awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-06 22:27:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update machine-identity-token.go

Browse Source
This commit is contained in:
Daniel Hougaard
2024-03-21 17:07:31 +01:00
parent 71e31518d7
commit 5c6781a705
1 changed files with 35 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8-operator/packages/util/machine-identity-token.go
+35 -35
View File
@@ -35,22 +35,22 @@ func NewMachineIdentityToken(clientId string, clientSecret string) *MachineIdent
return &token return &token
} }
func (tm *MachineIdentityToken) HandleTokenLifecycle() error { func (t *MachineIdentityToken) HandleTokenLifecycle() error {
for { for {
accessTokenMaxTTLExpiresInTime := tm.accessTokenFetchedTime.Add(tm.accessTokenMaxTTL - (5 * time.Second)) accessTokenMaxTTLExpiresInTime := t.accessTokenFetchedTime.Add(t.accessTokenMaxTTL - (5 * time.Second))
accessTokenRefreshedTime := tm.accessTokenRefreshedTime accessTokenRefreshedTime := t.accessTokenRefreshedTime
if accessTokenRefreshedTime.IsZero() { if accessTokenRefreshedTime.IsZero() {
accessTokenRefreshedTime = tm.accessTokenFetchedTime accessTokenRefreshedTime = t.accessTokenFetchedTime
} }
nextAccessTokenExpiresInTime := accessTokenRefreshedTime.Add(tm.accessTokenTTL - (5 * time.Second)) nextAccessTokenExpiresInTime := accessTokenRefreshedTime.Add(t.accessTokenTTL - (5 * time.Second))
if tm.accessTokenFetchedTime.IsZero() && tm.accessTokenRefreshedTime.IsZero() { if t.accessTokenFetchedTime.IsZero() && t.accessTokenRefreshedTime.IsZero() {
// case: init login to get access token // case: init login to get access token
fmt.Println("\nInfisical Authentication: attempting to authenticate...") fmt.Println("\nInfisical Authentication: attempting to authenticate...")
err := tm.FetchNewAccessToken() err := t.FetchNewAccessToken()
if err != nil { if err != nil {
fmt.Printf("\nInfisical Authentication: unable to authenticate universal auth because %v. Will retry in 30 seconds", err) fmt.Printf("\nInfisical Authentication: unable to authenticate universal auth because %v. Will retry in 30 seconds", err)
@@ -60,7 +60,7 @@ func (tm *MachineIdentityToken) HandleTokenLifecycle() error {
} }
} else if time.Now().After(accessTokenMaxTTLExpiresInTime) { } else if time.Now().After(accessTokenMaxTTLExpiresInTime) {
fmt.Printf("\nInfisical Authentication: machine identity access token has reached max ttl, attempting to re authenticate...") fmt.Printf("\nInfisical Authentication: machine identity access token has reached max ttl, attempting to re authenticate...")
err := tm.FetchNewAccessToken() err := t.FetchNewAccessToken()
if err != nil { if err != nil {
fmt.Printf("\nInfisical Authentication: unable to authenticate universal auth because %v. Will retry in 30 seconds", err) fmt.Printf("\nInfisical Authentication: unable to authenticate universal auth because %v. Will retry in 30 seconds", err)
@@ -69,7 +69,7 @@ func (tm *MachineIdentityToken) HandleTokenLifecycle() error {
continue continue
} }
} else { } else {
err := tm.RefreshAccessToken() err := t.RefreshAccessToken()
if err != nil { if err != nil {
fmt.Printf("\nInfisical Authentication: unable to refresh universal auth token because %v. Will retry in 30 seconds", err) fmt.Printf("\nInfisical Authentication: unable to refresh universal auth token because %v. Will retry in 30 seconds", err)
@@ -80,31 +80,31 @@ func (tm *MachineIdentityToken) HandleTokenLifecycle() error {
} }
if accessTokenRefreshedTime.IsZero() { if accessTokenRefreshedTime.IsZero() {
accessTokenRefreshedTime = tm.accessTokenFetchedTime accessTokenRefreshedTime = t.accessTokenFetchedTime
} else { } else {
accessTokenRefreshedTime = tm.accessTokenRefreshedTime accessTokenRefreshedTime = t.accessTokenRefreshedTime
} }
nextAccessTokenExpiresInTime = accessTokenRefreshedTime.Add(tm.accessTokenTTL - (5 * time.Second)) nextAccessTokenExpiresInTime = accessTokenRefreshedTime.Add(t.accessTokenTTL - (5 * time.Second))
accessTokenMaxTTLExpiresInTime = tm.accessTokenFetchedTime.Add(tm.accessTokenMaxTTL - (5 * time.Second)) accessTokenMaxTTLExpiresInTime = t.accessTokenFetchedTime.Add(t.accessTokenMaxTTL - (5 * time.Second))
if nextAccessTokenExpiresInTime.After(accessTokenMaxTTLExpiresInTime) { if nextAccessTokenExpiresInTime.After(accessTokenMaxTTLExpiresInTime) {
// case: Refreshed so close that the next refresh would occur beyond max ttl (this is because currently, token renew tries to add +access-token-ttl amount of time) // case: Refreshed so close that the next refresh would occur beyond max ttl (this is because currently, token renew tries to add +access-token-ttl amount of time)
// example: access token ttl is 11 sec and max ttl is 30 sec. So it will start with 11 seconds, then 22 seconds but the next time you call refresh it would try to extend it to 33 but max ttl only allows 30, so the token will be valid until 30 before we need to reauth // example: access token ttl is 11 sec and max ttl is 30 sec. So it will start with 11 seconds, then 22 seconds but the next time you call refresh it would try to extend it to 33 but max ttl only allows 30, so the token will be valid until 30 before we need to reauth
time.Sleep(tm.accessTokenTTL - nextAccessTokenExpiresInTime.Sub(accessTokenMaxTTLExpiresInTime)) time.Sleep(t.accessTokenTTL - nextAccessTokenExpiresInTime.Sub(accessTokenMaxTTLExpiresInTime))
} else { } else {
time.Sleep(tm.accessTokenTTL - (5 * time.Second)) time.Sleep(t.accessTokenTTL - (5 * time.Second))
} }
} }
} }
func (tm *MachineIdentityToken) RefreshAccessToken() error { func (t *MachineIdentityToken) RefreshAccessToken() error {
httpClient := resty.New() httpClient := resty.New()
httpClient.SetRetryCount(10000). httpClient.SetRetryCount(10000).
SetRetryMaxWaitTime(20 * time.Second). SetRetryMaxWaitTime(20 * time.Second).
SetRetryWaitTime(5 * time.Second) SetRetryWaitTime(5 * time.Second)
accessToken, err := tm.GetToken() accessToken, err := t.GetToken()
if err != nil { if err != nil {
return err return err
@@ -117,19 +117,19 @@ func (tm *MachineIdentityToken) RefreshAccessToken() error {
accessTokenTTL := time.Duration(response.ExpiresIn * int(time.Second)) accessTokenTTL := time.Duration(response.ExpiresIn * int(time.Second))
accessTokenMaxTTL := time.Duration(response.AccessTokenMaxTTL * int(time.Second)) accessTokenMaxTTL := time.Duration(response.AccessTokenMaxTTL * int(time.Second))
tm.accessTokenRefreshedTime = time.Now() t.accessTokenRefreshedTime = time.Now()
tm.SetToken(response.AccessToken, accessTokenTTL, accessTokenMaxTTL) t.SetToken(response.AccessToken, accessTokenTTL, accessTokenMaxTTL)
return nil return nil
} }
// Fetches a new access token using client credentials // Fetches a new access token using client credentials
func (tm *MachineIdentityToken) FetchNewAccessToken() error { func (t *MachineIdentityToken) FetchNewAccessToken() error {
loginResponse, err := api.CallUniversalMachineIdentityLogin(api.MachineIdentityUniversalAuthLoginRequest{ loginResponse, err := api.CallUniversalMachineIdentityLogin(api.MachineIdentityUniversalAuthLoginRequest{
ClientId: tm.clientId, ClientId: t.clientId,
ClientSecret: tm.clientSecret, ClientSecret: t.clientSecret,
}) })
if err != nil { if err != nil {
return err return err
@@ -143,28 +143,28 @@ func (tm *MachineIdentityToken) FetchNewAccessToken() error {
os.Exit(1) os.Exit(1)
} }
tm.accessTokenFetchedTime = time.Now() t.accessTokenFetchedTime = time.Now()
tm.SetToken(loginResponse.AccessToken, accessTokenTTL, accessTokenMaxTTL) t.SetToken(loginResponse.AccessToken, accessTokenTTL, accessTokenMaxTTL)
return nil return nil
} }
func (tm *MachineIdentityToken) SetToken(token string, accessTokenTTL time.Duration, accessTokenMaxTTL time.Duration) { func (t *MachineIdentityToken) SetToken(token string, accessTokenTTL time.Duration, accessTokenMaxTTL time.Duration) {
tm.mutex.Lock() t.mutex.Lock()
defer tm.mutex.Unlock() defer t.mutex.Unlock()
tm.accessToken = token t.accessToken = token
tm.accessTokenTTL = accessTokenTTL t.accessTokenTTL = accessTokenTTL
tm.accessTokenMaxTTL = accessTokenMaxTTL t.accessTokenMaxTTL = accessTokenMaxTTL
} }
func (tm *MachineIdentityToken) GetToken() (string, error) { func (t *MachineIdentityToken) GetToken() (string, error) {
tm.mutex.Lock() t.mutex.Lock()
defer tm.mutex.Unlock() defer t.mutex.Unlock()
if tm.accessToken == "" { if t.accessToken == "" {
return "", fmt.Errorf("no machine identity access token available") return "", fmt.Errorf("no machine identity access token available")
} }
return tm.accessToken, nil return t.accessToken, nil
} }