awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix sa validation without ns

Browse Source
This commit is contained in:
Fang-Pen Lin
2025-12-03 16:38:34 -08:00
parent 47da427612
commit 30b451469b
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
backend/src/ee/services/pam-resource/kubernetes/kubernetes-resource-factory.ts
View File

@@ -127,7 +127,10 @@ export const kubernetesResourceFactory: TPamResourceFactory<
if (authMethod === KubernetesAuthMethod.ServiceAccountToken) {
// Validate service account token by making an authenticated API call
try {
await axios.get(`${baseUrl}/api/v1/namespaces/${connectionDetails.namespace}`, {
// TODO: is this the best API endpoint to use for validation?
// the SA may not have access to list ns
// maybe we should use a more specific API endpoint?
await axios.get(`${baseUrl}/api/v1/namespaces`, {
headers: {
"Content-Type": "application/json",
Authorization: `Bearer ${credentials.serviceAccountToken}`
@@ -137,10 +140,7 @@ export const kubernetesResourceFactory: TPamResourceFactory<
timeout: EXTERNAL_REQUEST_TIMEOUT
});
logger.info(
{ namespace: connectionDetails.namespace },
"[Kubernetes Resource Factory] Kubernetes service account token authentication successful"
);
logger.info("[Kubernetes Resource Factory] Kubernetes service account token authentication successful");
} catch (error) {
if (error instanceof AxiosError) {
if (error.response?.status === 401 || error.response?.status === 403) {