mirror of
https://github.com/kubeshark/kubeshark.git
synced 2026-07-10 09:00:15 +00:00
Provider.MintHubToken requests a short-lived token (audience kubeshark-hub) for the kubeshark-cli ServiceAccount via the TokenRequest API. The Hub client now prefers that token via the X-Kubeshark-Authorization custom header (which survives the kube API-server proxy), falling back to License-Key when minting isn't possible (--url mode, SA missing, or no RBAC to mint). The MCP runner mints once at startup. Pairs with hub branch cli-sa-auth. Needs the helm kubeshark-cli SA + RBAC and the hub AUTH_CLI_SERVICE_ACCOUNTS allowlist to validate end-to-end.