|
| 1 | +package cluster |
| 2 | + |
| 3 | +import ( |
| 4 | + "context" |
| 5 | + "os" |
| 6 | + |
| 7 | + "github.com/golang-jwt/jwt/v5" |
| 8 | + "golang.org/x/oauth2" |
| 9 | + "knative.dev/pkg/logging" |
| 10 | +) |
| 11 | + |
| 12 | +var ( |
| 13 | + provider = &tokenSource{ |
| 14 | + path: "/var/run/secrets/kubernetes.io/serviceaccount/token", |
| 15 | + } |
| 16 | +) |
| 17 | + |
| 18 | +type tokenSource struct { |
| 19 | + path string |
| 20 | + |
| 21 | + token *oauth2.Token |
| 22 | + iss string |
| 23 | +} |
| 24 | + |
| 25 | +func (ts *tokenSource) Token() (*oauth2.Token, error) { |
| 26 | + if ts.token.Valid() { |
| 27 | + return ts.token, nil |
| 28 | + } |
| 29 | + b, err := os.ReadFile(ts.path) |
| 30 | + if err != nil { |
| 31 | + return nil, err |
| 32 | + } |
| 33 | + ts.token = &oauth2.Token{ |
| 34 | + AccessToken: string(b), |
| 35 | + } |
| 36 | + |
| 37 | + return ts.token, nil |
| 38 | +} |
| 39 | + |
| 40 | +func (ts *tokenSource) Issuer(ctx context.Context) string { |
| 41 | + log := logging.FromContext(ctx) |
| 42 | + |
| 43 | + if ts.token.Valid() && ts.iss != "" { |
| 44 | + return ts.iss |
| 45 | + } |
| 46 | + |
| 47 | + oauth, err := ts.Token() |
| 48 | + if err != nil { |
| 49 | + log.Errorf("failed to get cluster token: %v", err) |
| 50 | + return "" |
| 51 | + } |
| 52 | + |
| 53 | + // We're assuming that in order to place a token in the path |
| 54 | + // you already have some amount of privilege. |
| 55 | + // While we don't know if the token is actually real, even if we |
| 56 | + // wanted to verify it against the api server we'd need to trust |
| 57 | + // the cacert bundle also included in this same path, so trusting |
| 58 | + // the token is correctly set by the Kubernetes cluster is |
| 59 | + // likely a reasonable compromise. |
| 60 | + parser := jwt.NewParser() |
| 61 | + claims := new(jwt.RegisteredClaims) |
| 62 | + if _, _, err := parser.ParseUnverified(oauth.AccessToken, claims); err != nil { |
| 63 | + log.Errorf("failed to parse cluster token: %v", err) |
| 64 | + return "" |
| 65 | + } |
| 66 | + |
| 67 | + ts.iss = claims.Issuer |
| 68 | + return claims.Issuer |
| 69 | +} |
| 70 | + |
| 71 | +// BuilderID returns a builder ID that the current cluster. |
| 72 | +// To approximate this, we use the cluster token issuer as defined by |
| 73 | +// the controller's default service account token. |
| 74 | +// See https://kubernetes.io/docs/tasks/run-application/access-api-from-pod/#directly-accessing-the-rest-api for more details. |
| 75 | +// This will be change depending on where/how the cluster is running. |
| 76 | +// |
| 77 | +// Some examples: |
| 78 | +// - GKE: https://containers.googleapis.com/v1/projects/123456789012/locations/us-east1/clusters/cluster-1 |
| 79 | +// - EKS: https://oidc.eks.us-east-1.amazonaws.com/id/12345678901234567890123456789012 |
| 80 | +// - AKS: https://eastus.oic.prod-aks.azure.com/00000000-0000-0000-0000-000000000000/00000000-0000-0000-0000-000000000000/ |
| 81 | +// - Kind/Local: https://kubernetes.default.svc (NOTE: this isn't a real URL and won't give you much useful information) |
| 82 | +func BuilderID(ctx context.Context) string { |
| 83 | + return provider.Issuer(ctx) |
| 84 | +} |
0 commit comments