Add a make target to export admin editor token

[majst01]

Description

This completes the effort made in: metal-stack/metal-apiserver#231

Used AI-Tools ✨

• none used for generation

[l0wl3vel]

Errors (non-critical unfortunately) during the integration tests:

eval $(make dev-env)
./test/integration.sh

eval $(make dev-env)
error: stat /home/benjamin/metal-stack/mini-lab/.kubeconfig: no such file or directory

and the resulting env looks like this:

...
METAL_APIV2_TOKEN=
METALCTL_API_URL=http://api.172.17.0.1.nip.io:8080/metal
export=
METALCTL_HMAC=metal-admin
METAL_APIV2_URL=http://v2.172.17.0.1.nip.io:8080
KUBECONFIG=/home/benjamin/metal-stack/mini-lab/.kubeconfig

-> metalcli wont work

had a similar issue yesterday. Making env vars return command output evaluated when reading an env var is not possible in bash. I tried to do a similar thing yesterday.

TOKEN=$$(...)

evaluates into

TOKEN=1560054(kubectl --kubeconfig=$(KUBECONFIG) get secret -n metal-control-plane metal-apiserver-admin-token --template={{.data.admin_editor_token}} | base64 -d)

In my case I had to generate the CA/certificates before running the dev-env target: aa1926b

@Gerrit91 @majst01

[majst01]

Errors (non-critical unfortunately) during the integration tests:

eval $(make dev-env)
./test/integration.sh

eval $(make dev-env)
error: stat /home/benjamin/metal-stack/mini-lab/.kubeconfig: no such file or directory

and the resulting env looks like this:

...
METAL_APIV2_TOKEN=
METALCTL_API_URL=http://api.172.17.0.1.nip.io:8080/metal
export=
METALCTL_HMAC=metal-admin
METAL_APIV2_URL=http://v2.172.17.0.1.nip.io:8080
KUBECONFIG=/home/benjamin/metal-stack/mini-lab/.kubeconfig

-> metalcli wont work

had a similar issue yesterday. Making env vars return command output evaluated when reading an env var is not possible in bash. I tried to do a similar thing yesterday.

TOKEN=$$(...)

evaluates into

TOKEN=1560054(kubectl --kubeconfig=$(KUBECONFIG) get secret -n metal-control-plane metal-apiserver-admin-token --template={{.data.admin_editor_token}} | base64 -d)

In my case I had to generate the CA/certificates before running the dev-env target: aa1926b

@Gerrit91 @majst01

But this only happens if the deployment of the metal-apiserver was not done yet.

[l0wl3vel]

Expressions in env vars not evaluated at runtime has nothing to do with the secret missing.

Even after mini-lab startup and the secret getting created manually it does not fill the METAL_APIV2_TOKEN:

# Start mini-lab
% eval $(make dev-env)
Error from server (NotFound): secrets "metal-apiserver-admin-token" not found

% kubectl create secret -n metal-control-plane generic  metal-apiserver-admin-token --from-literal=admin_editor_token=asdf
secret/metal-apiserver-admin-token created

% env
METAL_APIV2_TOKEN=
METALCTL_API_URL=https://api.172.42.0.42.nip.io/metal
export=
METALCTL_HMAC=metal-admin
METAL_APIV2_URL=http://v2.172.42.0.42.nip.io
KUBECONFIG=/home/benjamin/metal-stack/mini-lab/.kubeconfig

The $$ does not cause lazy evaluation of the kubectl get. We should move the token retrieval into an extra make target so it can be run separately after control-plane bootstrap.

[majst01]

Expressions in env vars not evaluated at runtime has nothing to do with the secret missing.

Even after mini-lab startup and the secret getting created manually it does not fill the METAL_APIV2_TOKEN:

# Start mini-lab
% eval $(make dev-env)
Error from server (NotFound): secrets "metal-apiserver-admin-token" not found

% kubectl create secret -n metal-control-plane generic  metal-apiserver-admin-token --from-literal=admin_editor_token=asdf
secret/metal-apiserver-admin-token created

% env
METAL_APIV2_TOKEN=
METALCTL_API_URL=https://api.172.42.0.42.nip.io/metal
export=
METALCTL_HMAC=metal-admin
METAL_APIV2_URL=http://v2.172.42.0.42.nip.io
KUBECONFIG=/home/benjamin/metal-stack/mini-lab/.kubeconfig

The $$ does not cause lazy evaluation of the kubectl get. We should move the token retrieval into an extra make target so it can be run separately after control-plane bootstrap.

It worked for me under bash and on another seat under zsh, do not understand why this is not working on your setup ?

If you have a better solution, please create a PR for that.