feat(k8s): unified cloud OAuth token generation for GKE and AKS - #208
feat(k8s): unified cloud OAuth token generation for GKE and AKS#208JLCode-tech wants to merge 11 commits into
Conversation
jgruberf5
changed the title
…w nits Self-review findings on feat/unified-cloud-k8s-access: - F1 (MEDIUM): get_gcp_service_account_info / get_azure_service_principal_info no longer fall through to ambient os.getenv creds when a project sets an EXPLICIT credential_template_id whose provider mismatches (or whose creds are unusable). That fail-OPEN handed back the ambient global identity and defeated explicit template scoping. Now fail CLOSED (return None) whenever a template is explicitly scoped; the ambient env fallback applies ONLY when no template is set. Made the two guard tests hermetic (monkeypatch ambient env to sentinels) so they catch the regression regardless of CI env. - F3 (nit): removed dead `import logging` + unused module logger from azure_oauth_service.py. - F4 (nit): corrected the load_kubeconfig docstring to describe in-memory load_kube_config_from_dict instead of a temporary kubeconfig file. - F5 (LOW): _generate_gcp_token now derives its cache TTL from the token's real expiry (max(60, expires_in - 300)), mirroring _generate_azure_token, instead of a hardcoded now + 2700. Claude-Session: https://claude.ai/code/session_01UCsZXDxBsWV2s4kT47DwDW
Self-review (cold, adversarial) + fixes appliedAn independent cold audit executed the security-critical paths. No blockers — token minting mirrors the existing EKS path, encryption-at-rest is respected, no token/secret is logged, and the temp-file kubeconfig was replaced with in-memory F1 (MEDIUM — fail-open + non-hermetic tests) — FIXED. F2 (LOW) — FIXED. Removed the "corporate-proxy SSL-interception retries" claim from the title/body — it isn't implemented ( F3/F4 (nits) — FIXED. Removed the dead F5 (LOW) — FIXED. Held clean: no secret/token leakage; Azure token cache keyed on the credential identity (no cross-identity serve); contract unchanged (no new routers/schemas). Note for merge coordination: PRs #206 and #207 also edit |
…core Self-review findings on feat/v4-multi-cloud-ux-enhancements (tractable minors + a real coverage gap; no blockers). MINOR 1 — llm_observability_service.stats fleet branch: per-cluster `models` is already a COUNT of distinct models, so max() silently understated the fleet whenever clusters ran disjoint model sets. Switch to sum() as an upper bound of "models in use across the fleet" (matching the generic "Models" stat-tile), with a comment stating the true union is not computable from these inputs. Pin the semantics with a fleet `stats` test (previously untested). Coverage gap — routes/k8s/search._scan_cluster_for_query (the ~260-line live-scan core) was FULLY MOCKED in both integration tests. Add unit tests that mock the k8s client RESPONSES (not the scan function) and exercise Ingress/HTTPRoute/VirtualServer/Egress/Gateway/Service parsing, LB-IP harvesting, CRD-absent tolerance, and the ThreadPoolExecutor timeout harvest (partial results, no hang) + cross-cluster dedup. Add a request-based negative-authZ test asserting the route requires require_viewer (was only asserted by inspection). Did NOT touch credentials_service.py (reconciled with #208 at merge). Claude-Session: https://claude.ai/code/session_01UCsZXDxBsWV2s4kT47DwDW
3 participants
Summary
Provides pure-Python OAuth token generation for GCP and Azure Kubernetes clusters, plus multi-cloud provider badges.
Key Changes
credentials_service.pyandkubernetes/_base.py, so the API container does not needgke-gcloud-auth-pluginor the Azure CLI to authenticate to GKE/AKS.https://claude.ai/code/session_01UCsZXDxBsWV2s4kT47DwDW