feat: liqoctl generate peering user

This patch introduces a set of commands allowing to generate a user with
the minimum permissions to create a peering from the cluster with the
specified cluster ID

cmd/liqoctl/cmd/root.go

@@ -39,6 +39,7 @@ import (
 	"github.com/liqotech/liqo/pkg/liqoctl/rest/identity"
 	"github.com/liqotech/liqo/pkg/liqoctl/rest/kubeconfig"
 	"github.com/liqotech/liqo/pkg/liqoctl/rest/nonce"
+	peeringuser "github.com/liqotech/liqo/pkg/liqoctl/rest/peering-user"
 	"github.com/liqotech/liqo/pkg/liqoctl/rest/publickey"
 	"github.com/liqotech/liqo/pkg/liqoctl/rest/resourceslice"
 	"github.com/liqotech/liqo/pkg/liqoctl/rest/tenant"
@@ -56,6 +57,7 @@ var liqoResources = []rest.APIProvider{
 	publickey.PublicKey,
 	tenant.Tenant,
 	nonce.Nonce,
+	peeringuser.PeeringUser,
 	identity.Identity,
 	resourceslice.ResourceSlice,
 	kubeconfig.Kubeconfig,

deployments/liqo/files/liqo-peering-user-ClusterRole.yaml

@@ -0,0 +1,65 @@
+rules:
+- apiGroups:
+  - "networking.liqo.io"
+  resources:
+  - "configurations"
+  - "gatewayclients"
+  - "gatewayservers"
+  - "publickeies"
+  verbs:
+  - "create"
+  - "update"
+  - "get"
+  - "list"
+  - "delete"
+- apiGroups:
+  - "networking.liqo.io"
+  resources:
+  - "connections"
+  verbs:
+  - "get"
+  - "list"
+- apiGroups:
+  - "networking.liqo.io"
+  resources:
+  - "gatewayclients/status"
+  - "gatewayservers/status"
+  verbs:
+  - "get"
+- apiGroups:
+  - ""
+  resources:
+  - "configmaps"
+  - "secrets"
+  verbs:
+  - "create"
+  - "get"
+  - "list"
+  - "delete"
+- apiGroups:
+  - ""
+  resources:
+  - "services"
+  verbs:
+  - "get"
+- apiGroups:
+  - "apps"
+  resources:
+  - "deployments"
+  verbs:
+  - "get"
+- apiGroups:
+  - "ipam.liqo.io"
+  resources:
+  - "ips"
+  verbs:
+  - "create"
+  - "update"
+  - "get"
+  - "delete"
+- apiGroups:
+  - "authentication.liqo.io"
+  resources:
+  - "tenants/status"
+  verbs:
+  - "get"

deployments/liqo/files/liqo-peering-user-Role.yaml

@@ -0,0 +1,17 @@
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - "networking.liqo.io"
+  resources:
+  - "wggatewayservertemplates"
+  - "wggatewayclienttemplates"
+  verbs:
+  - "get"
+  - "list"

deployments/liqo/templates/liqo-peer-rbac.yaml

@@ -0,0 +1,17 @@
+{{- $peeringroles := (merge (dict "name" "peering-user" "module" "peering-user") .) -}}
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "liqo.prefixedName" $peeringroles}}
+  labels:
+  {{- include "liqo.labels" $peeringroles| nindent 4 }}
+{{ .Files.Get (include "liqo.cluster-role-filename" (dict "prefix" ( include "liqo.prefixedName" $peeringroles))) }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "liqo.prefixedName" $peeringroles}}
+  labels:
+  {{- include "liqo.labels" $peeringroles| nindent 4 }}
+{{ .Files.Get (include "liqo.role-filename" (dict "prefix" ( include "liqo.prefixedName" $peeringroles))) }}

pkg/consts/authentication.go

@@ -54,4 +54,7 @@ const (
 
 	// RenewAnnotation is the value of the annotation that enables the renewal of a resource.
 	RenewAnnotation = "liqo.io/renew"
+
+	// PeeringUserNameLabelKey labels all the resources created to grant peering permissions to the user doing a pering toward this cluster.
+	PeeringUserNameLabelKey = "liqo.io/peering-user-name"
 )

pkg/liqo-controller-manager/authentication/csr.go

@@ -68,6 +68,26 @@ func GenerateCSRForControlPlane(key ed25519.PrivateKey, clusterID liqov1beta1.Cl
 	return generateCSR(key, CommonNameControlPlaneCSR(clusterID), OrganizationControlPlaneCSR())
 }
 
+// GenerateCSRForPeerUser generates a new CSR given a private key and the clusterID from which the peering will start.
+func GenerateCSRForPeerUser(key ed25519.PrivateKey, clusterID liqov1beta1.ClusterID) (csrBytes []byte, userCN string, err error) {
+	userCN, err = commonNamePeerUser(clusterID)
+	if err != nil {
+		return nil, "", fmt.Errorf("unable to generate user CN: %w", err)
+	}
+
+	csrBytes, err = generateCSR(key, userCN, OrganizationControlPlaneCSR())
+	return
+}
+
+// commonNamePeerUser returns the common name for the user creating the peering. To avoid reuses of the same name, a suffix is added.
+func commonNamePeerUser(clusterID liqov1beta1.ClusterID) (string, error) {
+	randSuffix := make([]byte, 16)
+	if _, err := rand.Read(randSuffix); err != nil {
+		return "", err
+	}
+	return fmt.Sprintf("liqo-peer-user-%s-%x", clusterID, randSuffix), nil
+}
+
 // CommonNameControlPlaneCSR returns the common name for a control plane CSR.
 func CommonNameControlPlaneCSR(clusterID liqov1beta1.ClusterID) string {
 	return string(clusterID)

pkg/liqo-controller-manager/offloading/virtualnode-controller/virtualkubelet.go

@@ -171,12 +171,14 @@ func (r *VirtualNodeReconciler) ensureVirtualKubeletDeploymentAbsence(
 		return err
 	}
 
+	crbName := k8strings.ShortenString(fmt.Sprintf("%s%s", vkMachinery.CRBPrefix, virtualNode.Name), 253)
 	err = r.Client.Delete(ctx, &rbacv1.ClusterRoleBinding{ObjectMeta: metav1.ObjectMeta{
-		Name: k8strings.ShortenString(fmt.Sprintf("%s%s", vkMachinery.CRBPrefix, virtualNode.Name), 253),
+		Name: crbName,
 	}})
 	if client.IgnoreNotFound(err) != nil {
 		return err
 	}
+	klog.Info(fmt.Sprintf("[%v] Deleted virtual-kubelet CRB %s", virtualNode.Spec.ClusterID, crbName))
 
 	err = r.Client.Delete(ctx, &corev1.ServiceAccount{ObjectMeta: metav1.ObjectMeta{
 		Name: virtualNode.Name, Namespace: virtualNode.Namespace,

pkg/liqoctl/info/localstatus/local_info.go

@@ -24,6 +24,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	liqov1beta1 "github.com/liqotech/liqo/apis/core/v1beta1"
+	"github.com/liqotech/liqo/pkg/consts"
 	"github.com/liqotech/liqo/pkg/liqoctl/info"
 	"github.com/liqotech/liqo/pkg/liqoctl/output"
 	liqoctlutils "github.com/liqotech/liqo/pkg/liqoctl/utils"
@@ -46,10 +47,6 @@ type InstallationChecker struct {
 	data Installation
 }
 
-const (
-	ctrlManagerContainerName = "controller-manager"
-)
-
 // Collect data about the local installation of Liqo.
 func (l *InstallationChecker) Collect(ctx context.Context, options info.Options) {
 	// Get the cluster ID of the local cluster
@@ -64,7 +61,7 @@ func (l *InstallationChecker) Collect(ctx context.Context, options info.Options)
 	if err != nil {
 		l.AddCollectionError(fmt.Errorf("unable to get Liqo version and cluster labels: %w", err))
 	} else {
-		ctrlContainer, err := l.getCtrlManagerContainer(ctrlDeployment)
+		ctrlContainer, err := liqoctlutils.GetCtrlManagerContainer(ctrlDeployment)
 		if err != nil {
 			l.AddCollectionError(fmt.Errorf("unable to get Liqo instance info: %w", err))
 		} else {
@@ -143,22 +140,10 @@ func (l *InstallationChecker) collectClusterLabels(ctrlContainer *corev1.Contain
 }
 
 func (l *InstallationChecker) collectLiqoVersion(ctrlDeployment *appsv1.Deployment) error {
-	version, err := getters.GetContainerImageVersion(ctrlDeployment.Spec.Template.Spec.Containers, ctrlManagerContainerName)
+	version, err := getters.GetContainerImageVersion(ctrlDeployment.Spec.Template.Spec.Containers, consts.ControllerManagerAppName)
 	if err != nil {
 		return err
 	}
 	l.data.Version = version
 	return nil
 }
-
-func (l *InstallationChecker) getCtrlManagerContainer(ctrlDeployment *appsv1.Deployment) (*corev1.Container, error) {
-	// Get the container of the controller manager
-	containers := ctrlDeployment.Spec.Template.Spec.Containers
-	for i := range containers {
-		if containers[i].Name == ctrlManagerContainerName {
-			return &containers[i], nil
-		}
-	}
-
-	return nil, fmt.Errorf("invalid controller manager deployment: no container with name %q found", ctrlManagerContainerName)
-}

pkg/liqoctl/peer/handler.go

@@ -86,7 +86,7 @@ func (o *Options) RunPeer(ctx context.Context) error {
 	// Ensure networking
 	if !o.NetworkingDisabled {
 		if err := ensureNetworking(ctx, o); err != nil {
-			o.LocalFactory.PrinterGlobal.Error.Println("unable to ensure networking")
+			o.LocalFactory.PrinterGlobal.Error.Printfln("Unable to ensure networking: %v", err)
 			return err
 		}
 	}

pkg/liqoctl/rest/peering-user/create.go

@@ -0,0 +1,28 @@
+// Copyright 2019-2025 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package peeringuser
+
+import (
+	"context"
+
+	"github.com/spf13/cobra"
+
+	"github.com/liqotech/liqo/pkg/liqoctl/rest"
+)
+
+// Create implements the create command.
+func (o *Options) Create(_ context.Context, _ *rest.CreateOptions) *cobra.Command {
+	panic("not implemented")
+}

pkg/liqoctl/rest/peering-user/delete.go

@@ -0,0 +1,74 @@
+// Copyright 2019-2025 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package peeringuser
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/spf13/cobra"
+	"k8s.io/apimachinery/pkg/util/runtime"
+
+	liqov1beta1 "github.com/liqotech/liqo/apis/core/v1beta1"
+	"github.com/liqotech/liqo/pkg/liqoctl/output"
+	"github.com/liqotech/liqo/pkg/liqoctl/rest"
+	"github.com/liqotech/liqo/pkg/liqoctl/rest/peering-user/userfactory"
+)
+
+const liqoctlDeletePeeringUserHelp = `elete an existing user with the permissions to peer with this cluster.
+
+Delete a peering user, so that it will no longer be able to peer with this cluster from the cluster with the given Cluster ID.
+The previous credentials will be invalidated, and cannot be used anymore, even if the user is recreated.
+
+Examples:
+  $ {{ .Executable }} delete peering-user --consumer-cluster-id=<cluster-id>`
+
+// Delete deletes a user.
+func (o *Options) Delete(ctx context.Context, options *rest.DeleteOptions) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "peering-user",
+		Short: "Delete an existing user with the permissions to peer with this cluster",
+		Long:  liqoctlDeletePeeringUserHelp,
+		Args:  cobra.NoArgs,
+
+		PreRun: func(_ *cobra.Command, _ []string) {
+			o.deleteOptions = options
+		},
+
+		Run: func(_ *cobra.Command, _ []string) {
+			output.ExitOnErr(o.handleDelete(ctx))
+		},
+	}
+
+	cmd.Flags().Var(&o.clusterID, "consumer-cluster-id", "The cluster ID of the cluster from which peering has been performed")
+
+	runtime.Must(cmd.MarkFlagRequired("consumer-cluster-id"))
+
+	return cmd
+}
+
+func (o *Options) handleDelete(ctx context.Context) error {
+	opts := o.deleteOptions
+	clusterID := liqov1beta1.ClusterID(*o.clusterID.ClusterID)
+
+	if err := userfactory.RemovePermissions(ctx, opts.CRClient, clusterID); err != nil {
+		wErr := fmt.Errorf("unable to delete peering user: %w", err)
+		opts.Printer.Error.Println(wErr)
+		return wErr
+	}
+
+	opts.Printer.Success.Printfln("Peering user for cluster with ID %q deleted successfully", clusterID)
+	return nil
+}

pkg/liqoctl/rest/peering-user/doc.go

@@ -0,0 +1,16 @@
+// Copyright 2019-2025 The Liqo Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package peeringuser contains the rest API commands to allow liqoctl to create an authentication token to authenticate to this cluster.
+package peeringuser