mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-15 17:11:30 +00:00
Josh Siviour
5aaf8c23d2
* feat(eks): webhook observability — console log sink + per-request TokenReview decision * fix(eks): wire token-webhook authenticator into generated k3s apiserver config The generated /etc/rancher/k3s/config.yaml overrides the AMI-baked config.yaml.skel, but its kube-apiserver-arg list omitted the authentication-token-webhook-config-file arg. The running apiserver therefore never loaded the token webhook, so bearer tokens minted by 'aws eks get-token' 401'd without the webhook ever being invoked. * fix(eks): echo TokenReview audiences so api-audiences apiserver accepts the principal With --api-audiences set, kube-apiserver sends spec.audiences in the TokenReview and discards an authenticated=true response that does not confirm a matching audience. The webhook returned an empty status.audiences, so a valid IAM principal surfaced as a 401. Echo the request's audiences on success. * fix(eks): pin token-webhook version v1 so apiserver accepts the response kube-apiserver --authentication-token-webhook-version defaults to v1beta1, but the eks-token-webhook responds with an authentication.k8s.io/v1 TokenReview. The apiserver decodes the response against the expected GVK and rejects the mismatch, surfacing a valid principal as a 401. Pin v1 to match the webhook.
35 lines
1.2 KiB
Go
35 lines
1.2 KiB
Go
package main
|
|
|
|
// Minimal authentication.k8s.io/v1 TokenReview wire types. Hand-rolled to avoid
|
|
// pulling k8s.io/api into the spinifex module for these few fields; the shapes
|
|
// match what kube-apiserver sends and expects on the webhook contract.
|
|
|
|
type tokenReview struct {
|
|
APIVersion string `json:"apiVersion"`
|
|
Kind string `json:"kind"`
|
|
Spec tokenReviewSpec `json:"spec,omitzero"`
|
|
Status tokenReviewStatus `json:"status"`
|
|
}
|
|
|
|
type tokenReviewSpec struct {
|
|
Token string `json:"token"`
|
|
Audiences []string `json:"audiences,omitempty"`
|
|
}
|
|
|
|
type tokenReviewStatus struct {
|
|
Authenticated bool `json:"authenticated"`
|
|
User userInfo `json:"user,omitzero"`
|
|
// Audiences echoes the request's spec.audiences on success. When the
|
|
// apiserver runs with --api-audiences, it sends spec.audiences and discards
|
|
// an authenticated=true response that does not confirm a matching audience —
|
|
// so an empty Audiences here surfaces as a 401 despite a valid principal.
|
|
Audiences []string `json:"audiences,omitempty"`
|
|
Error string `json:"error,omitempty"`
|
|
}
|
|
|
|
type userInfo struct {
|
|
Username string `json:"username,omitempty"`
|
|
UID string `json:"uid,omitempty"`
|
|
Groups []string `json:"groups,omitempty"`
|
|
}
|