mirror of
https://github.com/kubeshark/kubeshark.git
synced 2026-07-13 02:20:15 +00:00
7c67abc3fd
Provider.MintHubToken requests a short-lived token (audience kubeshark-hub) for the kubeshark-cli ServiceAccount via the TokenRequest API. The Hub client now prefers that token via the X-Kubeshark-Authorization custom header (which survives the kube API-server proxy), falling back to License-Key when minting isn't possible (--url mode, SA missing, or no RBAC to mint). The MCP runner mints once at startup. Pairs with hub branch cli-sa-auth. Needs the helm kubeshark-cli SA + RBAC and the hub AUTH_CLI_SERVICE_ACCOUNTS allowlist to validate end-to-end.
45 lines
1.4 KiB
Go
45 lines
1.4 KiB
Go
package kubernetes
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
authenticationv1 "k8s.io/api/authentication/v1"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
)
|
|
|
|
const (
|
|
// HubTokenAudience must match the hub's internalauth TokenAudience.
|
|
HubTokenAudience = "kubeshark-hub"
|
|
// CLIServiceAccountName is the ServiceAccount the CLI mints a token for;
|
|
// must match the SA the helm chart creates and the hub's
|
|
// AUTH_CLI_SERVICE_ACCOUNTS allowlist.
|
|
CLIServiceAccountName = "kubeshark-cli"
|
|
|
|
hubTokenExpirySeconds = 3600
|
|
)
|
|
|
|
// MintHubToken requests a short-lived ServiceAccount token (audience
|
|
// HubTokenAudience) for the CLI ServiceAccount via the TokenRequest API. The
|
|
// hub validates it with TokenReview and maps the SA to a role. The caller's
|
|
// kube RBAC must permit `create` on serviceaccounts/token for that SA — which
|
|
// is what gates who may use the CLI against a gated Hub.
|
|
func (provider *Provider) MintHubToken(ctx context.Context, namespace string) (string, error) {
|
|
exp := int64(hubTokenExpirySeconds)
|
|
tr, err := provider.clientSet.CoreV1().ServiceAccounts(namespace).CreateToken(
|
|
ctx,
|
|
CLIServiceAccountName,
|
|
&authenticationv1.TokenRequest{
|
|
Spec: authenticationv1.TokenRequestSpec{
|
|
Audiences: []string{HubTokenAudience},
|
|
ExpirationSeconds: &exp,
|
|
},
|
|
},
|
|
metav1.CreateOptions{},
|
|
)
|
|
if err != nil {
|
|
return "", fmt.Errorf("minting hub token for serviceaccount %s/%s: %w", namespace, CLIServiceAccountName, err)
|
|
}
|
|
return tr.Status.Token, nil
|
|
}
|