Cluster Validation using Canonical K8s

[addyess]

Overview

• relate over the kube-control relation upgraded to v2 schema in order to communicate with the k8s control-plane

Details

• minor CI updates
• docs updates
• adjustments to use kube-control v2 relation schema

[mateoflorido]

If we get a CA certificate from the kube-control relation, we don’t need to write the CA cert from the TLS relation, right? However, I notice we are using CA_CERT_PATH to create the kubeconfig (L112,L115). Am I missing something here? Could you clarify if I’m misunderstanding this?

[addyess]

I hope I can. The CA cert CAN come from kube-control over the v2 schema. In v1 schema the CA cert won't be there. So, to maintain backwards API here the caller must provide a path where the CA certs will be if they aren't in the relation data.

Realistically:
kubernetes-control-plane doesn't provide the CA cert
k8s does provide the CA cert

when the ca cert is in the relation, this path CA_CERT_PATH is ignored.

[addyess]

details from the library:

    def create_kubeconfig(
        self, ca: PathLike, kubeconfig: PathLike, user: str, k8s_user: str
    ):
        ... Skipped ...
        if ca_content := self.get_ca_certificate():
            ca_b64 = base64.b64encode(ca_content).decode("utf-8")
        elif Path(ca).exists():
            ca_b64 = base64.b64encode(Path(ca).read_bytes()).decode("utf-8")
        else:
            log.error("No CA certificate found")
            raise FileNotFoundError("No CA certificate found")

[addyess]

@mateoflorido @HomayoonAlimohammadi anything else here?