mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-11-06 19:01:10 +00:00
Josh Siviour
acfa078586
* feat: add a gateway readiness endpoint to the EKS token webhook * feat: serve token webhook readiness beyond loopback and admit it to the control-plane SG * feat: health-check the EKS apiserver target group on the token webhook readiness port * style: order the strconv import * fix: export the readiness listener address to the EKS token webhook * docs: regenerate the ELB coverage README * docs: describe EKS control plane readiness and what happens when a gateway stops * test: range over SplitSeq in the webhook initd guard
42 lines
1.8 KiB
Plaintext
Executable File
42 lines
1.8 KiB
Plaintext
Executable File
#!/sbin/openrc-run
|
|
# eks-token-webhook — K8s TokenReview authenticator for IAM-backed kubectl.
|
|
# Binds 127.0.0.1:8443 only; kube-apiserver is the sole client (loopback path).
|
|
# Relays `aws eks get-token` bearer tokens through the AWS gateway broker (SigV4
|
|
# HTTPS), which host-side verifies via Mulga STS + resolves the principal to a
|
|
# TokenReview via the cluster AccessEntry KV — the VM never speaks core NATS.
|
|
# Ordered `before k3s` so its apiserver kubeconfig exists before k3s reads
|
|
# --authentication-token-webhook-config-file.
|
|
|
|
description="EKS Token Review webhook (Mulga)"
|
|
command="/usr/local/bin/eks-token-webhook"
|
|
command_args="--addr=127.0.0.1:8443"
|
|
command_background="yes"
|
|
pidfile="/run/eks-token-webhook.pid"
|
|
# Headless appliance: no SSH. Route the webhook's stdout/stderr to the serial
|
|
# console so its startup + per-request decisions land in the host-captured
|
|
# console log (the only off-VM window into webhook health).
|
|
output_log="/dev/console"
|
|
error_log="/dev/console"
|
|
|
|
# Gateway endpoint + SigV4 creds + cluster identity come from the cloud-init-
|
|
# seeded first-boot env. Sourced here and exported so start-stop-daemon hands
|
|
# them to the binary, which reads EKS_GATEWAY_* / EKS_ACCESS_KEY / EKS_SECRET_KEY
|
|
# / EKS_REGION / EKS_ACCOUNT_ID / EKS_CLUSTER_NAME from its environment.
|
|
if [ -f /etc/spinifex-eks/first-boot.env ]; then
|
|
# shellcheck disable=SC1091
|
|
. /etc/spinifex-eks/first-boot.env
|
|
export EKS_GATEWAY_URL EKS_GATEWAY_CA EKS_ACCESS_KEY EKS_SECRET_KEY EKS_REGION EKS_ACCOUNT_ID EKS_CLUSTER_NAME EKS_WEBHOOK_READY_ADDR
|
|
fi
|
|
|
|
depend() {
|
|
need net
|
|
before k3s
|
|
}
|
|
|
|
start_pre() {
|
|
if [ ! -f /etc/spinifex-eks/first-boot.env ]; then
|
|
eerror "/etc/spinifex-eks/first-boot.env not present — cloud-init did not seed gateway creds"
|
|
return 1
|
|
fi
|
|
}
|