feat: Cache token by decoding it and using 'exp' claim

Author: Baarsgaard

controllers/client/grafana_client.go

@@ -8,6 +8,8 @@ import (
 	"os"
 	"time"
 
+	"github.com/go-jose/go-jose/v4"
+	"github.com/go-jose/go-jose/v4/jwt"
 	genapi "github.com/grafana/grafana-openapi-client-go/client"
 	"github.com/grafana/grafana-operator/v5/api/v1beta1"
 	"github.com/grafana/grafana-operator/v5/controllers/config"
@@ -17,12 +19,71 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
+const (
+	serviceAccountTokenPath = "/var/run/secrets/kubernetes.io/serviceaccount/token" // nolint:gosec
+)
+
 type grafanaAdminCredentials struct {
 	adminUser     string
 	adminPassword string
 	apikey        string
 }
 
+type JWTCache struct {
+	Token      string
+	Expiration time.Time
+}
+
+var jwtCache *JWTCache
+
+// getBearerToken will read JWT token from given file and cache it until it expires.
+// accepts filepath arg for testing
+func getBearerToken(bearerTokenPath string) (string, error) {
+	// Return cached token if not expired
+	if jwtCache != nil && jwtCache.Expiration.After(time.Now()) {
+		return jwtCache.Token, nil
+	}
+
+	b, err := os.ReadFile(bearerTokenPath)
+	if err != nil {
+		return "", fmt.Errorf("reading token file at %s, %w", bearerTokenPath, err)
+	}
+
+	token := string(b)
+
+	// List of accepted algorithms mirrore of: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#:~:text=RS256
+	// RS256 should be the default, but no documentation came up regarding configuration of how service accounts are generated
+	t, err := jwt.ParseSigned(token, []jose.SignatureAlgorithm{
+		jose.RS256, jose.RS384, jose.RS512,
+		jose.ES256, jose.ES384, jose.ES512,
+		jose.PS256, jose.PS384, jose.PS512,
+	})
+	if err != nil {
+		return "", err
+	}
+
+	claims := jwt.Claims{}
+
+	// TODO fetch JWKS from https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT_HTTPS}/openid/v1/jwks
+	// Then verify token using the keys
+	err = t.UnsafeClaimsWithoutVerification(&claims)
+	if err != nil {
+		return "", fmt.Errorf("decoding ServiceAccount token %w", err)
+	}
+
+	tokenExpiration := claims.Expiry.Time()
+	if tokenExpiration.Before(time.Now()) {
+		return "", fmt.Errorf("token expired at %s, expected %s to be rotated", tokenExpiration.String(), bearerTokenPath)
+	}
+
+	jwtCache = &JWTCache{
+		Token:      token,
+		Expiration: tokenExpiration,
+	}
+
+	return token, nil
+}
+
 func getExternalAdminUser(ctx context.Context, c client.Client, cr *v1beta1.Grafana) (string, error) {
 	if cr.Spec.External != nil && cr.Spec.External.AdminUser != nil {
 		adminUser, err := GetValueFromSecretKey(ctx, cr.Spec.External.AdminUser, c, cr.Namespace)
@@ -64,12 +125,12 @@ func getAdminCredentials(ctx context.Context, c client.Client, grafana *v1beta1.
 	credentials := &grafanaAdminCredentials{}
 
 	if grafana.Spec.Client != nil && grafana.Spec.Client.UseKubeAuth {
-		b, err := os.ReadFile("/var/run/secrets/kubernetes.io/serviceaccount/token")
+		t, err := getBearerToken(serviceAccountTokenPath)
 		if err != nil {
 			return nil, err
 		}
 
-		credentials.apikey = string(b)
+		credentials.apikey = t
 
 		return credentials, nil
 	}

go.mod

@@ -43,6 +43,7 @@ require (
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/go-openapi/analysis v0.23.0 // indirect

go.sum

@@ -58,6 +58,8 @@ github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nos
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
 github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
 github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
+github.com/go-jose/go-jose/v4 v4.1.2 h1:TK/7NqRQZfgAh+Td8AlsrvtPoUyiHh0LqVvokh+1vHI=
+github.com/go-jose/go-jose/v4 v4.1.2/go.mod h1:22cg9HWM1pOlnRiY+9cQYJ9XHmya1bYW8OeDM6Ku6Oo=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=