Function WrapForCFOnK8sAuth

api/shared/wrap_for_cf_on_k8s.go:29–78

go:generate go run github.com/maxbrunsfeld/counterfeiter/v6 net/http.RoundTripper

(config command.Config, k8sConfigGetter v7action.KubernetesConfigGetter, roundTripper http.RoundTripper)

//go:generate go run github.com/maxbrunsfeld/counterfeiter/v6 net/http.RoundTripper

func WrapForCFOnK8sAuth(config command.Config, k8sConfigGetter v7action.KubernetesConfigGetter, roundTripper http.RoundTripper) (http.RoundTripper, error) {
	username, err := config.CurrentUserName()
	if err != nil {
		return nil, err
	}
	if username == "" {
		return nil, errors.New("current user not set")
	}

	k8sConfig, err := k8sConfigGetter.Get()
	if err != nil {
		return nil, err
	}

	restConfig, err := clientcmd.NewDefaultClientConfig(
		*k8sConfig,
		&clientcmd.ConfigOverrides{
			Context: api.Context{AuthInfo: username},
		},
	).ClientConfig()
	if err != nil {
		return nil, err
	}

	// Special case for certs, since we don't want mtls
	cert, err := getCert(restConfig)
	if err != nil {
		return nil, err
	}

	transportConfig, err := restConfig.TransportConfig()
	if err != nil {
		return nil, fmt.Errorf("failed to get transport config: %w", err)
	}

	if cert != nil {
		return certRoundTripper{
			cert:         cert,
			roundTripper: roundTripper,
		}, nil
	}

	if transportConfig.WrapTransport == nil {
		// i.e. not auth-provider or exec plugin
		return transport.HTTPWrappersForConfig(transportConfig, roundTripper)
	}

	// using auth provider to generate token
	return transportConfig.WrapTransport(roundTripper), nil
}

func getCert(restConfig *rest.Config) (*tls.Certificate, error) {
	tlsConfig, err := rest.TLSConfigFor(restConfig)