From 22acdf745db44a25b68b53fd7eb514e2816b3c4a Mon Sep 17 00:00:00 2001 From: Thomas Kooi Date: Fri, 10 Jul 2026 14:47:31 +0200 Subject: [PATCH] feat(kubernetes): support session lifetime for kubeconfig tokens Signed-off-by: Thomas Kooi --- cmd/kubernetes/kubeconfig.go | 17 +++++++++++++++-- go.mod | 2 +- go.sum | 4 ++-- internal/kubernetes/auth/credential.go | 5 ++++- 4 files changed, 22 insertions(+), 6 deletions(-) diff --git a/cmd/kubernetes/kubeconfig.go b/cmd/kubernetes/kubeconfig.go index 9920c47..57ffb1e 100644 --- a/cmd/kubernetes/kubeconfig.go +++ b/cmd/kubernetes/kubeconfig.go @@ -3,6 +3,7 @@ package kubernetes import ( "fmt" "os" + "time" "github.com/spf13/cobra" @@ -10,9 +11,13 @@ import ( "github.com/thalassa-cloud/cli/internal/kuberesolve" kubeconfigrender "github.com/thalassa-cloud/cli/internal/kubernetes/kubeconfig" "github.com/thalassa-cloud/cli/internal/thalassaclient" + "github.com/thalassa-cloud/client-go/kubernetes" ) -var kubeconfigInlineToken bool +var ( + kubeconfigInlineToken bool + kubeconfigSessionLifetime time.Duration +) var KubernetesKubeConfigCmd = &cobra.Command{ Use: "kubeconfig", @@ -31,8 +36,15 @@ var KubernetesKubeConfigCmd = &cobra.Command{ return err } + if !kubeconfigInlineToken { + // expire the session token immediately, we don't use it in this call, it's fetched by the credentials exec plugin + kubeconfigSessionLifetime = 1 * time.Second + } + fmt.Fprintf(os.Stderr, "Getting kubeconfig for cluster %s\n", cluster.Name) - session, err := client.Kubernetes().GetKubernetesClusterKubeconfig(ctx, cluster.Identity) + session, err := client.Kubernetes().GetKubernetesClusterKubeconfigWithParams(ctx, cluster.Identity, kubernetes.KubeconfigParams{ + SessionLifetime: kubeconfigSessionLifetime, + }) if err != nil { return err } @@ -55,4 +67,5 @@ var KubernetesKubeConfigCmd = &cobra.Command{ func init() { KubernetesCmd.AddCommand(KubernetesKubeConfigCmd) KubernetesKubeConfigCmd.Flags().BoolVar(&kubeconfigInlineToken, "inline-token", false, "embed the session token in the kubeconfig instead of using a kubectl exec credential plugin") + KubernetesKubeConfigCmd.Flags().DurationVar(&kubeconfigSessionLifetime, "session-lifetime", 4*7*24*time.Hour, "Lifetime of the kubeconfig session token. Defaults to 4 weeks.") } diff --git a/go.mod b/go.mod index 966a580..ba0dd25 100644 --- a/go.mod +++ b/go.mod @@ -11,7 +11,7 @@ require ( github.com/olekukonko/tablewriter v0.0.5 github.com/spf13/cobra v1.10.2 github.com/stretchr/testify v1.11.1 - github.com/thalassa-cloud/client-go v0.35.1 + github.com/thalassa-cloud/client-go v0.35.3 github.com/zalando/go-keyring v0.2.8 golang.org/x/oauth2 v0.36.0 gopkg.in/yaml.v3 v3.0.1 diff --git a/go.sum b/go.sum index 4281ea2..2ddcf0a 100644 --- a/go.sum +++ b/go.sum @@ -58,8 +58,8 @@ github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/ github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= -github.com/thalassa-cloud/client-go v0.35.1 h1:1ShdYmp0hgtW1Zq6byzIwPsOp2C/tEJ7lFo4+L2FR78= -github.com/thalassa-cloud/client-go v0.35.1/go.mod h1:fKtWPWd8fzA/HvNEO1b/5CJ3de4f99RJuZmAgsZaEzc= +github.com/thalassa-cloud/client-go v0.35.3 h1:H6yn/ma+DhLCCaWcSUEqUyJDfKX3r90Al5R7mGYkVgw= +github.com/thalassa-cloud/client-go v0.35.3/go.mod h1:fKtWPWd8fzA/HvNEO1b/5CJ3de4f99RJuZmAgsZaEzc= github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= github.com/zalando/go-keyring v0.2.8 h1:6sD/Ucpl7jNq10rM2pgqTs0sZ9V3qMrqfIIy5YPccHs= diff --git a/internal/kubernetes/auth/credential.go b/internal/kubernetes/auth/credential.go index fae643f..7748def 100644 --- a/internal/kubernetes/auth/credential.go +++ b/internal/kubernetes/auth/credential.go @@ -8,6 +8,7 @@ import ( "os" "time" + "github.com/thalassa-cloud/client-go/kubernetes" "github.com/thalassa-cloud/client-go/thalassa" ) @@ -26,7 +27,9 @@ type execCredentialStatus struct { // WriteExecCredential fetches a cluster session token and writes kubectl ExecCredential JSON. func WriteExecCredential(ctx context.Context, client thalassa.Client, clusterIdentity string, out io.Writer) error { - session, err := client.Kubernetes().GetKubernetesClusterKubeconfig(ctx, clusterIdentity) + session, err := client.Kubernetes().GetKubernetesClusterKubeconfigWithParams(ctx, clusterIdentity, kubernetes.KubeconfigParams{ + SessionLifetime: 5 * time.Minute, + }) if err != nil { return err }