nilsandClaude Opus 5.5
461f9d5578
Read-only by default, optional deploy role; no Secrets, exec, port-forward or RBAC. Tokens from kubectl create token, time-limited. Not applied. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
50 lines
1.6 KiB
Bash
Executable File
50 lines
1.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Writes a kubeconfig for the mg4-agent service account, valid for a limited time.
|
|
#
|
|
# k8s/agent-access/make-kubeconfig.sh [duration] [output]
|
|
#
|
|
# Run it yourself, with your own (admin) kubeconfig active. duration defaults to 24h; the API
|
|
# server may cap it (--service-account-max-token-expiration). The token is written to the file
|
|
# only, never printed.
|
|
set -euo pipefail
|
|
|
|
duration="${1:-24h}"
|
|
out="${2:-$HOME/.config/nilsmg4/kubeconfig-mg4-agent}"
|
|
|
|
cluster="$(kubectl config view --minify -o jsonpath='{.clusters[0].name}')"
|
|
server="$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')"
|
|
ca="$(kubectl config view --minify --raw -o jsonpath='{.clusters[0].cluster.certificate-authority-data}')"
|
|
if [ -z "$ca" ]; then
|
|
ca_file="$(kubectl config view --minify --raw -o jsonpath='{.clusters[0].cluster.certificate-authority}')"
|
|
[ -n "$ca_file" ] || { echo "no cluster CA in the current kubeconfig" >&2; exit 1; }
|
|
ca="$(base64 -w0 < "$ca_file")"
|
|
fi
|
|
|
|
token="$(kubectl create token mg4-agent --namespace mg4 --duration "$duration")"
|
|
|
|
mkdir -p "$(dirname "$out")"
|
|
umask 077
|
|
cat > "$out" <<KUBECONFIG
|
|
apiVersion: v1
|
|
kind: Config
|
|
clusters:
|
|
- name: ${cluster}
|
|
cluster:
|
|
server: ${server}
|
|
certificate-authority-data: ${ca}
|
|
users:
|
|
- name: mg4-agent
|
|
user:
|
|
token: ${token}
|
|
contexts:
|
|
- name: mg4-agent
|
|
context:
|
|
cluster: ${cluster}
|
|
namespace: mg4
|
|
user: mg4-agent
|
|
current-context: mg4-agent
|
|
KUBECONFIG
|
|
|
|
echo "Wrote $out (mode 600), token valid for $duration."
|
|
echo "Check: KUBECONFIG=$out kubectl auth can-i --list"
|