+		}
+
+		config.TLSClientConfig = rest.TLSClientConfig{CAData: caData}
+	}
+
+	return createClientFromConfig(config)
+}
+
+func createClientFromConfig(c *rest.Config) (Client, error) {
+	clientset, err := kubernetes.NewForConfig(c)
 	if err != nil {
 		return nil, err
 	}

provider/kubernetes.go

@@ -1,6 +1,8 @@
 package provider
 
 import (
+	"fmt"
+	"os"
 	"reflect"
 	"strconv"
 	"strings"
@@ -30,7 +32,9 @@ const (
 // Kubernetes holds configurations of the Kubernetes provider.
 type Kubernetes struct {
 	BaseProvider           `mapstructure:",squash"`
-	Endpoint               string         `description:"Kubernetes server endpoint"`
+	Endpoint               string         `description:"Kubernetes server endpoint (required for external cluster client)"`
+	Token                  string         `description:"Kubernetes bearer token (not needed for in-cluster client)"`
+	CertAuthFilePath       string         `description:"Kubernetes certificate authority file path (not needed for in-cluster client)"`
 	DisablePassHostHeaders bool           `description:"Kubernetes disable PassHost Headers"`
 	Namespaces             k8s.Namespaces `description:"Kubernetes namespaces"`
 	LabelSelector          string         `description:"Kubernetes api label selector to use"`
@@ -38,12 +42,18 @@ type Kubernetes struct {
 }
 
 func (provider *Kubernetes) newK8sClient() (k8s.Client, error) {
+	withEndpoint := ""
 	if provider.Endpoint != "" {
-		log.Infof("Creating in cluster Kubernetes client with endpoint %v", provider.Endpoint)
-		return k8s.NewInClusterClientWithEndpoint(provider.Endpoint)
+		withEndpoint = fmt.Sprintf(" with endpoint %v", provider.Endpoint)
 	}
-	log.Info("Creating in cluster Kubernetes client")
-	return k8s.NewInClusterClient()
+
+	if os.Getenv("KUBERNETES_SERVICE_HOST") != "" && os.Getenv("KUBERNETES_SERVICE_PORT") != "" {
+		log.Infof("Creating in-cluster Kubernetes client%s\n", withEndpoint)
+		return k8s.NewInClusterClient(provider.Endpoint)
+	}
+
+	log.Infof("Creating cluster-external Kubernetes client%s\n", withEndpoint)
+	return k8s.NewExternalClusterClient(provider.Endpoint, provider.Token, provider.CertAuthFilePath)
 }
 
 // Provide allows the provider to provide configurations to traefik