-
Notifications
You must be signed in to change notification settings - Fork 29
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #218 from jahzielHA/issue-204-bound-service-account
Issue 204 - Bound tokens for incluster configuration
- Loading branch information
Showing
10 changed files
with
248 additions
and
33 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -32,4 +32,8 @@ skuber { | |
| # reclaim the unused resources. | ||
| pool-idle-timeout = 30s | ||
| } | ||
|
|
||
| in-cluster { | ||
| refresh-token-interval = 5m | ||
| } | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
61 changes: 61 additions & 0 deletions
61
client/src/main/scala/skuber/api/client/token/FileTokenAuthRefreshable.scala
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| package skuber.api.client.token | ||
|
|
||
| import org.joda.time.DateTime | ||
| import skuber.K8SException | ||
| import skuber.api.client.{AuthProviderRefreshableAuth, Status} | ||
|
|
||
| import scala.concurrent.duration.{Duration, DurationInt} | ||
| import scala.util.{Failure, Success} | ||
|
|
||
| final case class FileTokenAuthRefreshable(config: FileTokenConfiguration) extends TokenAuthRefreshable with FileReaderComponent {} | ||
|
|
||
| final case class FileTokenConfiguration( | ||
| cachedAccessToken: Option[String], | ||
| tokenPath: String, | ||
| refreshInterval: Duration = 5.minutes, | ||
| ) | ||
|
|
||
| trait TokenAuthRefreshable extends AuthProviderRefreshableAuth { self: ContentReaderComponent => | ||
| val config: FileTokenConfiguration | ||
|
|
||
| private val refreshInterval: Duration = config.refreshInterval | ||
| @volatile private var cachedToken: Option[RefreshableToken] = config.cachedAccessToken.map(buildRefreshableToken) | ||
|
|
||
| private val tokenPath: String = config.tokenPath | ||
|
|
||
| override def name: String = "file-token" | ||
| override def toString: String = """FileTokenAuthRefreshable(accessToken=<redacted>)""".stripMargin | ||
|
|
||
| override def refreshToken: RefreshableToken = { | ||
| val refreshedToken = buildRefreshableToken(generateToken) | ||
| cachedToken = Some(refreshedToken) | ||
| refreshedToken | ||
| } | ||
|
|
||
| override def generateToken: String = { | ||
| val maybeToken = contentReader.read(tokenPath) | ||
| maybeToken match { | ||
| case Success(token) => token | ||
| case Failure(e) => throw new K8SException(Status(reason = Option(e.getMessage))) | ||
| } | ||
| } | ||
|
|
||
| override def isTokenExpired(refreshableToken: RefreshableToken): Boolean = | ||
| refreshableToken.expiry.isBefore(System.currentTimeMillis) | ||
|
|
||
| override def accessToken: String = this.synchronized { | ||
| cachedToken match { | ||
| case Some(token) if isTokenExpired(token) => | ||
| refreshToken.accessToken | ||
| case None => | ||
| refreshToken.accessToken | ||
| case Some(token) => | ||
| token.accessToken | ||
| } | ||
| } | ||
|
|
||
| private def buildRefreshableToken(accessToken: String): RefreshableToken = { | ||
| RefreshableToken(accessToken, DateTime.now.plus(refreshInterval.toMillis)) | ||
| } | ||
| } | ||
|
|
26 changes: 26 additions & 0 deletions
26
client/src/main/scala/skuber/api/client/token/package.scala
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| package skuber.api.client | ||
|
|
||
| import scala.io.Source | ||
| import scala.util.Try | ||
|
|
||
| package object token { | ||
| trait ContentReaderComponent { | ||
| val contentReader: ContentReader | ||
|
|
||
| trait ContentReader { | ||
| def read(filePath: String): Try[String] | ||
| } | ||
| } | ||
|
|
||
| trait FileReaderComponent extends ContentReaderComponent { | ||
| val contentReader: ContentReader = new FileContentReader | ||
|
|
||
| class FileContentReader extends ContentReader { | ||
| def read(filePath: String): Try[String] = for { | ||
| source <- Try(Source.fromFile(filePath, "utf-8")) | ||
| content <- Try(source.getLines().mkString("\n")) | ||
| _ <- Try(source.close()) | ||
| } yield content | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| package skuber.config | ||
|
|
||
| import com.typesafe.config.{Config, ConfigFactory} | ||
| import skuber.config.SkuberConfig.skuberKeyPath | ||
|
|
||
| import scala.concurrent.duration.Duration | ||
|
|
||
| case class SkuberConfig(appConfig: Config) { | ||
| def getSkuberConfig[T](key: String, fromConfig: String => Option[T], default: T): T = { | ||
| val skuberConfigKey = s"$skuberKeyPath.$key" | ||
| if (appConfig.getIsNull(skuberConfigKey)) { | ||
| default | ||
| } else { | ||
| fromConfig(skuberConfigKey) match { | ||
| case None => default | ||
| case Some(t) => t | ||
| } | ||
| } | ||
| } | ||
|
|
||
| def getDuration(configKey: String, default: Duration = Duration.Inf): Duration = getSkuberConfig(configKey, durationFromConfig, default) | ||
| def durationFromConfig(configKey: String): Option[Duration] = Some(Duration.fromNanos(appConfig.getDuration(configKey).toNanos)) | ||
| } | ||
|
|
||
| object SkuberConfig { | ||
| final val skuberKeyPath = "skuber" | ||
|
|
||
| def load(appConfig: Config = ConfigFactory.load()): SkuberConfig = { | ||
| appConfig.checkValid(ConfigFactory.defaultReference(), skuberKeyPath) | ||
| SkuberConfig(appConfig) | ||
| } | ||
| } |
42 changes: 42 additions & 0 deletions
42
client/src/test/scala/skuber/api/client/token/FileTokenAuthRefreshableSpec.scala
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| package skuber.api.client.token | ||
|
|
||
| import org.joda.time.DateTime | ||
| import org.specs2.mutable.Specification | ||
|
|
||
| import scala.concurrent.duration.DurationInt | ||
| import scala.util.Try | ||
|
|
||
| class FileTokenAuthRefreshableSpec extends Specification { | ||
| "This is a specification for the 'FileTokenAuthRefreshable' class".txt | ||
|
|
||
| trait MockFileReaderComponent extends ContentReaderComponent { | ||
| val contentReader: ContentReader = new MockFileReaderComponent | ||
|
|
||
| class MockFileReaderComponent extends ContentReader { | ||
| def read(filePath: String): Try[String] = Try(DateTime.now.toString()) | ||
| } | ||
| } | ||
|
|
||
| final case class MockFileTokenAuthRefreshable(config: FileTokenConfiguration) extends TokenAuthRefreshable with MockFileReaderComponent {} | ||
|
|
||
| "FileTokenAuthRefreshable" should { | ||
| "Retrieve the token if none provided" in { | ||
| val initialToken : Option[String] = None | ||
| val fileTokenRefreshable = MockFileTokenAuthRefreshable(FileTokenConfiguration(cachedAccessToken = initialToken, tokenPath = "/tmp/token", refreshInterval = 100.milliseconds)) | ||
| fileTokenRefreshable.accessToken.nonEmpty must beTrue | ||
| } | ||
|
|
||
| "Refresh the token after the refresh interval" in { | ||
| val initialToken = "cachedToken" | ||
| val fileTokenRefreshable = MockFileTokenAuthRefreshable(FileTokenConfiguration(Some(initialToken), "/tmp/token", 100.milliseconds)) | ||
| fileTokenRefreshable.accessToken shouldEqual initialToken | ||
|
|
||
| Thread.sleep(150) | ||
| val refreshed = fileTokenRefreshable.accessToken | ||
| refreshed shouldNotEqual initialToken | ||
|
|
||
| Thread.sleep(150) | ||
| fileTokenRefreshable.accessToken shouldNotEqual refreshed | ||
| } | ||
| } | ||
| } |
43 changes: 43 additions & 0 deletions
43
client/src/test/scala/skuber/config/SkuberConfigSpec.scala
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| package skuber.config | ||
|
|
||
| import com.typesafe.config.ConfigFactory | ||
| import org.specs2.mutable.Specification | ||
|
|
||
| import scala.concurrent.duration.{Duration, DurationInt} | ||
|
|
||
| class SkuberConfigSpec extends Specification { | ||
| "This is a specification for the 'SkuberConfigSpec' class".txt | ||
|
|
||
| "SkuberConfig" should { | ||
| "in-cluster" should { | ||
| "refresh token interval defaults to 5 min if no configuration provided" in { | ||
| val refreshTokenInterval = SkuberConfig.load().getDuration("in-cluster.refresh-token-interval") | ||
| refreshTokenInterval shouldEqual 5.minutes | ||
| } | ||
|
|
||
| "refresh token interval value provided by the configuration" in { | ||
| val appConfig = ConfigFactory.parseString( | ||
| """ | ||
| |skuber.in-cluster.refresh-token-interval = 100ms | ||
| """.stripMargin) | ||
| .withFallback(ConfigFactory.load()) | ||
|
|
||
| val refreshTokenInterval = SkuberConfig.load(appConfig).getDuration("in-cluster.refresh-token-interval") | ||
| refreshTokenInterval shouldEqual 100.milliseconds | ||
| } | ||
| } | ||
| "watch-continuously" should { | ||
| "defaults are provided" in { | ||
| val skuberConfig = SkuberConfig.load() | ||
| val watchContinuouslyRequestTimeout: Duration = skuberConfig.getDuration("watch-continuously.request-timeout") | ||
| watchContinuouslyRequestTimeout shouldEqual 30.seconds | ||
|
|
||
| val watchContinuouslyIdleTimeout: Duration = skuberConfig.getDuration("watch-continuously.idle-timeout") | ||
| watchContinuouslyIdleTimeout shouldEqual 60.seconds | ||
|
|
||
| val watchPoolIdleTimeout: Duration = skuberConfig.getDuration("watch-continuously.pool-idle-timeout") | ||
| watchPoolIdleTimeout shouldEqual 30.seconds | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters