2 Commits

Author	SHA1	Message	Date
Josh Siviour	bfacca7789	feat(eks): 6c token webhook + AccessEntry (IAM auth → kubectl) (#284) ... * feat(eks): 6c AccessEntry CRUD + access-policy association Replace the nine notImpl() AccessEntry/AccessPolicy stubs with real KV-backed handlers (Q9, API auth mode): - AccessEntry CRUD persisted at clusters/{name}/access-entries/{hash}; the principal ARN is hashed into the key (ARNs carry ':', illegal in NATS KV keys) while the record keeps the plaintext ARN. - AssociateAccessPolicy/Disassociate/ListAssociated against the four supported AWS-managed policies; unsupported policy ARN or bad access scope -> InvalidParameterValue. - ListAccessPolicies returns the static supported catalogue. - Cluster-existence gate -> ResourceNotFoundException; duplicate create -> ResourceInUseException; node-type entries rejected until 6d. Updates the daemon routing test for the now-implemented handlers. * feat(eks): plumb caller principal ARN + bootstrap-creator-admin Thread the caller's resolved IAM principal ARN from the gateway to the EKS control plane via a new X-Principal-ARN NATS header, so CreateCluster can mint the bootstrapClusterCreatorAdminPermissions AccessEntry (Q9): - utils.NATSRequest takes optional extra headers; PrincipalARNHeader + PrincipalARNFromMsg added. - Gateway resolves the caller ARN best-effort (buildCallerARN) and passes it down the EKS route table; only CreateCluster consumes it. - CreateCluster signature gains callerPrincipalARN; default-true bootstrap flag mints a system:masters entry keyed by the caller's exact ARN (the token webhook resolves the same ARN from STS). '' degrades gracefully. - Dedicated daemon handler reads both headers. * feat(eks): IAM token webhook + STS verify-over-NATS + apiserver wiring The eks-token-webhook (baked into the eks-server AMI) authenticates kubectl requests that present an `aws eks get-token` bearer token: decode the presigned STS GetCallerIdentity URL, verify it, resolve the principal ARN to its cluster AccessEntry, and answer the apiserver TokenReview with the mapped username + groups. STS is hosted in-process in the awsgw service and is not otherwise on the bus, so awsgw now serves an `eks.VerifyToken` NATS subject that wraps VerifyPresignedGetCallerIdentity (the cluster name is forwarded so STS enforces the x-k8s-aws-id anti-replay pin). The webhook reads the AccessEntry KV directly over its own NATS connection. Apiserver wiring: the k3s config skeleton sets authentication-token-webhook-config-file; the webhook writes its own self-signed serving cert + the apiserver kubeconfig at startup (ordered `before k3s`, with a bounded wait in the k3s start_pre so the apiserver never loads a missing file). * fix(eks): omit empty spec from token webhook TokenReview response * fix(sts): presigned GetCallerIdentity must hash empty body, not UNSIGNED-PAYLOAD VerifyPresignedGetCallerIdentity built the SigV4 canonical request with "UNSIGNED-PAYLOAD" as the payload hash. That is an S3-only convention; botocore and the aws-sdk presign non-S3 requests (sts:GetCallerIdentity, the shape `aws eks get-token` produces) with the SHA256 of the empty string. Every real get-token therefore failed signature verification with InvalidIdentityToken, breaking the entire EKS IAM token-auth flow end to end. Use the empty-string SHA256. The existing hand-rolled presign tests masked the bug by signing with the same wrong constant; they now sign correctly, and a new test presigns with the real aws-sdk-go v4 signer (the same canonicalisation the CLI uses) so this can't regress silently. Verified live: a real `aws eks get-token --cluster-name dev1` now resolves to the caller principal over the awsgw eks.VerifyToken surface; an otherwise-valid token presented for a different cluster is still rejected (anti-replay intact). * fix(eks): match access-entry routes on escaped path so slashed principal ARNs resolve IAM principal ARNs (user/admin, role/foo) embed a '/' that the AWS CLI percent-encodes in the request path. The dispatcher matched r.URL.Path (decoded), so %2F became a literal '/' and split the ARN across the ([^/]+) capture, dropping every describe/update/delete-access-entry and associate/disassociate/list-access-policy call to InvalidActionException. Match r.URL.EscapedPath() so the encoded ARN stays one segment, then url.PathUnescape each captured param before it reaches the handler. * test(eks): unit-cover access-entry scope validation, AWS converters, store guards	2026-06-04 11:25:56 +10:00
Josh Siviour	8883984f3f	feat(eks): eks-server + eks-agent AMI manifests (#273) ... * feat(eks): eks-server + eks-agent AMI manifests + builder INSTALL_FILES Manifest-driven AMI build for the two EKS image variants (eks-v1.md Q12). Lifted forward from cs-eks-6b so the K3s boot path can be smoke-tested in isolation before CreateCluster orchestration lands. Builder: - build-system-image.sh gains optional INSTALL_FILES (src:dst pairs, mode 0644, parent dirs auto-created). Symmetric with INSTALL_BINARIES. - ENABLE_SERVICES moves after INSTALL_FILES + SETUP_SCRIPT so init scripts the manifest references are on disk before rc-update enables them. eks-server image (Alpine 3.21.7, q35, 4G): - K3s v1.32.5+k3s1 (downloaded at bake time, SHA256 verified against the upstream sha256sum-amd64.txt trust anchor). - nats-cli v0.4.0 (not in Alpine main/community — pulled from upstream release zip; unzip installed + purged in same setup step). - OpenRC init scripts: k3s, eks-token-webhook, k3s-first-boot. - Cron periodics under /etc/periodic/{15min,daily}/ for state-report + etcd-snapshot. - k3s-first-boot publishes node-token + admin kubeconfig over NATS on first successful K3s healthz, then self-disables (sentinel + rc-update del). - config.yaml.skel without webhook-token-auth — wiring it before the real webhook lands (cs-eks-6c) would block anonymous probes against /healthz. Orchestrator drops the live config + restarts k3s. eks-agent image (Alpine 3.21.7, q35, 2G): - Same pinned K3s release for server/agent lock-step. - k3s-agent OpenRC service refuses to start without K3S_URL+K3S_TOKEN — fail-closed pre-orchestration. eks-token-webhook stub (cmd/eks-token-webhook/main.go): - 503 + Retry-After:30 on every path. Statically linked. Lets the AMI build succeed and kube-apiserver boot cleanly. Replaced wholesale by cs-eks-6c. Init system divergence from spec wording: Alpine ships OpenRC, not systemd. Unit files use .initd extensions and cron periodics instead of .service / .timer. Bead-level intent (auto-enable on boot, periodic execution) preserved. Smoke-tested: - eks-server: builds 300M qcow2; qemu q35 boot reaches K3s apiserver on 6443 within ~120s; HTTPS probes return valid k8s Status JSON (the 401 is K3s v1.32 default RBAC behaviour against anonymous, not a regression). - eks-agent: builds 280M qcow2; qemu boot mounts root cleanly. * feat(eks): make targets for eks-server + eks-agent AMI builds - build-system-image gains subdir-manifest fallback: tries scripts/images/$(IMAGE).conf first, then scripts/images/$(IMAGE)/manifest.conf so the new EKS layout works alongside the existing flat lb manifest. - build-eks-server-image / build-eks-agent-image — explicit convenience targets that delegate to the generic one.	2026-06-01 16:24:49 +10:00