Implements handling of insecure TLS connections in Mehkit

utils/kubernetes/client.go

@@ -1,10 +1,16 @@
 package kubernetes
 
 import (
+	"fmt"
+	"log"
 	"os"
 	"path/filepath"
 
+	"github.com/layer5io/meshkit/models"
+	event "github.com/layer5io/meshkit/models/events"
 	"github.com/layer5io/meshkit/utils"
+	"github.com/layer5io/meshkit/utils/events"
+	"gopkg.in/yaml.v3"
 	"k8s.io/client-go/rest"
 	"k8s.io/client-go/tools/clientcmd"
 	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
@@ -13,39 +19,63 @@ import (
 // DetectKubeConfig detects the kubeconfig for the kubernetes cluster and returns it
 func DetectKubeConfig(configfile []byte) (config *rest.Config, err error) {
 	if len(configfile) > 0 {
+		if err != nil {
+			return nil, err
+		}
+
+		models := &models.Kubeconfig{}
 		var cfgFile []byte
+
 		cfgFile, err = processConfig(configfile)
 		if err != nil {
 			return nil, err
 		}
 
-		if config, err = clientcmd.RESTConfigFromKubeConfig(cfgFile); err == nil {
-			return config, err
+		if err = yaml.Unmarshal(cfgFile, models); err != nil {
+			return nil, err
 		}
+
+		config, err = processClustersAndConfig(models, cfgFile)
+		return config, err
 	}
 
 	// If deployed within the cluster
 	if config, err = rest.InClusterConfig(); err == nil {
 		return config, err
 	}
 
-	// Look for kubeconfig from the path mentioned in $KUBECONFIG
+	// Look for kubeconfig from the path mentioned in $KUBECONFIGZ
+	models := &models.Kubeconfig{}
+	var cfgFile []byte
 	kubeconfig := os.Getenv("KUBECONFIG")
 	if kubeconfig != "" {
 		if config, err = clientcmd.BuildConfigFromFlags("", kubeconfig); err == nil {
+
+			config, err = processClustersAndConfig(models, cfgFile)
 			return config, err
+
 		}
+		return
 	}
 
 	// Look for kubeconfig at the default path
 	path := filepath.Join(utils.GetHome(), ".kube", "config")
 	if config, err = clientcmd.BuildConfigFromFlags("", path); err == nil {
+
+		config, err = processClustersAndConfig(models, cfgFile)
 		return config, err
 	}
 
 	return
 }
 
+func publishEvent(event interface{}) {
+	eventStreamer := events.NewEventStreamer()
+	clientChannel := make(chan interface{})
+	eventStreamer.Subscribe(clientChannel)
+	eventStreamer.Publish(event)
+}
+
 func processConfig(configFile []byte) ([]byte, error) {
 	cfg, err := clientcmd.Load(configFile)
 	if err != nil {
@@ -69,3 +99,28 @@ func processConfig(configFile []byte) ([]byte, error) {
 
 	return clientcmd.Write(*cfg)
 }
+
+func processClustersAndConfig(models *models.Kubeconfig, cfgFile []byte) (*rest.Config, error) {
+	for _, clusters := range models.Clusters {
+		if config, err := clientcmd.RESTConfigFromKubeConfig(cfgFile); err == nil {
+			if insecureSkipTLSVerify := clusters.Cluster.InsecureSkipTLSVerify; insecureSkipTLSVerify != nil && *insecureSkipTLSVerify {
+				// Skip TLS verification if the field is set to true
+				config.TLSClientConfig.Insecure = *insecureSkipTLSVerify
+
+				clusters.Cluster.CertificateAuthorityData = ""
+
+				// Create an event to record the insecure connection
+				eventBuilder := event.NewEvent().WithCategory("connection").WithAction("insecure")
+				eventBuilder.WithSeverity(event.Warning).WithDescription("Insecure TLS connection to Kubernetes cluster detected")
+
+				// Publish the event directly using the events package
+				event := eventBuilder.Build()
+				publishEvent(event)
+
+				log.Println("SKIP TLS verification part was called")
+			}
+			return config, err
+		}
+	}
+	return nil, fmt.Errorf("unable to build Kubernetes configuration")
+}

utils/kubernetes/client_test.go

@@ -0,0 +1,105 @@
+package kubernetes
+
+import (
+	"fmt"
+	"testing"
+)
+
+func TestDetectKubeConfig(t *testing.T) {
+	t.Parallel()
+	// Test case 1: Valid kubeconfig file with tls-skip-verify set to true
+	configfile := []byte(`
+apiVersion: v1
+clusters:
+- cluster:
+    certificate-authority-data: REDACTED
+    server: https://localhost:6443
+    insecure-skip-tls-verify: false
+  name: kubernetes
+contexts:
+- context:
+    cluster: kubernetes
+    user: kubernetes-admin
+  name: kubernetes-admin@kubernetes
+current-context: kubernetes-admin@kubernetes
+kind: Config
+preferences: {}
+users:
+- name: kubernetes-admin
+  user:
+    client-certificate-data: REDACTED
+    client-key-data: REDACTED
+`)
+	config, err := DetectKubeConfig(configfile)
+	if err != nil {
+		t.Errorf("DetectKubeConfig() failed with error: %v", err)
+	}
+	if config == nil {
+		t.Errorf("DetectKubeConfig() returned nil config")
+	}
+	if config != nil && config.TLSClientConfig.CAData != nil {
+		fmt.Print("Test case 1: CertificateAuthorityData should be empty, but it's not")
+	}
+
+	// Test case 2: Valid kubeconfig file with tls-skip-verify set to false
+	configfile = []byte(`
+apiVersion: v1
+clusters:
+- cluster:
+    certificate-authority-data: REDACTED
+    server: https://localhost:6443
+    insecure-skip-tls-verify: false
+  name: kubernetes
+contexts:
+- context:
+    cluster: kubernetes
+    user: kubernetes-admin
+  name: kubernetes-admin@kubernetes
+current-context: kubernetes-admin@kubernetes
+kind: Config
+preferences: {}
+users:
+- name: kubernetes-admin
+  user:
+    client-certificate-data: REDACTED
+    client-key-data: REDACTED
+`)
+	config, err = DetectKubeConfig(configfile)
+	if err != nil {
+		t.Errorf("DetectKubeConfig() failed with error: %v", err)
+	}
+	if config == nil {
+		t.Errorf("DetectKubeConfig() returned nil config")
+	}
+	if config != nil && config.TLSClientConfig.CAData == nil {
+		fmt.Print("Test case 2: CertificateAuthorityData should not be empty, but it is")
+	}
+
+	// Test case 3: Invalid kubeconfig file
+	configfile = []byte(`invalid kubeconfig`)
+	config, err = DetectKubeConfig(configfile)
+	if err == nil {
+		t.Errorf("DetectKubeConfig() did not return an error for invalid kubeconfig")
+	}
+	if config != nil {
+		t.Errorf("DetectKubeConfig() returned non-nil config for invalid kubeconfig")
+	}
+	if config != nil && config.TLSClientConfig.CAData != nil {
+		t.Errorf("Test case 3: CertificateAuthorityData should be empty, but it's not")
+	}
+}
+
+func TestPublishEventWithChannelLeak(t *testing.T) {
+	t.Parallel()
+	// Simulate multiple subscribers
+	numSubscribers := 10
+	channels := make([]chan interface{}, numSubscribers)
+	for i := 0; i < numSubscribers; i++ {
+		channels[i] = make(chan interface{})
+	}
+
+	// Publish an event without closing the channels
+	event := "test event with channel leak"
+	publishEvent(event)
+
+}