OCPBUGS-11395: Remove stale kubeconfigs

pkg/cmd/init.go

@@ -33,6 +33,8 @@ import (
 	"github.com/openshift/microshift/pkg/util"
 	"github.com/openshift/microshift/pkg/util/cryptomaterial"
 	"github.com/openshift/microshift/pkg/util/cryptomaterial/certchains"
+
+	"k8s.io/klog/v2"
 )
 
 func initCerts(cfg *config.Config) (*certchains.CertificateChains, error) {
@@ -401,6 +403,10 @@ func initKubeconfigs(
 		}
 	}
 
+	if err := cleanupStaleKubeconfigs(cfg, cfg.KubeConfigRootAdminPath()); err != nil {
+		klog.Warningf("Unable to remove stale kubeconfigs: %v", err)
+	}
+
 	if err := util.KubeConfigWithClientCerts(
 		cfg.KubeConfigPath(config.KubeAdmin),
 		cfg.ApiServer.URL,
@@ -510,3 +516,30 @@ func certsToRegenerate(cs *certchains.CertificateChains) ([][]string, error) {
 
 	return regenCerts, err
 }
+
+func cleanupStaleKubeconfigs(cfg *config.Config, path string) error {
+	currentKubeconfigs := make(map[string]struct{})
+	for _, name := range append(cfg.ApiServer.SubjectAltNames, cfg.Node.HostnameOverride) {
+		currentKubeconfigs[name] = struct{}{}
+	}
+	files, err := os.ReadDir(path)
+	if err != nil {
+		return err
+	}
+	deleteDirs := make([]string, 0)
+	for _, file := range files {
+		if !file.IsDir() {
+			continue
+		}
+		if _, ok := currentKubeconfigs[file.Name()]; !ok {
+			deleteDirs = append(deleteDirs, filepath.Join(path, file.Name()))
+		}
+	}
+	for _, deletePath := range deleteDirs {
+		if err := os.RemoveAll(deletePath); err != nil {
+			klog.Warningf("Unable to remove %s: %v", deletePath, err)
+		}
+		klog.Infof("Removed stale kubeconfig %s", deletePath)
+	}
+	return nil
+}

pkg/cmd/init_test.go

@@ -16,9 +16,12 @@ limitations under the License.
 package cmd
 
 import (
+	"os"
+	"path/filepath"
 	"reflect"
 	"testing"
 
+	"github.com/openshift/microshift/pkg/config"
 	"github.com/openshift/microshift/pkg/util/cryptomaterial/certchains"
 	"github.com/stretchr/testify/require"
 	"k8s.io/apiserver/pkg/authentication/user"
@@ -126,6 +129,45 @@ func Test_certsToRegenerate(t *testing.T) {
 	}
 }
 
+func Test_removeStaleKubeconfig(t *testing.T) {
+	rootDir, err := os.MkdirTemp("", "test")
+	if err != nil {
+		t.Fatalf("unable to create temporary dir: %v", err)
+	}
+	defer os.RemoveAll(rootDir)
+
+	cfg := &config.Config{
+		Node: config.Node{
+			HostnameOverride: "hostname",
+		},
+		ApiServer: config.ApiServer{
+			SubjectAltNames: []string{"altname1", "altname2"},
+		},
+	}
+	for _, dir := range append(cfg.ApiServer.SubjectAltNames, cfg.Node.HostnameOverride) {
+		os.Mkdir(filepath.Join(rootDir, dir), 0600)
+	}
+
+	staleDir, err := os.MkdirTemp(rootDir, "example")
+	if err != nil {
+		t.Fatalf("unable to create temporary dir: %v", err)
+	}
+	cleanupStaleKubeconfigs(cfg, rootDir)
+	_, err = os.Stat(staleDir)
+	if err == nil {
+		t.Fatalf("%s should have been deleted", staleDir)
+	}
+	if !os.IsNotExist(err) {
+		t.Fatalf("unable to check %s existence: %v", staleDir, err)
+	}
+	for _, dir := range append(cfg.ApiServer.SubjectAltNames, cfg.Node.HostnameOverride) {
+		d := filepath.Join(rootDir, dir)
+		if _, err = os.Stat(d); err != nil {
+			t.Fatalf("dir %s should remain: %v", d, err)
+		}
+	}
+}
+
 func mustComplete(t *testing.T, cs certchains.CertificateChainsBuilder) *certchains.CertificateChains {
 	ret, err := cs.Complete()
 	require.NoError(t, err)

pkg/config/kubeconfig.go

@@ -20,5 +20,9 @@ func (cfg *Config) KubeConfigPath(id KubeConfigID) string {
 }
 
 func (cfg *Config) KubeConfigAdminPath(id string) string {
-	return filepath.Join(DataDir, "resources", string(KubeAdmin), id, "kubeconfig")
+	return filepath.Join(cfg.KubeConfigRootAdminPath(), id, "kubeconfig")
+}
+
+func (cfg *Config) KubeConfigRootAdminPath() string {
+	return filepath.Join(DataDir, "resources", string(KubeAdmin))
 }