diff --git a/k8-operator/packages/util/machine-identity-token.go b/k8-operator/packages/util/machine-identity-token.go index 77c1ad0af..055e869ad 100644 --- a/k8-operator/packages/util/machine-identity-token.go +++ b/k8-operator/packages/util/machine-identity-token.go @@ -35,22 +35,22 @@ func NewMachineIdentityToken(clientId string, clientSecret string) *MachineIdent return &token } -func (tm *MachineIdentityToken) HandleTokenLifecycle() error { +func (t *MachineIdentityToken) HandleTokenLifecycle() error { for { - accessTokenMaxTTLExpiresInTime := tm.accessTokenFetchedTime.Add(tm.accessTokenMaxTTL - (5 * time.Second)) - accessTokenRefreshedTime := tm.accessTokenRefreshedTime + accessTokenMaxTTLExpiresInTime := t.accessTokenFetchedTime.Add(t.accessTokenMaxTTL - (5 * time.Second)) + accessTokenRefreshedTime := t.accessTokenRefreshedTime if accessTokenRefreshedTime.IsZero() { - accessTokenRefreshedTime = tm.accessTokenFetchedTime + accessTokenRefreshedTime = t.accessTokenFetchedTime } - nextAccessTokenExpiresInTime := accessTokenRefreshedTime.Add(tm.accessTokenTTL - (5 * time.Second)) + nextAccessTokenExpiresInTime := accessTokenRefreshedTime.Add(t.accessTokenTTL - (5 * time.Second)) - if tm.accessTokenFetchedTime.IsZero() && tm.accessTokenRefreshedTime.IsZero() { + if t.accessTokenFetchedTime.IsZero() && t.accessTokenRefreshedTime.IsZero() { // case: init login to get access token fmt.Println("\nInfisical Authentication: attempting to authenticate...") - err := tm.FetchNewAccessToken() + err := t.FetchNewAccessToken() if err != nil { fmt.Printf("\nInfisical Authentication: unable to authenticate universal auth because %v. Will retry in 30 seconds", err) @@ -60,7 +60,7 @@ func (tm *MachineIdentityToken) HandleTokenLifecycle() error { } } else if time.Now().After(accessTokenMaxTTLExpiresInTime) { fmt.Printf("\nInfisical Authentication: machine identity access token has reached max ttl, attempting to re authenticate...") - err := tm.FetchNewAccessToken() + err := t.FetchNewAccessToken() if err != nil { fmt.Printf("\nInfisical Authentication: unable to authenticate universal auth because %v. Will retry in 30 seconds", err) @@ -69,7 +69,7 @@ func (tm *MachineIdentityToken) HandleTokenLifecycle() error { continue } } else { - err := tm.RefreshAccessToken() + err := t.RefreshAccessToken() if err != nil { fmt.Printf("\nInfisical Authentication: unable to refresh universal auth token because %v. Will retry in 30 seconds", err) @@ -80,31 +80,31 @@ func (tm *MachineIdentityToken) HandleTokenLifecycle() error { } if accessTokenRefreshedTime.IsZero() { - accessTokenRefreshedTime = tm.accessTokenFetchedTime + accessTokenRefreshedTime = t.accessTokenFetchedTime } else { - accessTokenRefreshedTime = tm.accessTokenRefreshedTime + accessTokenRefreshedTime = t.accessTokenRefreshedTime } - nextAccessTokenExpiresInTime = accessTokenRefreshedTime.Add(tm.accessTokenTTL - (5 * time.Second)) - accessTokenMaxTTLExpiresInTime = tm.accessTokenFetchedTime.Add(tm.accessTokenMaxTTL - (5 * time.Second)) + nextAccessTokenExpiresInTime = accessTokenRefreshedTime.Add(t.accessTokenTTL - (5 * time.Second)) + accessTokenMaxTTLExpiresInTime = t.accessTokenFetchedTime.Add(t.accessTokenMaxTTL - (5 * time.Second)) if nextAccessTokenExpiresInTime.After(accessTokenMaxTTLExpiresInTime) { // case: Refreshed so close that the next refresh would occur beyond max ttl (this is because currently, token renew tries to add +access-token-ttl amount of time) // example: access token ttl is 11 sec and max ttl is 30 sec. So it will start with 11 seconds, then 22 seconds but the next time you call refresh it would try to extend it to 33 but max ttl only allows 30, so the token will be valid until 30 before we need to reauth - time.Sleep(tm.accessTokenTTL - nextAccessTokenExpiresInTime.Sub(accessTokenMaxTTLExpiresInTime)) + time.Sleep(t.accessTokenTTL - nextAccessTokenExpiresInTime.Sub(accessTokenMaxTTLExpiresInTime)) } else { - time.Sleep(tm.accessTokenTTL - (5 * time.Second)) + time.Sleep(t.accessTokenTTL - (5 * time.Second)) } } } -func (tm *MachineIdentityToken) RefreshAccessToken() error { +func (t *MachineIdentityToken) RefreshAccessToken() error { httpClient := resty.New() httpClient.SetRetryCount(10000). SetRetryMaxWaitTime(20 * time.Second). SetRetryWaitTime(5 * time.Second) - accessToken, err := tm.GetToken() + accessToken, err := t.GetToken() if err != nil { return err @@ -117,19 +117,19 @@ func (tm *MachineIdentityToken) RefreshAccessToken() error { accessTokenTTL := time.Duration(response.ExpiresIn * int(time.Second)) accessTokenMaxTTL := time.Duration(response.AccessTokenMaxTTL * int(time.Second)) - tm.accessTokenRefreshedTime = time.Now() + t.accessTokenRefreshedTime = time.Now() - tm.SetToken(response.AccessToken, accessTokenTTL, accessTokenMaxTTL) + t.SetToken(response.AccessToken, accessTokenTTL, accessTokenMaxTTL) return nil } // Fetches a new access token using client credentials -func (tm *MachineIdentityToken) FetchNewAccessToken() error { +func (t *MachineIdentityToken) FetchNewAccessToken() error { loginResponse, err := api.CallUniversalMachineIdentityLogin(api.MachineIdentityUniversalAuthLoginRequest{ - ClientId: tm.clientId, - ClientSecret: tm.clientSecret, + ClientId: t.clientId, + ClientSecret: t.clientSecret, }) if err != nil { return err @@ -143,28 +143,28 @@ func (tm *MachineIdentityToken) FetchNewAccessToken() error { os.Exit(1) } - tm.accessTokenFetchedTime = time.Now() - tm.SetToken(loginResponse.AccessToken, accessTokenTTL, accessTokenMaxTTL) + t.accessTokenFetchedTime = time.Now() + t.SetToken(loginResponse.AccessToken, accessTokenTTL, accessTokenMaxTTL) return nil } -func (tm *MachineIdentityToken) SetToken(token string, accessTokenTTL time.Duration, accessTokenMaxTTL time.Duration) { - tm.mutex.Lock() - defer tm.mutex.Unlock() +func (t *MachineIdentityToken) SetToken(token string, accessTokenTTL time.Duration, accessTokenMaxTTL time.Duration) { + t.mutex.Lock() + defer t.mutex.Unlock() - tm.accessToken = token - tm.accessTokenTTL = accessTokenTTL - tm.accessTokenMaxTTL = accessTokenMaxTTL + t.accessToken = token + t.accessTokenTTL = accessTokenTTL + t.accessTokenMaxTTL = accessTokenMaxTTL } -func (tm *MachineIdentityToken) GetToken() (string, error) { - tm.mutex.Lock() - defer tm.mutex.Unlock() +func (t *MachineIdentityToken) GetToken() (string, error) { + t.mutex.Lock() + defer t.mutex.Unlock() - if tm.accessToken == "" { + if t.accessToken == "" { return "", fmt.Errorf("no machine identity access token available") } - return tm.accessToken, nil + return t.accessToken, nil }