Merge pull request #49419 from fabriziopandini/kubeadm-phase-kubeconfig2

cmd/kubeadm/BUILD

@@ -41,7 +41,7 @@ filegroup(
     srcs = [
         ":package-srcs",
         "//cmd/kubeadm/app:all-srcs",
-        "//cmd/kubeadm/test/cmd:all-srcs",
+        "//cmd/kubeadm/test:all-srcs",
     ],
     tags = ["automanaged"],
 )

cmd/kubeadm/app/apis/kubeadm/types.go

@@ -17,6 +17,7 @@ limitations under the License.
 package kubeadm
 
 import (
+	"fmt"
 	"time"
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -105,3 +106,7 @@ type NodeConfiguration struct {
 	TLSBootstrapToken        string
 	Token                    string
 }
+
+func (cfg *MasterConfiguration) GetMasterEndpoint() string {
+	return fmt.Sprintf("https://%s:%d", cfg.API.AdvertiseAddress, cfg.API.BindPort)
+}

cmd/kubeadm/app/cmd/init.go

@@ -231,9 +231,7 @@ func (i *Init) Run(out io.Writer) error {
 	}
 
 	// PHASE 2: Generate kubeconfig files for the admin and the kubelet
-
-	masterEndpoint := fmt.Sprintf("https://%s:%d", i.cfg.API.AdvertiseAddress, i.cfg.API.BindPort)
-	err = kubeconfigphase.CreateInitKubeConfigFiles(masterEndpoint, i.cfg.CertificatesDir, kubeadmconstants.KubernetesDir, i.cfg.NodeName)
+	err = kubeconfigphase.CreateInitKubeConfigFiles(kubeadmconstants.KubernetesDir, i.cfg)
 	if err != nil {
 		return err
 	}

cmd/kubeadm/app/cmd/phases/BUILD

@@ -40,15 +40,22 @@ go_library(
 
 go_test(
     name = "go_default_test",
-    srcs = ["certs_test.go"],
+    srcs = [
+        "certs_test.go",
+        "kubeconfig_test.go",
+    ],
     library = ":go_default_library",
     tags = ["automanaged"],
     deps = [
+        "//cmd/kubeadm/app/apis/kubeadm:go_default_library",
         "//cmd/kubeadm/app/apis/kubeadm/install:go_default_library",
         "//cmd/kubeadm/app/constants:go_default_library",
         "//cmd/kubeadm/app/phases/certs/pkiutil:go_default_library",
-        "//vendor/github.com/renstrom/dedent:go_default_library",
-        "//vendor/github.com/spf13/cobra:go_default_library",
+        "//cmd/kubeadm/test:go_default_library",
+        "//cmd/kubeadm/test/cmd:go_default_library",
+        "//cmd/kubeadm/test/kubeconfig:go_default_library",
+        "//pkg/util/node:go_default_library",
+        "//vendor/k8s.io/client-go/tools/clientcmd:go_default_library",
     ],
 )
 

cmd/kubeadm/app/cmd/phases/certs.go

@@ -34,6 +34,7 @@ import (
 	"k8s.io/kubernetes/pkg/api"
 )
 
+// NewCmdCerts return main command for certs phase
 func NewCmdCerts() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:     "certs",
@@ -42,12 +43,12 @@ func NewCmdCerts() *cobra.Command {
 		RunE:    subCmdRunE("certs"),
 	}
 
-	cmd.AddCommand(newSubCmdCerts()...)
+	cmd.AddCommand(getCertsSubCommands()...)
 	return cmd
 }
 
-// newSubCmdCerts returns sub commands for certs phase
-func newSubCmdCerts() []*cobra.Command {
+// getCertsSubCommands returns sub commands for certs phase
+func getCertsSubCommands() []*cobra.Command {
 
 	cfg := &kubeadmapiext.MasterConfiguration{}
 	// Default values for the cobra help text
@@ -122,13 +123,13 @@ func newSubCmdCerts() []*cobra.Command {
 	return subCmds
 }
 
-// runCmdFunc creates a cobra.Command Run function, by composing the call to the given cmdFunc with necessary additional steps (e.g preparation of inpunt parameters)
+// runCmdFunc creates a cobra.Command Run function, by composing the call to the given cmdFunc with necessary additional steps (e.g preparation of input parameters)
 func runCmdFunc(cmdFunc func(cfg *kubeadmapi.MasterConfiguration) error, cfgPath *string, cfg *kubeadmapiext.MasterConfiguration) func(cmd *cobra.Command, args []string) {
 
-	// the following statement build a clousure that wraps a call to a CreateCertFunc, binding
+	// the following statement build a clousure that wraps a call to a cmdFunc, binding
 	// the function itself with the specific parameters of each sub command.
 	// Please note that specific parameter should be passed as value, while other parameters - passed as reference -
-	// are shared between sub commnands and gets access to current value e.g. flags value.
+	// are shared between sub commands and gets access to current value e.g. flags value.
 
 	return func(cmd *cobra.Command, args []string) {
 		internalcfg := &kubeadmapi.MasterConfiguration{}

cmd/kubeadm/app/cmd/phases/certs_test.go

@@ -18,26 +18,24 @@ package phases
 
 import (
 	"fmt"
-	"html/template"
-	"io/ioutil"
 	"os"
-	"path"
-	"strings"
 	"testing"
 
-	"github.com/renstrom/dedent"
-	"github.com/spf13/cobra"
-
 	// required for triggering api machinery startup when running unit tests
 	_ "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/install"
 
+	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
 	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
 	"k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/pkiutil"
+	"k8s.io/kubernetes/pkg/util/node"
+
+	testutil "k8s.io/kubernetes/cmd/kubeadm/test"
+	cmdtestutil "k8s.io/kubernetes/cmd/kubeadm/test/cmd"
 )
 
 func TestSubCmdCertsCreateFiles(t *testing.T) {
 
-	subCmds := newSubCmdCerts()
+	subCmds := getCertsSubCommands()
 
 	var tests = []struct {
 		subCmds       []string
@@ -81,71 +79,51 @@ func TestSubCmdCertsCreateFiles(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		// Temporary folder for the test case
-		tmpdir, err := ioutil.TempDir("", "")
-		if err != nil {
-			t.Fatalf("Couldn't create tmpdir")
-		}
+		// Create temp folder for the test case
+		tmpdir := testutil.SetupTempDir(t)
 		defer os.RemoveAll(tmpdir)
 
 		// executes given sub commands
 		for _, subCmdName := range test.subCmds {
-			subCmd := getSubCmd(t, subCmdName, subCmds)
-			subCmd.SetArgs([]string{fmt.Sprintf("--cert-dir=%s", tmpdir)})
-			if err := subCmd.Execute(); err != nil {
-				t.Fatalf("Could not execute subcommand: %s", subCmdName)
-			}
+			certDirFlag := fmt.Sprintf("--cert-dir=%s", tmpdir)
+			cmdtestutil.RunSubCommand(t, subCmds, subCmdName, certDirFlag)
 		}
 
 		// verify expected files are there
-		assertFilesCount(t, tmpdir, len(test.expectedFiles))
-		for _, file := range test.expectedFiles {
-			assertFileExists(t, tmpdir, file)
-		}
+		testutil.AssertFileExists(t, tmpdir, test.expectedFiles...)
 	}
 }
 
 func TestSubCmdApiServerFlags(t *testing.T) {
 
-	subCmds := newSubCmdCerts()
+	subCmds := getCertsSubCommands()
 
-	// Temporary folder for the test case
-	tmpdir, err := ioutil.TempDir("", "")
-	if err != nil {
-		t.Fatalf("Couldn't create tmpdir")
-	}
+	// Create temp folder for the test case
+	tmpdir := testutil.SetupTempDir(t)
 	defer os.RemoveAll(tmpdir)
 
 	// creates ca cert
-	subCmd := getSubCmd(t, "ca", subCmds)
-	subCmd.SetArgs([]string{fmt.Sprintf("--cert-dir=%s", tmpdir)})
-	if err := subCmd.Execute(); err != nil {
-		t.Fatalf("Could not execute subcommand ca")
-	}
+	certDirFlag := fmt.Sprintf("--cert-dir=%s", tmpdir)
+	cmdtestutil.RunSubCommand(t, subCmds, "ca", certDirFlag)
 
 	// creates apiserver cert
-	subCmd = getSubCmd(t, "apiserver", subCmds)
-	subCmd.SetArgs([]string{
+	apiserverFlags := []string{
 		fmt.Sprintf("--cert-dir=%s", tmpdir),
 		"--apiserver-cert-extra-sans=foo,boo",
 		"--service-cidr=10.0.0.0/24",
 		"--service-dns-domain=mycluster.local",
 		"--apiserver-advertise-address=1.2.3.4",
-	})
-	if err := subCmd.Execute(); err != nil {
-		t.Fatalf("Could not execute subcommand apiserver")
 	}
+	cmdtestutil.RunSubCommand(t, subCmds, "apiserver", apiserverFlags...)
 
 	APIserverCert, err := pkiutil.TryLoadCertFromDisk(tmpdir, kubeadmconstants.APIServerCertAndKeyBaseName)
 	if err != nil {
 		t.Fatalf("Error loading API server certificate: %v", err)
 	}
 
-	hostname, err := os.Hostname()
-	if err != nil {
-		t.Errorf("couldn't get the hostname: %v", err)
-	}
-	for i, name := range []string{strings.ToLower(hostname), "kubernetes", "kubernetes.default", "kubernetes.default.svc", "kubernetes.default.svc.mycluster.local"} {
+	hostname := node.GetHostname("")
+
+	for i, name := range []string{hostname, "kubernetes", "kubernetes.default", "kubernetes.default.svc", "kubernetes.default.svc.mycluster.local"} {
 		if APIserverCert.DNSNames[i] != name {
 			t.Errorf("APIserverCert.DNSNames[%d] is %s instead of %s", i, APIserverCert.DNSNames[i], name)
 		}
@@ -157,9 +135,9 @@ func TestSubCmdApiServerFlags(t *testing.T) {
 	}
 }
 
-func TestSubCmdReadsConfig(t *testing.T) {
+func TestSubCmdCertsReadsConfig(t *testing.T) {
 
-	subCmds := newSubCmdCerts()
+	subCmds := getCertsSubCommands()
 
 	var tests = []struct {
 		subCmds           []string
@@ -184,88 +162,26 @@ func TestSubCmdReadsConfig(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		// Temporary folder for the test case
-		tmpdir, err := ioutil.TempDir("", "")
-		if err != nil {
-			t.Fatalf("Couldn't create tmpdir")
-		}
+		// Create temp folder for the test case
+		tmpdir := testutil.SetupTempDir(t)
 		defer os.RemoveAll(tmpdir)
 
-		configPath := saveDummyCfg(t, tmpdir)
+		certdir := tmpdir
+
+		cfg := &kubeadmapi.MasterConfiguration{
+			API:             kubeadmapi.API{AdvertiseAddress: "1.2.3.4", BindPort: 1234},
+			CertificatesDir: certdir,
+			NodeName:        "valid-node-name",
+		}
+		configPath := testutil.SetupMasterConfigurationFile(t, tmpdir, cfg)
 
 		// executes given sub commands
 		for _, subCmdName := range test.subCmds {
-			subCmd := getSubCmd(t, subCmdName, subCmds)
-			subCmd.SetArgs([]string{fmt.Sprintf("--config=%s", configPath)})
-			if err := subCmd.Execute(); err != nil {
-				t.Fatalf("Could not execute command: %s", subCmdName)
-			}
+			configFlag := fmt.Sprintf("--config=%s", configPath)
+			cmdtestutil.RunSubCommand(t, subCmds, subCmdName, configFlag)
 		}
 
 		// verify expected files are there
-		// NB. test.expectedFileCount + 1 because in this test case the tempdir where key/certificates
-		//     are saved contains also the dummy configuration file
-		assertFilesCount(t, tmpdir, test.expectedFileCount+1)
-	}
-}
-
-func getSubCmd(t *testing.T, name string, subCmds []*cobra.Command) *cobra.Command {
-	for _, subCmd := range subCmds {
-		if subCmd.Name() == name {
-			return subCmd
-		}
+		testutil.AssertFilesCount(t, tmpdir, test.expectedFileCount)
 	}
-	t.Fatalf("Unable to find sub command %s", name)
-
-	return nil
-}
-
-func assertFilesCount(t *testing.T, dirName string, count int) {
-	files, err := ioutil.ReadDir(dirName)
-	if err != nil {
-		t.Fatalf("Couldn't read files from tmpdir: %s", err)
-	}
-
-	if len(files) != count {
-		t.Errorf("dir does contains %d, %d expected", len(files), count)
-		for _, f := range files {
-			t.Error(f.Name())
-		}
-	}
-}
-
-func assertFileExists(t *testing.T, dirName string, fileName string) {
-	path := path.Join(dirName, fileName)
-	if _, err := os.Stat(path); os.IsNotExist(err) {
-		t.Errorf("file %s does not exist", fileName)
-	}
-}
-
-func saveDummyCfg(t *testing.T, dirName string) string {
-
-	path := path.Join(dirName, "dummyconfig.yaml")
-	cfgTemplate := template.Must(template.New("init").Parse(dedent.Dedent(`
-		apiVersion: kubeadm.k8s.io/v1alpha1
-		kind: MasterConfiguration
-		certificatesDir: {{.CertificatesDir}}
-		`)))
-
-	f, err := os.Create(path)
-	if err != nil {
-		t.Errorf("error creating dummyconfig file %s: %v", path, err)
-	}
-
-	templateData := struct {
-		CertificatesDir string
-	}{
-		CertificatesDir: dirName,
-	}
-
-	err = cfgTemplate.Execute(f, templateData)
-	if err != nil {
-		t.Errorf("error generating dummyconfig file %s: %v", path, err)
-	}
-	f.Close()
-
-	return path
 }

cmd/kubeadm/app/cmd/phases/kubeconfig.go

@@ -22,98 +22,147 @@ import (
 
 	"github.com/spf13/cobra"
 
+	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
 	kubeadmapiext "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1alpha1"
+	"k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/validation"
+	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
 	kubeconfigphase "k8s.io/kubernetes/cmd/kubeadm/app/phases/kubeconfig"
 	kubeadmutil "k8s.io/kubernetes/cmd/kubeadm/app/util"
+	configutil "k8s.io/kubernetes/cmd/kubeadm/app/util/config"
+	"k8s.io/kubernetes/pkg/api"
 )
 
+// NewCmdKubeConfig return main command for kubeconfig phase
 func NewCmdKubeConfig(out io.Writer) *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "kubeconfig",
-		Short: "Create KubeConfig files from given credentials.",
+		Short: "Generate all kubeconfig files necessary to establish the control plane and the admin kubeconfig file.",
 		RunE:  subCmdRunE("kubeconfig"),
 	}
 
-	cmd.AddCommand(NewCmdToken(out))
-	cmd.AddCommand(NewCmdClientCerts(out))
+	cmd.AddCommand(getKubeConfigSubCommands(out, kubeadmconstants.KubernetesDir)...)
 	return cmd
 }
 
-func NewCmdToken(out io.Writer) *cobra.Command {
-	config := &kubeconfigphase.BuildConfigProperties{
-		MakeClientCerts: false,
-	}
-	cmd := &cobra.Command{
-		Use:   "token",
-		Short: "Output a valid KubeConfig file to STDOUT with a token as the authentication method.",
-		Run: func(cmd *cobra.Command, args []string) {
-			err := RunCreateWithToken(out, config)
-			kubeadmutil.CheckErr(err)
+// getKubeConfigSubCommands returns sub commands for kubeconfig phase
+func getKubeConfigSubCommands(out io.Writer, outDir string) []*cobra.Command {
+
+	cfg := &kubeadmapiext.MasterConfiguration{}
+	// Default values for the cobra help text
+	api.Scheme.Default(cfg)
+
+	var cfgPath, token, clientName string
+	var subCmds []*cobra.Command
+
+	subCmdProperties := []struct {
+		use     string
+		short   string
+		cmdFunc func(outDir string, cfg *kubeadmapi.MasterConfiguration) error
+	}{
+		{
+			use:     "all",
+			short:   "Generate all kubeconfig files necessary to establish the control plane and the admin kubeconfig file.",
+			cmdFunc: kubeconfigphase.CreateInitKubeConfigFiles,
 		},
-	}
-	addCommonFlags(cmd, config)
-	cmd.Flags().StringVar(&config.Token, "token", "", "The path to the directory where the certificates are.")
-	return cmd
-}
+		{
+			use:     "admin",
+			short:   "Generate a kubeconfig file for the admin to use and for kubeadm itself.",
+			cmdFunc: kubeconfigphase.CreateAdminKubeConfigFile,
+		},
+		{
+			use:     "kubelet",
+			short:   "Generate a kubeconfig file for the Kubelet to use. Please note that this should *only* be used for bootstrapping purposes. After your control plane is up, you should request all kubelet credentials from the CSR API.",
+			cmdFunc: kubeconfigphase.CreateKubeletKubeConfigFile,
+		},
+		{
+			use:     "controller-manager",
+			short:   "Generate a kubeconfig file for the Controller Manager to use.",
+			cmdFunc: kubeconfigphase.CreateControllerManagerKubeConfigFile,
+		},
+		{
+			use:     "scheduler",
+			short:   "Generate a kubeconfig file for the Scheduler to use.",
+			cmdFunc: kubeconfigphase.CreateSchedulerKubeConfigFile,
+		},
+		{
+			use:   "user",
+			short: "Outputs a kubeconfig file for an additional user.",
+			cmdFunc: func(outDir string, cfg *kubeadmapi.MasterConfiguration) error {
+				if clientName == "" {
+					return fmt.Errorf("missing required argument client-name")
+				}
 
-func NewCmdClientCerts(out io.Writer) *cobra.Command {
-	config := &kubeconfigphase.BuildConfigProperties{
-		MakeClientCerts: true,
-	}
-	cmd := &cobra.Command{
-		Use:   "client-certs",
-		Short: "Output a valid KubeConfig file to STDOUT with a client certificates as the authentication method.",
-		Run: func(cmd *cobra.Command, args []string) {
-			err := RunCreateWithClientCerts(out, config)
-			kubeadmutil.CheckErr(err)
+				// if the kubeconfig file for an additional user has to use a token, use it
+				if token != "" {
+					return kubeconfigphase.WriteKubeConfigWithToken(out, cfg, clientName, token)
+				}
+
+				// Otherwise, write a kubeconfig file with a generate client cert
+				return kubeconfigphase.WriteKubeConfigWithClientCert(out, cfg, clientName)
+			},
 		},
 	}
-	addCommonFlags(cmd, config)
-	cmd.Flags().StringSliceVar(&config.Organization, "organization", []string{}, "The organization (group) the certificate should be in.")
-	return cmd
-}
 
-func addCommonFlags(cmd *cobra.Command, config *kubeconfigphase.BuildConfigProperties) {
-	cmd.Flags().StringVar(&config.CertDir, "cert-dir", kubeadmapiext.DefaultCertificatesDir, "The path to the directory where the certificates are.")
-	cmd.Flags().StringVar(&config.ClientName, "client-name", "", "The name of the client for which the KubeConfig file will be generated.")
-	cmd.Flags().StringVar(&config.APIServer, "server", "", "The location of the api server.")
-}
+	for _, properties := range subCmdProperties {
+		// Creates the UX Command
+		cmd := &cobra.Command{
+			Use:   properties.use,
+			Short: properties.short,
+			Run:   runCmdFuncKubeConfig(properties.cmdFunc, &outDir, &cfgPath, cfg),
+		}
 
-func validateCommonFlags(config *kubeconfigphase.BuildConfigProperties) error {
-	if len(config.ClientName) == 0 {
-		return fmt.Errorf("The --client-name flag is required")
-	}
-	if len(config.APIServer) == 0 {
-		return fmt.Errorf("The --server flag is required")
-	}
-	return nil
-}
+		// Add flags to the command
+		if properties.use != "user" {
+			cmd.Flags().StringVar(&cfgPath, "config", cfgPath, "Path to kubeadm config file (WARNING: Usage of a configuration file is experimental)")
+		}
+		cmd.Flags().StringVar(&cfg.CertificatesDir, "cert-dir", cfg.CertificatesDir, "The path where to save and store the certificates")
+		cmd.Flags().StringVar(&cfg.API.AdvertiseAddress, "apiserver-advertise-address", cfg.API.AdvertiseAddress, "The IP address the API Server will advertise it's listening on. 0.0.0.0 means the default network interface's address.")
+		cmd.Flags().Int32Var(&cfg.API.BindPort, "apiserver-bind-port", cfg.API.BindPort, "Port for the API Server to bind to")
+		if properties.use == "all" || properties.use == "kubelet" {
+			cmd.Flags().StringVar(&cfg.NodeName, "node-name", cfg.NodeName, `Specify the node name`)
+		}
+		if properties.use == "user" {
+			cmd.Flags().StringVar(&token, "token", token, "The path to the directory where the certificates are.")
+			cmd.Flags().StringVar(&clientName, "client-name", clientName, "The name of the client for which the KubeConfig file will be generated.")
+		}
 
-// RunCreateWithToken generates a kubeconfig file from with a token as the authentication mechanism
-func RunCreateWithToken(out io.Writer, config *kubeconfigphase.BuildConfigProperties) error {
-	if len(config.Token) == 0 {
-		return fmt.Errorf("The --token flag is required")
-	}
-	if err := validateCommonFlags(config); err != nil {
-		return err
+		subCmds = append(subCmds, cmd)
 	}
-	kubeConfigBytes, err := kubeconfigphase.GetKubeConfigBytesFromSpec(*config)
-	if err != nil {
-		return err
-	}
-	fmt.Fprintln(out, string(kubeConfigBytes))
-	return nil
+
+	return subCmds
 }
 
-// RunCreateWithClientCerts generates a kubeconfig file from with client certs as the authentication mechanism
-func RunCreateWithClientCerts(out io.Writer, config *kubeconfigphase.BuildConfigProperties) error {
-	if err := validateCommonFlags(config); err != nil {
-		return err
-	}
-	kubeConfigBytes, err := kubeconfigphase.GetKubeConfigBytesFromSpec(*config)
-	if err != nil {
-		return err
+// runCmdFuncKubeConfig creates a cobra.Command Run function, by composing the call to the given cmdFunc with necessary additional steps (e.g preparation of input parameters)
+func runCmdFuncKubeConfig(cmdFunc func(outDir string, cfg *kubeadmapi.MasterConfiguration) error, outDir, cfgPath *string, cfg *kubeadmapiext.MasterConfiguration) func(cmd *cobra.Command, args []string) {
+
+	// the following statement build a clousure that wraps a call to a CreateKubeConfigFunc, binding
+	// the function itself with the specific parameters of each sub command.
+	// Please note that specific parameter should be passed as value, while other parameters - passed as reference -
+	// are shared between sub commands and gets access to current value e.g. flags value.
+
+	return func(cmd *cobra.Command, args []string) {
+		internalcfg := &kubeadmapi.MasterConfiguration{}
+
+		// Takes passed flags into account; the defaulting is executed once again enforcing assignement of
+		// static default values to cfg only for values not provided with flags
+		api.Scheme.Default(cfg)
+		api.Scheme.Convert(cfg, internalcfg, nil)
+
+		// Loads configuration from config file, if provided
+		// Nb. --config overrides command line flags
+		err := configutil.TryLoadMasterConfiguration(*cfgPath, internalcfg)
+		kubeadmutil.CheckErr(err)
+
+		// Applies dynamic defaults to settings not provided with flags
+		err = configutil.SetInitDynamicDefaults(internalcfg)
+		kubeadmutil.CheckErr(err)
+
+		// Validates cfg (flags/configs + defaults + dynamic defaults)
+		err = validation.ValidateMasterConfiguration(internalcfg).ToAggregate()
+		kubeadmutil.CheckErr(err)
+
+		// Execute the cmdFunc
+		err = cmdFunc(*outDir, internalcfg)
+		kubeadmutil.CheckErr(err)
 	}
-	fmt.Fprintln(out, string(kubeConfigBytes))
-	return nil
 }

cmd/kubeadm/app/phases/kubeconfig/BUILD

@@ -5,6 +5,7 @@ licenses(["notice"])
 load(
     "@io_bazel_rules_go//go:def.bzl",
     "go_library",
+    "go_test",
 )
 
 go_library(
@@ -15,6 +16,7 @@ go_library(
     ],
     tags = ["automanaged"],
     deps = [
+        "//cmd/kubeadm/app/apis/kubeadm:go_default_library",
         "//cmd/kubeadm/app/constants:go_default_library",
         "//cmd/kubeadm/app/phases/certs/pkiutil:go_default_library",
         "//cmd/kubeadm/app/util/kubeconfig:go_default_library",
@@ -36,3 +38,20 @@ filegroup(
     srcs = [":package-srcs"],
     tags = ["automanaged"],
 )
+
+go_test(
+    name = "go_default_test",
+    srcs = ["kubeconfig_test.go"],
+    library = ":go_default_library",
+    tags = ["automanaged"],
+    deps = [
+        "//cmd/kubeadm/app/apis/kubeadm:go_default_library",
+        "//cmd/kubeadm/app/constants:go_default_library",
+        "//cmd/kubeadm/app/phases/certs/pkiutil:go_default_library",
+        "//cmd/kubeadm/test:go_default_library",
+        "//cmd/kubeadm/test/certs:go_default_library",
+        "//cmd/kubeadm/test/kubeconfig:go_default_library",
+        "//vendor/k8s.io/client-go/tools/clientcmd:go_default_library",
+        "//vendor/k8s.io/client-go/tools/clientcmd/api:go_default_library",
+    ],
+)

cmd/kubeadm/app/util/kubeconfig/kubeconfig.go

@@ -96,7 +96,6 @@ func WriteToDisk(filename string, kubeconfig *clientcmdapi.Config) error {
 		return err
 	}
 
-	fmt.Printf("[kubeconfig] Wrote KubeConfig file to disk: %q\n", filename)
 	return nil
 }
 

cmd/kubeadm/test/BUILD

+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["util.go"],
+    tags = ["automanaged"],
+    deps = [
+        "//cmd/kubeadm/app/apis/kubeadm:go_default_library",
+        "//cmd/kubeadm/app/constants:go_default_library",
+        "//cmd/kubeadm/app/phases/certs/pkiutil:go_default_library",
+        "//cmd/kubeadm/test/certs:go_default_library",
+        "//vendor/github.com/renstrom/dedent:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [
+        ":package-srcs",
+        "//cmd/kubeadm/test/certs:all-srcs",
+        "//cmd/kubeadm/test/cmd:all-srcs",
+        "//cmd/kubeadm/test/kubeconfig:all-srcs",
+    ],
+    tags = ["automanaged"],
+)

cmd/kubeadm/test/certs/BUILD

+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["util.go"],
+    tags = ["automanaged"],
+    deps = ["//cmd/kubeadm/app/phases/certs/pkiutil:go_default_library"],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

cmd/kubeadm/test/certs/util.go

+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package certs
+
+import (
+	"crypto/rsa"
+	"crypto/x509"
+	"testing"
+
+	"k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/pkiutil"
+)
+
+// SetupCertificateAuthorithy is a utility function for kubeadm testing that creates a
+// CertificateAuthorithy cert/key pair
+func SetupCertificateAuthorithy(t *testing.T) (*x509.Certificate, *rsa.PrivateKey) {
+	caCert, caKey, err := pkiutil.NewCertificateAuthority()
+	if err != nil {
+		t.Fatalf("failure while generating CA certificate and key: %v", err)
+	}
+
+	return caCert, caKey
+}
+
+// AssertCertificateIsSignedByCa is a utility function for kubeadm testing that asserts if a given certificate is signed
+// by the expected CA
+func AssertCertificateIsSignedByCa(t *testing.T, cert *x509.Certificate, signingCa *x509.Certificate) {
+	if err := cert.CheckSignatureFrom(signingCa); err != nil {
+		t.Error("cert is not signed by signing CA as expected")
+	}
+}
+
+// AssertCertificateHasCommonName is a utility function for kubeadm testing that asserts if a given certificate has
+// the expected SubjectCommonName
+func AssertCertificateHasCommonName(t *testing.T, cert *x509.Certificate, commonName string) {
+	if cert.Subject.CommonName != commonName {
+		t.Errorf("cert has Subject.CommonName %s, expected %s", cert.Subject.CommonName, commonName)
+	}
+}
+
+// AssertCertificateHasOrganizations is a utility function for kubeadm testing that asserts if a given certificate has
+// the expected Subject.Organization
+func AssertCertificateHasOrganizations(t *testing.T, cert *x509.Certificate, organizations ...string) {
+	for _, organization := range organizations {
+		found := false
+		for i := range cert.Subject.Organization {
+			if cert.Subject.Organization[i] == organization {
+				found = true
+			}
+		}
+		if !found {
+			t.Errorf("cert does not contain Subject.Organization %s as expected", organization)
+		}
+	}
+}
+
+// AssertCertificateHasClientAuthUsage is a utility function for kubeadm testing that asserts if a given certificate has
+// the expected ExtKeyUsageClientAuth
+func AssertCertificateHasClientAuthUsage(t *testing.T, cert *x509.Certificate) {
+	for i := range cert.ExtKeyUsage {
+		if cert.ExtKeyUsage[i] == x509.ExtKeyUsageClientAuth {
+			return
+		}
+	}
+	t.Error("cert has not ClientAuth usage as expected")
+}

cmd/kubeadm/test/cmd/BUILD

@@ -12,6 +12,7 @@ go_library(
     name = "go_default_library",
     srcs = ["util.go"],
     tags = ["automanaged"],
+    deps = ["//vendor/github.com/spf13/cobra:go_default_library"],
 )
 
 go_test(

cmd/kubeadm/test/cmd/util.go

@@ -20,6 +20,9 @@ import (
 	"bytes"
 	"fmt"
 	"os/exec"
+	"testing"
+
+	"github.com/spf13/cobra"
 )
 
 // Forked from test/e2e/framework because the e2e framework is quite bloated
@@ -37,3 +40,34 @@ func RunCmd(command string, args ...string) (string, string, error) {
 	}
 	return stdout, stderr, nil
 }
+
+// RunSubCommand is a utility function for kubeadm testing that executes a Cobra sub command
+func RunSubCommand(t *testing.T, subCmds []*cobra.Command, command string, args ...string) {
+	subCmd := getSubCommand(t, subCmds, command)
+	subCmd.SetArgs(args)
+	if err := subCmd.Execute(); err != nil {
+		t.Fatalf("Could not execute subcommand: %s", command)
+	}
+}
+
+// AssertSubCommandHasFlags is a utility function for kubeadm testing that assert if a Cobra sub command has expected flags
+func AssertSubCommandHasFlags(t *testing.T, subCmds []*cobra.Command, command string, flags ...string) {
+	subCmd := getSubCommand(t, subCmds, command)
+
+	for _, flag := range flags {
+		if subCmd.Flags().Lookup(flag) == nil {
+			t.Errorf("Could not find expecte flag %s for command %s", flag, command)
+		}
+	}
+}
+
+func getSubCommand(t *testing.T, subCmds []*cobra.Command, name string) *cobra.Command {
+	for _, subCmd := range subCmds {
+		if subCmd.Name() == name {
+			return subCmd
+		}
+	}
+	t.Fatalf("Unable to find sub command %s", name)
+
+	return nil
+}

cmd/kubeadm/test/kubeconfig/BUILD

+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["util.go"],
+    tags = ["automanaged"],
+    deps = [
+        "//cmd/kubeadm/test/certs:go_default_library",
+        "//vendor/k8s.io/client-go/tools/clientcmd/api:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

cmd/kubeadm/test/kubeconfig/util.go

+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package kubeconfig
+
+import (
+	"crypto/x509"
+	"encoding/pem"
+	"testing"
+
+	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
+	certstestutil "k8s.io/kubernetes/cmd/kubeadm/test/certs"
+)
+
+// AssertKubeConfigCurrentCluster is a utility function for kubeadm testing that asserts if the CurrentCluster in
+// the given KubeConfig object contains refers to a specific cluster
+func AssertKubeConfigCurrentCluster(t *testing.T, config *clientcmdapi.Config, expectedAPIServerAddress string, expectedAPIServerCaCert *x509.Certificate) {
+	currentContext := config.Contexts[config.CurrentContext]
+	currentCluster := config.Clusters[currentContext.Cluster]
+
+	// Assert expectedAPIServerAddress
+	if currentCluster.Server != expectedAPIServerAddress {
+		t.Errorf("kubeconfig.currentCluster.Server is [%s], expected [%s]", currentCluster.Server, expectedAPIServerAddress)
+	}
+
+	// Assert the APIServerCaCert
+	if len(currentCluster.CertificateAuthorityData) == 0 {
+		t.Error("kubeconfig.currentCluster.CertificateAuthorityData is empty, expected not empty")
+		return
+	}
+
+	block, _ := pem.Decode(currentCluster.CertificateAuthorityData)
+	currentAPIServerCaCert, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		t.Errorf("kubeconfig.currentCluster.CertificateAuthorityData is not a valid CA: %v", err)
+		return
+	}
+
+	if !currentAPIServerCaCert.Equal(expectedAPIServerCaCert) {
+		t.Errorf("kubeconfig.currentCluster.CertificateAuthorityData not correspond to the expected CA cert")
+	}
+}
+
+// AssertKubeConfigCurrentAuthInfoWithClientCert is a utility function for kubeadm testing that asserts if the CurrentAuthInfo in
+// the given KubeConfig object contains a clientCert that refers to a specific client name, is signed by the expected CA, includes the expected organizations
+func AssertKubeConfigCurrentAuthInfoWithClientCert(t *testing.T, config *clientcmdapi.Config, signinCa *x509.Certificate, expectedClientName string, expectedOrganizations ...string) {
+	currentContext := config.Contexts[config.CurrentContext]
+	currentAuthInfo := config.AuthInfos[currentContext.AuthInfo]
+
+	// assert clientCert
+	if len(currentAuthInfo.ClientCertificateData) == 0 {
+		t.Error("kubeconfig.currentAuthInfo.ClientCertificateData is empty, expected not empty")
+		return
+	}
+
+	block, _ := pem.Decode(config.AuthInfos[currentContext.AuthInfo].ClientCertificateData)
+	currentClientCert, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		t.Errorf("kubeconfig.currentAuthInfo.ClientCertificateData is not a valid CA: %v", err)
+		return
+	}
+
+	// Asserts the clientCert is signed by the signinCa
+	certstestutil.AssertCertificateIsSignedByCa(t, currentClientCert, signinCa)
+
+	// Asserts the clientCert has ClientAuth ExtKeyUsage
+	certstestutil.AssertCertificateHasClientAuthUsage(t, currentClientCert)
+
+	// Asserts the clientCert has expected expectedUserName as CommonName
+	certstestutil.AssertCertificateHasCommonName(t, currentClientCert, expectedClientName)
+
+	// Asserts the clientCert has expected Organizations
+	certstestutil.AssertCertificateHasOrganizations(t, currentClientCert, expectedOrganizations...)
+}
+
+// AssertKubeConfigCurrentAuthInfoWithToken is a utility function for kubeadm testing that asserts if the CurrentAuthInfo in
+// the given KubeConfig object refers to expected token
+func AssertKubeConfigCurrentAuthInfoWithToken(t *testing.T, config *clientcmdapi.Config, expectedClientName, expectedToken string) {
+	currentContext := config.Contexts[config.CurrentContext]
+	currentAuthInfo := config.AuthInfos[currentContext.AuthInfo]
+
+	// assert token
+	if currentAuthInfo.Token != expectedToken {
+		t.Errorf("kubeconfig.currentAuthInfo.Token [%s], expected [%s]", currentAuthInfo.Token, expectedToken)
+		return
+	}
+}

cmd/kubeadm/test/util.go

+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package test
+
+import (
+	"html/template"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/renstrom/dedent"
+
+	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
+	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
+	"k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/pkiutil"
+	certtestutil "k8s.io/kubernetes/cmd/kubeadm/test/certs"
+)
+
+// SetupTempDir is a utility function for kubeadm testing, that creates a temporary directory
+// NB. it is up to the caller to cleanup the folder at the end of the test with defer os.RemoveAll(tmpdir)
+func SetupTempDir(t *testing.T) string {
+	tmpdir, err := ioutil.TempDir("", "")
+	if err != nil {
+		t.Fatalf("Couldn't create tmpdir")
+	}
+
+	return tmpdir
+}
+
+// SetupMasterConfigurationFile is a utility function for kubeadm testing that writes a master configuration file
+// into /config subfolder of a given temporary directory.
+// The funtion returns the path of the created master configuration file.
+func SetupMasterConfigurationFile(t *testing.T, tmpdir string, cfg *kubeadmapi.MasterConfiguration) string {
+
+	cfgPath := filepath.Join(tmpdir, "config/masterconfig.yaml")
+	if err := os.MkdirAll(filepath.Dir(cfgPath), os.FileMode(0755)); err != nil {
+		t.Fatalf("Couldn't create cfgDir")
+	}
+
+	cfgTemplate := template.Must(template.New("init").Parse(dedent.Dedent(`
+		apiVersion: kubeadm.k8s.io/v1alpha1
+		kind: MasterConfiguration
+		certificatesDir: {{.CertificatesDir}}
+		api:
+		   advertiseAddress: {{.API.AdvertiseAddress}}
+		   bindPort: {{.API.BindPort}}
+		nodeName: {{.NodeName}}
+		`)))
+
+	f, err := os.Create(cfgPath)
+	if err != nil {
+		t.Fatalf("error creating masterconfig file %s: %v", cfgPath, err)
+	}
+
+	err = cfgTemplate.Execute(f, cfg)
+	if err != nil {
+		t.Fatalf("error generating masterconfig file %s: %v", cfgPath, err)
+	}
+	f.Close()
+
+	return cfgPath
+}
+
+// SetupPkiDirWithCertificateAuthorithy is a utility function for kubeadm testing that creates a
+// CertificateAuthorithy cert/key pair into /pki subfolder of a given temporary directory.
+// The funtion returns the path of the created pki.
+func SetupPkiDirWithCertificateAuthorithy(t *testing.T, tmpdir string) string {
+	caCert, caKey := certtestutil.SetupCertificateAuthorithy(t)
+
+	certDir := filepath.Join(tmpdir, "pki")
+	if err := pkiutil.WriteCertAndKey(certDir, kubeadmconstants.CACertAndKeyBaseName, caCert, caKey); err != nil {
+		t.Fatalf("failure while saving CA certificate and key: %v", err)
+	}
+
+	return certDir
+}
+
+// AssertFilesCount is a utility function for kubeadm testing that asserts if the given folder contains
+// count files.
+func AssertFilesCount(t *testing.T, dirName string, count int) {
+	files, err := ioutil.ReadDir(dirName)
+	if err != nil {
+		t.Fatalf("Couldn't read files from tmpdir: %s", err)
+	}
+
+	countFiles := 0
+	for _, f := range files {
+		if !f.IsDir() {
+			countFiles++
+		}
+	}
+
+	if countFiles != count {
+		t.Errorf("dir does contains %d, %d expected", len(files), count)
+		for _, f := range files {
+			t.Error(f.Name())
+		}
+	}
+}
+
+// AssertFileExists is a utility function for kubeadm testing that asserts if the given folder contains
+// the given files.
+func AssertFileExists(t *testing.T, dirName string, fileNames ...string) {
+	for _, fileName := range fileNames {
+		path := filepath.Join(dirName, fileName)
+
+		if _, err := os.Stat(path); os.IsNotExist(err) {
+			t.Errorf("file %s does not exist", fileName)
+		}
+	}
+}