feat: add TOKEN_AUDIENCE configuration

Author: froz42

charts/kerbernetes/templates/deployment.yaml

@@ -24,6 +24,8 @@ spec:
               value: "{{ .Values.httpPort }}"
             - name: LDAP_ENABLED
               value: "{{ .Values.ldap.enabled }}"
+            - name: TOKEN_AUDIENCE
+              value: "{{ .Values.token.audience }}"
             {{- if and .Values.ldap.enabled .Values.secrets.ldapSecret }}
             - name: LDAP_BASE_DN
               value: "{{ .Values.ldap.baseDN }}"

charts/kerbernetes/values.yaml

@@ -9,6 +9,9 @@ image:
 
 httpPort: 3000
 
+token:
+  audience: "https://kubernetes.default.svc.cluster.local"
+
 ldap:
   enabled: false
   url: "ldap://ldap.example.com"

internal/services/auth/auth.service.go

@@ -92,7 +92,11 @@ func (s *authService) AuthAccount(
 	}, nil
 }
 
-func (s *authService) ldapReconcilate(ctx context.Context, username string, sa *corev1.ServiceAccount) error {
+func (s *authService) ldapReconcilate(
+	ctx context.Context,
+	username string,
+	sa *corev1.ServiceAccount,
+) error {
 	user, err := s.ldapSvc.GetUser(username)
 	if err != nil {
 		s.logger.Error("Failed to get user from LDAP", "username", username, "error", err)

internal/services/env/env.service.go

@@ -16,7 +16,8 @@ type Env struct {
 	KeytabPath string `mapstructure:"KEYTAB_PATH" default:"/etc/krb5.keytab" validate:"required"`
 	Namespace  string `mapstructure:"NAMESPACE" default:"default" validate:"required"`
 
-	TokenDuration int `mapstructure:"TOKEN_DURATION" default:"600" validate:"required"`
+	TokenDuration int    `mapstructure:"TOKEN_DURATION" default:"600" validate:"required"`
+	TokenAudience string `mapstructure:"TOKEN_AUDIENCE" default:"https://kubernetes.default.svc.cluster.local"`
 
 	LDAPEnabled bool   `mapstructure:"LDAP_ENABLED" default:"false"`
 	LDAPURL     string `mapstructure:"LDAP_URL"`

internal/services/k8s/serviceaccounts/serviceaccounts.service.go

@@ -135,7 +135,7 @@ func (svc *serviceAccountsService) IssueToken(
 	token, err := svc.clientset.CoreV1().ServiceAccounts(svc.namespace).
 		CreateToken(ctx, username, &authv1.TokenRequest{
 			Spec: authv1.TokenRequestSpec{
-				Audiences:         []string{"https://kubernetes.default.svc.cluster.local"},
+				Audiences:         []string{svc.env.TokenAudience},
 				ExpirationSeconds: int64Ptr(int64(svc.env.TokenDuration)),
 			},
 		}, metav1.CreateOptions{})