mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-15 17:11:30 +00:00
Josh Siviour
5aaf8c23d2
* feat(eks): webhook observability — console log sink + per-request TokenReview decision * fix(eks): wire token-webhook authenticator into generated k3s apiserver config The generated /etc/rancher/k3s/config.yaml overrides the AMI-baked config.yaml.skel, but its kube-apiserver-arg list omitted the authentication-token-webhook-config-file arg. The running apiserver therefore never loaded the token webhook, so bearer tokens minted by 'aws eks get-token' 401'd without the webhook ever being invoked. * fix(eks): echo TokenReview audiences so api-audiences apiserver accepts the principal With --api-audiences set, kube-apiserver sends spec.audiences in the TokenReview and discards an authenticated=true response that does not confirm a matching audience. The webhook returned an empty status.audiences, so a valid IAM principal surfaced as a 401. Echo the request's audiences on success. * fix(eks): pin token-webhook version v1 so apiserver accepts the response kube-apiserver --authentication-token-webhook-version defaults to v1beta1, but the eks-token-webhook responds with an authentication.k8s.io/v1 TokenReview. The apiserver decodes the response against the expected GVK and rejects the mismatch, surfacing a valid principal as a 401. Pin v1 to match the webhook.
40 lines
1.6 KiB
Plaintext
Executable File
40 lines
1.6 KiB
Plaintext
Executable File
#!/sbin/openrc-run
|
|
# eks-token-webhook — K8s TokenReview authenticator for IAM-backed kubectl.
|
|
# Binds 127.0.0.1:8443 only; kube-apiserver is the sole client (loopback path).
|
|
# Decodes `aws eks get-token` presigned URLs, verifies them via Mulga STS over
|
|
# NATS, and resolves the principal to a TokenReview via the cluster AccessEntry
|
|
# KV. Ordered `before k3s` so its apiserver kubeconfig exists before k3s reads
|
|
# --authentication-token-webhook-config-file.
|
|
|
|
description="EKS Token Review webhook (Mulga)"
|
|
command="/usr/local/bin/eks-token-webhook"
|
|
command_args="--addr=127.0.0.1:8443"
|
|
command_background="yes"
|
|
pidfile="/run/eks-token-webhook.pid"
|
|
# Headless appliance: no SSH. Route the webhook's stdout/stderr to the serial
|
|
# console so its startup + per-request decisions land in the host-captured
|
|
# console log (the only off-VM window into webhook health).
|
|
output_log="/dev/console"
|
|
error_log="/dev/console"
|
|
|
|
# NATS creds + cluster identity come from the cloud-init-seeded first-boot env.
|
|
# Sourced here and exported so start-stop-daemon hands them to the binary, which
|
|
# reads SPINIFEX_NATS_* / EKS_ACCOUNT_ID / EKS_CLUSTER_NAME from its environment.
|
|
if [ -f /etc/spinifex-eks/first-boot.env ]; then
|
|
# shellcheck disable=SC1091
|
|
. /etc/spinifex-eks/first-boot.env
|
|
export SPINIFEX_NATS_URL SPINIFEX_NATS_TOKEN SPINIFEX_NATS_CA EKS_ACCOUNT_ID EKS_CLUSTER_NAME
|
|
fi
|
|
|
|
depend() {
|
|
need net
|
|
before k3s
|
|
}
|
|
|
|
start_pre() {
|
|
if [ ! -f /etc/spinifex-eks/first-boot.env ]; then
|
|
eerror "/etc/spinifex-eks/first-boot.env not present — cloud-init did not seed NATS creds"
|
|
return 1
|
|
fi
|
|
}
|