Merge pull request #9340 from rifelpet/lt_userdata

Store terraform launchtemplate userdata in plaintext rather than b64

hack/verify-terraform.sh

@@ -36,7 +36,7 @@ while IFS= read -r -d '' -u 3 test_dir; do
   cluster=$(basename "${test_dir}")
   kube::util::array_contains "${cluster}" "${CLUSTERS_0_11[@]}" && tag=$TAG_0_11 || tag=$TAG_0_12
 
-  docker run --rm -it -v "${test_dir}":"${test_dir}" -w "${test_dir}" --entrypoint=sh hashicorp/terraform:$tag -c '/bin/terraform init >/dev/null && /bin/terraform validate' || RC=$?
+  docker run --rm -v "${test_dir}":"${test_dir}" -w "${test_dir}" --entrypoint=sh hashicorp/terraform:$tag -c '/bin/terraform init >/dev/null && /bin/terraform validate' || RC=$?
 done 3< <(find "${KOPS_ROOT}/tests/integration/update_cluster" -type d -maxdepth 1 -print0)
 
 if [ $RC != 0 ]; then

tests/integration/update_cluster/bastionadditional_user-data/data/aws_launch_template_bastion.bastionuserdata.example.com_user_data

@@ -1 +1,13 @@
-Q29udGVudC1UeXBlOiBtdWx0aXBhcnQvbWl4ZWQ7IGJvdW5kYXJ5PSJNSU1FQk9VTkRBUlkiDQpNSU1FLVZlcnNpb246IDEuMA0KDQotLU1JTUVCT1VOREFSWQ0KQ29udGVudC1EaXNwb3NpdGlvbjogYXR0YWNobWVudDsgZmlsZW5hbWU9Im15c2NyaXB0LnNoIg0KQ29udGVudC1UcmFuc2Zlci1FbmNvZGluZzogN2JpdA0KQ29udGVudC1UeXBlOiB0ZXh0L3gtc2hlbGxzY3JpcHQNCk1pbWUtVmVyc2lvbjogMS4wDQoNCiMhL2Jpbi9zaAplY2hvICJIZWxsbyBXb3JsZCwgZnJvbSB0aGUgYmFzdGlvbiEgIFRoZSB0aW1lIGlzIG5vdyAkKGRhdGUgLVIpISIgfCB0ZWUgL3Jvb3Qvb3V0cHV0LnR4dAoNCi0tTUlNRUJPVU5EQVJZLS0NCg==
+Content-Type: multipart/mixed; boundary="MIMEBOUNDARY"
+MIME-Version: 1.0
+
+--MIMEBOUNDARY
+Content-Disposition: attachment; filename="myscript.sh"
+Content-Transfer-Encoding: 7bit
+Content-Type: text/x-shellscript
+Mime-Version: 1.0
+
+#!/bin/sh
+echo "Hello World, from the bastion!  The time is now $(date -R)!" | tee /root/output.txt
+
+--MIMEBOUNDARY--

upup/pkg/fi/cloudup/awstasks/iamrole.go

@@ -195,7 +195,7 @@ type terraformIAMRole struct {
 }
 
 func (_ *IAMRole) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *IAMRole) error {
-	policy, err := t.AddFile("aws_iam_role", *e.Name, "policy", e.RolePolicyDocument)
+	policy, err := t.AddFile("aws_iam_role", *e.Name, "policy", e.RolePolicyDocument, false)
 	if err != nil {
 		return fmt.Errorf("error rendering RolePolicyDocument: %v", err)
 	}

upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go

@@ -317,7 +317,7 @@ func (_ *IAMRolePolicy) RenderTerraform(t *terraform.TerraformTarget, a, e, chan
 		return nil
 	}
 
-	policy, err := t.AddFile("aws_iam_role_policy", *e.Name, "policy", e.PolicyDocument)
+	policy, err := t.AddFile("aws_iam_role_policy", *e.Name, "policy", e.PolicyDocument, false)
 	if err != nil {
 		return fmt.Errorf("error rendering PolicyDocument: %v", err)
 	}

upup/pkg/fi/cloudup/awstasks/launchconfiguration.go

@@ -543,7 +543,7 @@ func (_ *LaunchConfiguration) RenderTerraform(t *terraform.TerraformTarget, a, e
 			return err
 		}
 		if userData != "" {
-			tf.UserData, err = t.AddFile("aws_launch_configuration", *e.Name, "user_data", e.UserData)
+			tf.UserData, err = t.AddFile("aws_launch_configuration", *e.Name, "user_data", e.UserData, false)
 			if err != nil {
 				return err
 			}

upup/pkg/fi/cloudup/awstasks/launchtemplate_target_terraform.go

@@ -19,6 +19,7 @@ package awstasks
 import (
 	"encoding/base64"
 
+	"k8s.io/kops/pkg/featureflag"
 	"k8s.io/kops/upup/pkg/fi"
 	"k8s.io/kops/upup/pkg/fi/cloudup/awsup"
 	"k8s.io/kops/upup/pkg/fi/cloudup/terraform"
@@ -212,13 +213,23 @@ func (t *LaunchTemplate) RenderTerraform(target *terraform.TerraformTarget, a, e
 		if err != nil {
 			return err
 		}
-		b64d := base64.StdEncoding.EncodeToString(d)
-		if b64d != "" {
-			b64UserDataResource := fi.WrapResource(fi.NewStringResource(b64d))
+		if d != nil {
+			if featureflag.Terraform012.Enabled() {
+				userDataResource := fi.WrapResource(fi.NewBytesResource(d))
 
-			tf.UserData, err = target.AddFile("aws_launch_template", fi.StringValue(e.Name), "user_data", b64UserDataResource)
-			if err != nil {
-				return err
+				tf.UserData, err = target.AddFile("aws_launch_template", fi.StringValue(e.Name), "user_data", userDataResource, true)
+				if err != nil {
+					return err
+				}
+			} else {
+				b64d := base64.StdEncoding.EncodeToString(d)
+				if b64d != "" {
+					b64UserDataResource := fi.WrapResource(fi.NewStringResource(b64d))
+					tf.UserData, err = target.AddFile("aws_launch_template", fi.StringValue(e.Name), "user_data", b64UserDataResource, false)
+					if err != nil {
+						return err
+					}
+				}
 			}
 		}
 	}

upup/pkg/fi/cloudup/awstasks/sshkey.go

@@ -176,7 +176,7 @@ func (_ *SSHKey) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *SS
 		return nil
 	}
 	tfName := strings.Replace(*e.Name, ":", "", -1)
-	publicKey, err := t.AddFile("aws_key_pair", tfName, "public_key", e.PublicKey)
+	publicKey, err := t.AddFile("aws_key_pair", tfName, "public_key", e.PublicKey, false)
 	if err != nil {
 		return fmt.Errorf("error rendering PublicKey: %v", err)
 	}

upup/pkg/fi/cloudup/gcetasks/instancetemplate.go

@@ -500,7 +500,7 @@ func addMetadata(target *terraform.TerraformTarget, name string, metadata *compu
 		val := fi.StringValue(g.Value)
 		if strings.Contains(val, "\n") {
 			v := fi.NewStringResource(val)
-			tfResource, err := target.AddFile("google_compute_instance_template", name, "metadata_"+g.Key, v)
+			tfResource, err := target.AddFile("google_compute_instance_template", name, "metadata_"+g.Key, v, false)
 			if err != nil {
 				return nil, err
 			}

upup/pkg/fi/cloudup/spotinsttasks/elastigroup.go

@@ -1430,7 +1430,7 @@ func (_ *Elastigroup) RenderTerraform(t *terraform.TerraformTarget, a, e, change
 	// User data.
 	if e.UserData != nil {
 		var err error
-		tf.UserData, err = t.AddFile("spotinst_elastigroup_aws", *e.Name, "user_data", e.UserData)
+		tf.UserData, err = t.AddFile("spotinst_elastigroup_aws", *e.Name, "user_data", e.UserData, false)
 		if err != nil {
 			return err
 		}

upup/pkg/fi/cloudup/spotinsttasks/launch_spec.go

@@ -667,7 +667,7 @@ func (_ *LaunchSpec) RenderTerraform(t *terraform.TerraformTarget, a, e, changes
 	{
 		if e.UserData != nil {
 			var err error
-			tf.UserData, err = t.AddFile("spotinst_ocean_aws_launch_spec", *e.Name, "user_data", e.UserData)
+			tf.UserData, err = t.AddFile("spotinst_ocean_aws_launch_spec", *e.Name, "user_data", e.UserData, false)
 			if err != nil {
 				return err
 			}

upup/pkg/fi/cloudup/spotinsttasks/ocean.go

@@ -1095,7 +1095,7 @@ func (_ *Ocean) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *Oce
 	// User data.
 	if e.UserData != nil {
 		var err error
-		tf.UserData, err = t.AddFile("spotinst_ocean_aws", *e.Name, "user_data", e.UserData)
+		tf.UserData, err = t.AddFile("spotinst_ocean_aws", *e.Name, "user_data", e.UserData, false)
 		if err != nil {
 			return err
 		}

upup/pkg/fi/cloudup/terraform/literal.go

@@ -47,9 +47,13 @@ func (l *Literal) MarshalJSON() ([]byte, error) {
 	return json.Marshal(&l.Value)
 }
 
-func LiteralFileExpression(modulePath string) *Literal {
+func LiteralFileExpression(modulePath string, base64 bool) *Literal {
+	fn := "file"
+	if base64 {
+		fn = "filebase64"
+	}
 	return &Literal{
-		Value:    fmt.Sprintf("${file(%q)}", modulePath),
+		Value:    fmt.Sprintf("${%v(%q)}", fn, modulePath),
 		FilePath: modulePath,
 	}
 }

upup/pkg/fi/cloudup/terraform/target.go

@@ -106,7 +106,7 @@ func tfSanitize(name string) string {
 	return strings.NewReplacer(".", "-", "/", "--", ":", "_").Replace(name)
 }
 
-func (t *TerraformTarget) AddFile(resourceType string, resourceName string, key string, r fi.Resource) (*Literal, error) {
+func (t *TerraformTarget) AddFile(resourceType string, resourceName string, key string, r fi.Resource, base64 bool) (*Literal, error) {
 	id := resourceType + "_" + resourceName + "_" + key
 
 	d, err := fi.ResourceAsBytes(r)
@@ -121,7 +121,7 @@ func (t *TerraformTarget) AddFile(resourceType string, resourceName string, key
 	t.files[p] = d
 
 	modulePath := path.Join("${path.module}", p)
-	l := LiteralFileExpression(modulePath)
+	l := LiteralFileExpression(modulePath, base64)
 	return l, nil
 }