Followup PR for k8snetworkplumbingwg/multus-cni#1512 to validate command file paths after Kubernetes bump

cmd/kubeconfig_generator/main.go

@@ -21,13 +21,13 @@ import (
 	"fmt"
 	"os"
 	"os/signal"
-	"path/filepath"
 	"syscall"
 	"text/template"
 	"time"
 
 	"github.com/spf13/pflag"
 
+	"gopkg.in/k8snetworkplumbingwg/multus-cni.v4/pkg/cmdutils"
 	"gopkg.in/k8snetworkplumbingwg/multus-cni.v4/pkg/k8sclient"
 
 	"k8s.io/client-go/tools/clientcmd"
@@ -63,27 +63,40 @@ func main() {
 	certDurationString := pflag.StringP("cert-duration", "", "10m", "specify certificate duration")
 	helpFlag := pflag.BoolP("help", "h", false, "show help message and quit")
 
-	kubeconfigPath, err := filepath.Abs(*kubeconfigPathRaw)
-	if err != nil {
-		klog.Fatalf("illegal path %s in kubeconfigPath %s: %v", kubeconfigPath, *kubeconfigPathRaw, err)
-	}
-
 	pflag.Parse()
 	if *helpFlag {
 		pflag.PrintDefaults()
 		os.Exit(1)
 	}
 
+	kubeconfigPath, err := cmdutils.NewRootedFile(*kubeconfigPathRaw)
+	if err != nil {
+		klog.Fatalf("illegal path in kubeconfigPath %s: %v", *kubeconfigPathRaw, err)
+	}
+	defer kubeconfigPath.Close()
+
+	bootstrapConfigPath, err := cmdutils.NewRootedFile(*bootstrapConfig)
+	if err != nil {
+		klog.Fatalf("illegal path in bootstrap-config %s: %v", *bootstrapConfig, err)
+	}
+	defer bootstrapConfigPath.Close()
+
+	certDirPath, err := cmdutils.NewRootedDir(*certDir)
+	if err != nil {
+		klog.Fatalf("illegal path in certdir %s: %v", *certDir, err)
+	}
+	defer certDirPath.Close()
+
 	// check variables
-	if _, err := os.Stat(*bootstrapConfig); err != nil {
-		klog.Fatalf("failed to read bootstrap config %q", *bootstrapConfig)
+	if _, err := bootstrapConfigPath.Root.Stat(bootstrapConfigPath.FileName); err != nil {
+		klog.Fatalf("failed to read bootstrap config %q", bootstrapConfigPath.Path())
 	}
-	st, err := os.Stat(*certDir)
+	st, err := certDirPath.Root.Stat(".")
 	if err != nil {
-		klog.Fatalf("failed to find cert directory %q", *certDir)
+		klog.Fatalf("failed to find cert directory %q", certDirPath.Path())
 	}
 	if !st.IsDir() {
-		klog.Fatalf("cert directory %q is not directory", *certDir)
+		klog.Fatalf("cert directory %q is not directory", certDirPath.Path())
 	}
 	certDuration, err := time.ParseDuration(*certDurationString)
 	if err != nil {
@@ -96,50 +109,61 @@ func main() {
 	}
 
 	// retrieve API server from bootstrapConfig()
-	config, err := clientcmd.BuildConfigFromFlags("", *bootstrapConfig)
+	config, err := clientcmd.BuildConfigFromFlags("", bootstrapConfigPath.Path())
 	if err != nil {
 		klog.Fatalf("cannot get in-cluster config: %v", err)
 	}
 	apiServer := fmt.Sprintf("%s%s", config.Host, config.APIPath)
 	caData := base64.StdEncoding.EncodeToString(config.CAData)
 
 	// run certManager to create certification
-	if _, err = k8sclient.PerNodeK8sClient(nodeName, *bootstrapConfig, certDuration, *certDir); err != nil {
+	if _, err = k8sclient.PerNodeK8sClient(nodeName, bootstrapConfigPath.Path(), certDuration, certDirPath.Path()); err != nil {
 		klog.Fatalf("failed to start cert manager: %v", err)
 	}
 
-	fp, err := os.OpenFile(kubeconfigPath, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0600)
-	if err != nil {
-		klog.Fatalf("cannot create kubeconfig file %q: %v", kubeconfigPath, err)
-	}
-
-	// render kubeconfig
-	templateKubeconfig, err := template.New("kubeconfig").Parse(kubeConfigTemplate)
-	if err != nil {
-		klog.Fatalf("template parse error: %v", err)
-	}
 	templateData := map[string]string{
 		"CADATA":        caData,
-		"CERTDIR":       *certDir,
+		"CERTDIR":       certDirPath.Path(),
 		"K8S_APISERVER": apiServer,
 	}
-	// genearate kubeconfig from template
-	if err = templateKubeconfig.Execute(fp, templateData); err != nil {
-		klog.Fatalf("cannot create kubeconfig: %v", err)
-	}
-	if err = fp.Close(); err != nil {
-		klog.Fatalf("cannot save kubeconfig: %v", err)
+	if err = writeKubeconfig(kubeconfigPath, templateData); err != nil {
+		klog.Fatalf("%v", err)
 	}
 
-	klog.Infof("kubeconfig %q is saved", kubeconfigPath)
+	klog.Infof("kubeconfig %q is saved", kubeconfigPath.Path())
 
 	// wait for signal
 	sigterm := make(chan os.Signal, 1)
-	signal.Notify(sigterm, syscall.SIGINT, syscall.SIGTERM, syscall.SIGKILL)
+	signal.Notify(sigterm, syscall.SIGINT, syscall.SIGTERM)
 	<-sigterm
-	klog.Infof("signal received. remove kubeconfig %q and quit.", kubeconfigPath)
-	err = os.Remove(kubeconfigPath)
+	klog.Infof("signal received. remove kubeconfig %q and quit.", kubeconfigPath.Path())
+	err = kubeconfigPath.Root.Remove(kubeconfigPath.FileName)
+	if err != nil {
+		klog.Errorf("failed to remove kubeconfig %q: %v", kubeconfigPath.Path(), err)
+	}
+}
+
+func writeKubeconfig(kubeconfigPath *cmdutils.RootedFile, templateData map[string]string) (err error) {
+	fp, err := kubeconfigPath.Root.OpenFile(kubeconfigPath.FileName, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0600)
 	if err != nil {
-		klog.Errorf("failed to remove kubeconfig %q: %v", kubeconfigPath, err)
+		return fmt.Errorf("cannot create kubeconfig file %q: %w", kubeconfigPath.Path(), err)
 	}
+	defer func() {
+		if closeErr := fp.Close(); closeErr != nil && err == nil {
+			err = fmt.Errorf("cannot save kubeconfig file %q: %w", kubeconfigPath.Path(), closeErr)
+		}
+	}()
+	if err = fp.Chmod(0600); err != nil {
+		return fmt.Errorf("cannot set kubeconfig file mode %q: %w", kubeconfigPath.Path(), err)
+	}
+
+	templateKubeconfig, err := template.New("kubeconfig").Parse(kubeConfigTemplate)
+	if err != nil {
+		return fmt.Errorf("template parse error: %w", err)
+	}
+	if err = templateKubeconfig.Execute(fp, templateData); err != nil {
+		return fmt.Errorf("cannot create kubeconfig: %w", err)
+	}
+
+	return nil
 }

cmd/kubeconfig_generator/main_test.go

@@ -0,0 +1,113 @@
+// Copyright (c) 2026 Multus Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/onsi/ginkgo/v2"
+	"github.com/onsi/gomega"
+
+	"gopkg.in/k8snetworkplumbingwg/multus-cni.v4/pkg/cmdutils"
+)
+
+func TestKubeconfigGenerator(t *testing.T) {
+	gomega.RegisterFailHandler(ginkgo.Fail)
+	ginkgo.RunSpecs(t, "kubeconfig_generator")
+}
+
+var _ = ginkgo.Describe("kubeconfig generator", func() {
+	ginkgo.It("writes a new kubeconfig with private file mode", func() {
+		tmpDir, err := os.MkdirTemp("", "multus_kubeconfig_generator_tmp")
+		gomega.Expect(err).NotTo(gomega.HaveOccurred())
+		ginkgo.DeferCleanup(func() {
+			gomega.Expect(os.RemoveAll(tmpDir)).To(gomega.Succeed())
+		})
+
+		kubeconfigPath, err := cmdutils.NewRootedFile(filepath.Join(tmpDir, "kubeconfig"))
+		gomega.Expect(err).NotTo(gomega.HaveOccurred())
+		ginkgo.DeferCleanup(func() {
+			gomega.Expect(kubeconfigPath.Close()).To(gomega.Succeed())
+		})
+
+		gomega.Expect(writeKubeconfig(kubeconfigPath, templateData(tmpDir))).To(gomega.Succeed())
+
+		expectKubeconfigContents(kubeconfigPath, tmpDir)
+		stat, err := kubeconfigPath.Root.Stat(kubeconfigPath.FileName)
+		gomega.Expect(err).NotTo(gomega.HaveOccurred())
+		gomega.Expect(stat.Mode().Perm()).To(gomega.Equal(os.FileMode(0600)))
+	})
+
+	ginkgo.It("writes kubeconfig and resets an existing permissive file mode", func() {
+		tmpDir, err := os.MkdirTemp("", "multus_kubeconfig_generator_tmp")
+		gomega.Expect(err).NotTo(gomega.HaveOccurred())
+		ginkgo.DeferCleanup(func() {
+			gomega.Expect(os.RemoveAll(tmpDir)).To(gomega.Succeed())
+		})
+
+		kubeconfigPath, err := cmdutils.NewRootedFile(filepath.Join(tmpDir, "kubeconfig"))
+		gomega.Expect(err).NotTo(gomega.HaveOccurred())
+		ginkgo.DeferCleanup(func() {
+			gomega.Expect(kubeconfigPath.Close()).To(gomega.Succeed())
+		})
+
+		createExistingKubeconfig(kubeconfigPath)
+		stat, err := kubeconfigPath.Root.Stat(kubeconfigPath.FileName)
+		gomega.Expect(err).NotTo(gomega.HaveOccurred())
+		gomega.Expect(stat.Mode().Perm()).To(gomega.Equal(os.FileMode(0644)))
+
+		gomega.Expect(writeKubeconfig(kubeconfigPath, templateData(tmpDir))).To(gomega.Succeed())
+
+		expectKubeconfigContents(kubeconfigPath, tmpDir)
+		stat, err = kubeconfigPath.Root.Stat(kubeconfigPath.FileName)
+		gomega.Expect(err).NotTo(gomega.HaveOccurred())
+		gomega.Expect(stat.Mode().Perm()).To(gomega.Equal(os.FileMode(0600)))
+	})
+})
+
+func templateData(certDir string) map[string]string {
+	return map[string]string{
+		"CADATA":        "test-ca",
+		"CERTDIR":       certDir,
+		"K8S_APISERVER": "https://api.example.test",
+	}
+}
+
+func expectKubeconfigContents(kubeconfigPath *cmdutils.RootedFile, certDir string) {
+	contents, err := kubeconfigPath.Root.ReadFile(kubeconfigPath.FileName)
+	gomega.Expect(err).NotTo(gomega.HaveOccurred())
+	for _, expected := range []string{
+		"certificate-authority-data: test-ca",
+		"server: https://api.example.test",
+		"client-certificate: " + certDir + "/multus-client-current.pem",
+		"client-key: " + certDir + "/multus-client-current.pem",
+	} {
+		gomega.Expect(string(contents)).To(gomega.ContainSubstring(expected))
+	}
+}
+
+func createExistingKubeconfig(kubeconfigPath *cmdutils.RootedFile) {
+	existingFile, err := kubeconfigPath.Root.OpenFile(kubeconfigPath.FileName, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0644)
+	gomega.Expect(err).NotTo(gomega.HaveOccurred())
+	defer func() {
+		gomega.Expect(existingFile.Close()).To(gomega.Succeed())
+	}()
+
+	_, err = existingFile.Write([]byte("existing"))
+	gomega.Expect(err).NotTo(gomega.HaveOccurred())
+	gomega.Expect(existingFile.Chmod(0644)).To(gomega.Succeed())
+}

cmd/multus-daemon/main.go

@@ -26,14 +26,14 @@ import (
 	"os"
 	"os/signal"
 	"os/user"
-	"path/filepath"
 	"sync"
 	"syscall"
 	"time"
 
 	"golang.org/x/net/netutil"
 	utilwait "k8s.io/apimachinery/pkg/util/wait"
 
+	"gopkg.in/k8snetworkplumbingwg/multus-cni.v4/pkg/cmdutils"
 	"gopkg.in/k8snetworkplumbingwg/multus-cni.v4/pkg/logging"
 	"gopkg.in/k8snetworkplumbingwg/multus-cni.v4/pkg/multus"
 	srv "gopkg.in/k8snetworkplumbingwg/multus-cni.v4/pkg/server"
@@ -209,34 +209,44 @@ func startMultusDaemon(ctx context.Context, daemonConfig *srv.ControllerNetConf,
 }
 
 func cniServerConfig(configFilePath string) (*srv.ControllerNetConf, error) {
-	path, err := filepath.Abs(configFilePath)
+	configPath, err := cmdutils.NewRootedFile(configFilePath)
 	if err != nil {
-		return nil, fmt.Errorf("illegal path %s in server config path %s: %w", path, configFilePath, err)
+		return nil, fmt.Errorf("illegal path in server config path %s: %w", configFilePath, err)
 	}
+	defer configPath.Close()
 
-	configFileContents, err := os.ReadFile(path)
+	configFileContents, err := configPath.Root.ReadFile(configPath.FileName)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("failed to read server config %s: %w", configPath.Path(), err)
 	}
 	return srv.LoadDaemonNetConf(configFileContents)
 }
 
 func copyUserProvidedConfig(multusConfigPath string, cniConfigDir string) error {
-	path, err := filepath.Abs(multusConfigPath)
+	srcPath, err := cmdutils.NewRootedFile(multusConfigPath)
 	if err != nil {
-		return fmt.Errorf("illegal path %s in multusConfigPath %s: %w", path, multusConfigPath, err)
+		return fmt.Errorf("illegal path in multusConfigPath %s: %w", multusConfigPath, err)
 	}
+	defer srcPath.Close()
 
-	srcFile, err := os.Open(path)
+	srcFile, err := srcPath.Root.Open(srcPath.FileName)
 	if err != nil {
-		return fmt.Errorf("failed to open (READ only) file %s: %w", path, err)
+		return fmt.Errorf("failed to open (READ only) file %s: %w", srcPath.Path(), err)
 	}
+	defer srcFile.Close()
 
-	dstFileName := cniConfigDir + "/" + filepath.Base(multusConfigPath)
-	dstFile, err := os.Create(dstFileName)
+	dstPath, err := cmdutils.NewRootedFileInDir(cniConfigDir, srcPath.FileName)
 	if err != nil {
-		return fmt.Errorf("creating copying file %s: %w", dstFileName, err)
+		return fmt.Errorf("illegal destination path in cniConfigDir %s: %w", cniConfigDir, err)
 	}
+	defer dstPath.Close()
+
+	dstFile, err := dstPath.Root.Create(dstPath.FileName)
+	if err != nil {
+		return fmt.Errorf("creating copying file %s: %w", dstPath.Path(), err)
+	}
+	defer dstFile.Close()
+
 	nBytes, err := io.Copy(dstFile, srcFile)
 	if err != nil {
 		return fmt.Errorf("error copying file: %w", err)