Revert KubernetesService. Introduce FetchKubernetesTokenService.

4 files changed, 90 insertions, 25 deletions

diff --git a/app/services/ci/create_cluster_service.rb b/app/services/ci/create_cluster_service.rb
index 86820706831..b5fb71f5092 100644
--- a/app/services/ci/create_cluster_service.rb
+++ b/app/services/ci/create_cluster_service.rb
@@ -1,6 +1,10 @@
 module Ci
   class CreateClusterService < BaseService
     def execute(access_token)
+      if params['machine_type'].blank?
+        params['machine_type'] = GoogleApi::CloudPlatform::Client::DEFAULT_MACHINE_TYPE
+      end
+
       project.clusters.create(
         params.merge(user: current_user,
                      status: Ci::Cluster.statuses[:scheduled],
diff --git a/app/services/ci/fetch_kubernetes_token_service.rb b/app/services/ci/fetch_kubernetes_token_service.rb
new file mode 100644
index 00000000000..013e4f12682
--- /dev/null
+++ b/app/services/ci/fetch_kubernetes_token_service.rb
@@ -0,0 +1,70 @@
+##
+# TODO:
+# Almost components in this class were copied from app/models/project_services/kubernetes_service.rb
+# We should dry up those classes not to repeat the same code.
+# Maybe we should have a special facility (e.g. lib/kubernetes_api) to maintain all Kubernetes API caller.
+module Ci
+  class FetchKubernetesTokenService
+    attr_reader :api_url, :ca_pem, :username, :password
+
+    def initialize(api_url, ca_pem, username, password)
+      @api_url = api_url
+      @ca_pem = ca_pem
+      @username = username
+      @password = password
+    end
+
+    def execute
+      read_secrets.each do |secret|
+        name = secret.dig('metadata', 'name')
+        if /default-token/ =~ name
+          token_base64 = secret.dig('data', 'token')
+          return Base64.decode64(token_base64) if token_base64
+        end
+      end
+    end
+
+    private
+
+    def read_secrets
+      kubeclient = build_kubeclient!
+
+      kubeclient.get_secrets.as_json
+    rescue KubeException => err
+      raise err unless err.error_code == 404
+      []
+    end
+
+    def build_kubeclient!(api_path: 'api', api_version: 'v1')
+      raise "Incomplete settings" unless api_url && username && password
+
+      ::Kubeclient::Client.new(
+        join_api_url(api_path),
+        api_version,
+        auth_options: { username: username, password: password },
+        ssl_options: kubeclient_ssl_options,
+        http_proxy_uri: ENV['http_proxy']
+      )
+    end
+
+    def join_api_url(api_path)
+      url = URI.parse(api_url)
+      prefix = url.path.sub(%r{/+\z}, '')
+
+      url.path = [prefix, api_path].join("/")
+
+      url.to_s
+    end
+
+    def kubeclient_ssl_options
+      opts = { verify_ssl: OpenSSL::SSL::VERIFY_PEER }
+
+      if ca_pem.present?
+        opts[:cert_store] = OpenSSL::X509::Store.new
+        opts[:cert_store].add_cert(OpenSSL::X509::Certificate.new(ca_pem))
+      end
+
+      opts
+    end
+  end
+end
diff --git a/app/services/ci/integrate_cluster_service.rb b/app/services/ci/integrate_cluster_service.rb
index d5b1ccd345d..5dd1f2b3414 100644
--- a/app/services/ci/integrate_cluster_service.rb
+++ b/app/services/ci/integrate_cluster_service.rb
@@ -1,21 +1,10 @@
 module Ci
   class IntegrateClusterService
     def execute(cluster, endpoint, ca_cert, token, username, password)
-      kubernetes_service ||= cluster.project.find_or_initialize_service('kubernetes')
-
       Ci::Cluster.transaction do
-        # Update service
-        kubernetes_service.attributes = {
-          active: true,
-          api_url: endpoint,
-          ca_pem: ca_cert,
-          namespace: cluster.project_namespace,
-          token: token
-        }
-
-        kubernetes_service.save!
+        kubernetes_service ||=
+          cluster.project.find_or_initialize_service('kubernetes')
 
-        # Save info in cluster record
         cluster.update!(
           enabled: true,
           service: kubernetes_service,
@@ -25,10 +14,16 @@ module Ci
           ca_cert: ca_cert,
           endpoint: endpoint,
           gcp_token: nil,
-          status: Ci::Cluster.statuses[:created]
-        )
-      end
+          gcp_operation_id: nil,
+          status: Ci::Cluster.statuses[:created])
 
+        kubernetes_service.update!(
+          active: true,
+          api_url: cluster.api_url,
+          ca_pem: ca_cert,
+          namespace: cluster.project_namespace,
+          token: token)
+      end
     rescue ActiveRecord::RecordInvalid => e
       cluster.error!("Failed to integrate cluster into kubernetes_service: #{e.message}")
     end
diff --git a/app/services/ci/update_cluster_service.rb b/app/services/ci/update_cluster_service.rb
index 0b458e27b90..a440ac03a0b 100644
--- a/app/services/ci/update_cluster_service.rb
+++ b/app/services/ci/update_cluster_service.rb
@@ -2,22 +2,18 @@ module Ci
   class UpdateClusterService < BaseService
     def execute(cluster)
       Ci::Cluster.transaction do
-        if params['enabled'] == 'true'
+        cluster.update!(enabled: params['enabled'])
 
-          cluster.service.attributes = {
+        if params['enabled'] == 'true'
+          cluster.service.update!(
             active: true,
-            api_url: cluster.endpoint,
+            api_url: cluster.api_url,
             ca_pem: cluster.ca_cert,
             namespace: cluster.project_namespace,
-            token: cluster.kubernetes_token
-          }
-
-          cluster.service.save!
+            token: cluster.kubernetes_token)
         else
           cluster.service.update(active: false)
         end
-
-        cluster.update!(enabled: params['enabled'])
       end
     rescue ActiveRecord::RecordInvalid => e
       cluster.errors.add(:base, e.message)