mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-16 01:22:00 +00:00
joshsiv-mulga
ac069d8f37
cmd/eks-token-webhook keeps the -addr flag, environment-derived config, logging setup and exits; agents/eks/tokenwebhook owns Config and Run. The handlers/eks TokenReview result type stays as recorded temporary debt.
74 lines
2.2 KiB
Go
74 lines
2.2 KiB
Go
// Command eks-token-webhook is the K8s TokenReview webhook authenticator baked
|
|
// into the eks-server AMI; the implementation is in agents/eks/tokenwebhook.
|
|
// It reads its configuration from the first-boot env cloud-init seeds onto the
|
|
// VM and binds loopback only.
|
|
package main
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"flag"
|
|
"log/slog"
|
|
"os"
|
|
|
|
_ "github.com/mulgadc/bluebottle/pkg/fipsboot"
|
|
|
|
"github.com/mulgadc/spinifex/spinifex/agents/eks/tokenwebhook"
|
|
)
|
|
|
|
func loadConfig() (tokenwebhook.Config, error) {
|
|
c := tokenwebhook.Config{
|
|
Addr: flagAddr,
|
|
GatewayURL: os.Getenv("EKS_GATEWAY_URL"),
|
|
GatewayCA: os.Getenv("EKS_GATEWAY_CA"),
|
|
AccessKey: os.Getenv("EKS_ACCESS_KEY"),
|
|
SecretKey: os.Getenv("EKS_SECRET_KEY"),
|
|
Region: os.Getenv("EKS_REGION"),
|
|
AccountID: os.Getenv("EKS_ACCOUNT_ID"),
|
|
ClusterName: os.Getenv("EKS_CLUSTER_NAME"),
|
|
CertPath: envOr("EKS_WEBHOOK_CERT", "/etc/spinifex-eks/token-webhook.crt"),
|
|
KeyPath: envOr("EKS_WEBHOOK_KEY", "/etc/spinifex-eks/token-webhook.key"),
|
|
Kubeconfig: envOr("EKS_WEBHOOK_KUBECONFIG", "/etc/spinifex-eks/token-webhook.kubeconfig"),
|
|
}
|
|
// Static SigV4 creds are optional: when absent, eksgw.New signs with the
|
|
// AWS SDK chain (IMDS instance-role creds), the same path the CP VM's
|
|
// sibling helpers use. The CP VM launches on an instance profile, so
|
|
// buildK3sUserData omits EKS_ACCESS_KEY/EKS_SECRET_KEY by design.
|
|
switch {
|
|
case c.GatewayURL == "":
|
|
return c, errors.New("EKS_GATEWAY_URL not set")
|
|
case c.AccountID == "":
|
|
return c, errors.New("EKS_ACCOUNT_ID not set")
|
|
case c.ClusterName == "":
|
|
return c, errors.New("EKS_CLUSTER_NAME not set")
|
|
}
|
|
return c, nil
|
|
}
|
|
|
|
func envOr(key, def string) string {
|
|
if v := os.Getenv(key); v != "" {
|
|
return v
|
|
}
|
|
return def
|
|
}
|
|
|
|
var flagAddr string
|
|
|
|
func main() {
|
|
flag.StringVar(&flagAddr, "addr", "127.0.0.1:8443", "listen address (loopback only)")
|
|
flag.Parse()
|
|
|
|
slog.SetDefault(slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelInfo})))
|
|
|
|
cfg, err := loadConfig()
|
|
if err != nil {
|
|
slog.Error("eks-token-webhook config error", "err", err)
|
|
os.Exit(1)
|
|
}
|
|
|
|
if err := tokenwebhook.Run(context.Background(), cfg); err != nil {
|
|
slog.Error("eks-token-webhook fatal", "err", err)
|
|
os.Exit(1)
|
|
}
|
|
}
|