k8s/agent-access: a namespace-limited service account and kubeconfig for a coding agent

Read-only by default, optional deploy role; no Secrets, exec, port-forward or RBAC. Tokens from kubectl create token, time-limited. Not applied. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
2026-10-19 09:49:20 +02:00
parent f0f4f57fee
commit 461f9d5578
8 changed files with 246 additions and 0 deletions
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Writes a kubeconfig for the mg4-agent service account, valid for a limited time.
+#
+#   k8s/agent-access/make-kubeconfig.sh [duration] [output]
+#
+# Run it yourself, with your own (admin) kubeconfig active. duration defaults to 24h; the API
+# server may cap it (--service-account-max-token-expiration). The token is written to the file
+# only, never printed.
+set -euo pipefail
+
+duration="${1:-24h}"
+out="${2:-$HOME/.config/nilsmg4/kubeconfig-mg4-agent}"
+
+cluster="$(kubectl config view --minify -o jsonpath='{.clusters[0].name}')"
+server="$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')"
+ca="$(kubectl config view --minify --raw -o jsonpath='{.clusters[0].cluster.certificate-authority-data}')"
+if [ -z "$ca" ]; then
+  ca_file="$(kubectl config view --minify --raw -o jsonpath='{.clusters[0].cluster.certificate-authority}')"
+  [ -n "$ca_file" ] || { echo "no cluster CA in the current kubeconfig" >&2; exit 1; }
+  ca="$(base64 -w0 < "$ca_file")"
+fi
+
+token="$(kubectl create token mg4-agent --namespace mg4 --duration "$duration")"
+
+mkdir -p "$(dirname "$out")"
+umask 077
+cat > "$out" <<KUBECONFIG
+apiVersion: v1
+kind: Config
+clusters:
+  - name: ${cluster}
+    cluster:
+      server: ${server}
+      certificate-authority-data: ${ca}
+users:
+  - name: mg4-agent
+    user:
+      token: ${token}
+contexts:
+  - name: mg4-agent
+    context:
+      cluster: ${cluster}
+      namespace: mg4
+      user: mg4-agent
+current-context: mg4-agent
+KUBECONFIG
+
+echo "Wrote $out (mode 600), token valid for $duration."
+echo "Check: KUBECONFIG=$out kubectl auth can-i --list"