feat(k8s): add endpoint that proxies CB-Spider's K8s Cluster Token API by hanizang77 · Pull Request #2366 · cloud-barista/cb-tumblebug

hanizang77 · 2026-03-12T11:45:38Z

Summary

Adds GET /ns/{nsId}/k8sCluster/{k8sClusterId}/token that proxies CB-Spider's GenerateClusterToken API, so external consumers (e.g., M-CMP) can obtain cluster access tokens (AWS, GCP, and NCP) through TB without direct Spider access.

Related to #2348

Test Results

Successfully retrieved tokens for AWS, GCP, and NCP clusters and verified cluster access via kubectl get nodes.

CSP	Result	Token format
AWS	✅	STS Presigned URL (`k8s-aws-v1...`)
GCP	✅	GCP access token (`ya29.c...`)
NCP	✅ (non-standard)	Full kubeconfig YAML in `status.token`

Notes

NCP returns a full kubeconfig YAML in status.token instead of a bearer token; consumers must detect and handle this case
For unsupported CSPs, TB transparently propagates Spider's error response without blocking at the TB level. Token issuance is governed by each CSP's authentication policy, which can change at any time and is solely handled by Spider's drivers. Having TB enforce its own allowlist would contradict that separation and add unnecessary maintenance overhead.

seokho-son

@hanizang77 업데이트 감사합니다. :)

코드 관리 관점에서, 의견들이 있어서 공유 드립니다.

seokho-son · 2026-03-12T12:31:41Z

src/interface/rest/server/resource/k8scluster.go

+// @Produce  json
+// @Param nsId path string true "Namespace ID" default(default)
+// @Param k8sClusterId path string true "K8sCluster ID" default(k8scluster01)
+// @Success 200 {object} resource.SpiderClusterTokenResponse


@hanizang77
기존 CB-TB 컨벤션에 따라서,
CB-Spider 가 상위로 드러날 필요가 없는 부분(특히 API 측면)에 대해서는,
CB-TB의 용어 및 관점으로 내용을 정리해서 내보낼 필요가 있습니다. (사용자에게 CB-Spider에 대한 내용을 의도적으로 드러내신 것이라면 알려주세요.)

// @description Proxies CB-Spider's cluster token API and returns an ExecCredential token

resource.SpiderClusterTokenResponse

seokho-son · 2026-03-12T12:33:58Z

src/interface/rest/server/server.go

+	// Echo router gives priority to static segments (/token) over param segments (:k8sClusterId),
+	// so this does not conflict with the existing GET /:nsId/k8sCluster/:k8sClusterId route


이 코멘트는 어떤 측면에서 추가해두신 것일까요?
업스트림 측면에서 (다른 기여자나 개발자에게) 도움이 되는 코멘트인지 확신이 없습니다.

seokho-son · 2026-03-12T12:37:45Z

src/interface/rest/server/resource/k8scluster.go

+	if err != nil {
+		mapA := map[string]string{"message": "Failed to get token for K8sCluster " + k8sClusterId + ": " + err.Error()}
+		return c.JSON(http.StatusInternalServerError, &mapA)
+	}
+	return c.JSON(http.StatusOK, res)


return clientManager.EndRequestWithLog(c, err, content)

https://github.com/cloud-barista/cb-tumblebug/blob/main/src/interface/rest/server/infra/provisioning.go#L144

이 패턴을 쓰는 것이 바람직합니다. 그러나, k8s 관련 코드들은 아직 정리가 전반적으로 되어 있지 않아서, 일단 api를 신규로 추가하실 때는 살펴봐주시면 좋을 것 같습니다.

seokho-son · 2026-03-12T12:40:35Z

src/core/resource/k8scluster.go

+// SpiderClusterTokenResponse mirrors CB-Spider's ClusterTokenResponse for ExecCredential passthrough.
+type SpiderClusterTokenResponse struct {
+	ApiVersion string                   `json:"apiVersion"`
+	Kind       string                   `json:"kind"`
+	Status     SpiderClusterTokenStatus `json:"status"`
+}
+
+type SpiderClusterTokenStatus struct {
+	Token string `json:"token"`
+}


https://github.com/cloud-barista/cb-tumblebug/blob/main/src/core/model/k8scluster.go

model 쪽에 들어가는게 적절하지 않을까요?
아니면, Spider 앞을 소문자로 변경하여, 활용 범위를 축소하는 방법도 있습니다.

hanizang77 · 2026-03-13T02:41:32Z

@seokho-son 코드와 주석 모두 CB-Spider의 흔적을 의도적으로 드러냈는데, 사용자 관점이 아니라 개인적인 개발 편의만 반영된 것 같습니다. CB-TB 용어와 관점으로 정리하겠습니다.

SpiderClusterTokenResponse는 소문자 변경 대신 K8sClusterTokenResponse로 이름을 변경하고 core/model/로 이동하겠습니다.
라우터 등록 코멘트는 제거하고 응답 패턴도 정리하겠습니다.

hanizang77 · 2026-03-13T06:57:44Z

@seokho-son 리뷰 감사합니다. 지적해주신 내용을 모두 반영했습니다. 반영된 코드로 AWS & GCP 토큰 발급 및 kubectl을 통한 클러스터 정보 조회까지 가능함을 확인했습니다.

seokho-son

minor comment. :)

seokho-son · 2026-03-13T08:45:14Z

src/core/model/k8scluster.go

+	Status     K8sClusterTokenStatus `json:"status"`
+}
+
+// K8sClusterTokenStatus holds the token value for K8s cluster authentication.
+type K8sClusterTokenStatus struct {
+	Token string `json:"token"`
+}


// K8sClusterTokenStatus holds the token value for K8s cluster authentication.
type K8sClusterTokenStatus struct {
Token string json:"token"
}

이 구조체를 굳이 별도로 정의할 필요가 있을까요?
활용처가 많이 있거나 앞으로 확장될 가능성이 있는 상태인지요?

K8sClusterTokenStatus는 향후 토큰 만료 처리 등의 필드 확장을 염두에 두고 분리해 두었으나, 당장 확장 계획이 없으므로 합쳐두는 편이 좋을것 같습니다.
혹시 모를 후속 구현(Option C: exec 블록 자동 해소)에서도 .Status.Token 문자열만 접근하면 충분해보입니다.

@hanizang77 의도가 있으시다면, 유지해도 괜찮을 것 같습니다. :)

@seokho-son 항상 빠르고 정확한 피드백 감사합니다. 조언해주신것처럼 Kubernetes 공식 ExecCredential 명세에 따라 아래과 같이 조정해보겠습니다.

// K8sClusterTokenResponse is the response struct for the K8sCluster token API. // It wraps an ExecCredential object that kubectl can use directly for exec-based auth. type K8sClusterTokenResponse struct { ExecCredential ExecCredential `json:"execCredential"` } // ExecCredential mirrors the Kubernetes ExecCredential format (client.authentication.k8s.io/v1). // kubectl parses this structure when an exec-based kubeconfig is used. // Ref: https://kubernetes.io/docs/reference/config-api/client-authentication.v1/ type ExecCredential struct { ApiVersion string `json:"apiVersion"` Kind string `json:"kind"` Status ExecCredentialStatus `json:"status"` } // ExecCredentialStatus holds credentials for the transport to use. // Mirrors the Kubernetes ExecCredentialStatus (client.authentication.k8s.io/v1). type ExecCredentialStatus struct { Token string `json:"token"` }

넵. 반영 후 알려주세요.

넵. 반영했습니다!

To support token-based kubeconfig access for GCP, AWS, and NCP

Move token response types to core/model, remove CB-Spider references from godoc, and apply EndRequestWithLog pattern

seokho-son · 2026-03-16T08:37:00Z

/approve

hanizang77 requested review from powerkimhub and seokho-son March 12, 2026 11:45

hanizang77 requested a review from yunkon-kim as a code owner March 12, 2026 11:45

seokho-son reviewed Mar 12, 2026

View reviewed changes

hanizang77 force-pushed the 260311-k8s branch from 17fbc25 to 3911cb2 Compare March 13, 2026 06:51

seokho-son reviewed Mar 13, 2026

View reviewed changes

hanizang77 added 3 commits March 16, 2026 14:30

feat(k8s): add endpoint that proxies CB-Spider's K8s Cluster Token API

cc41857

To support token-based kubeconfig access for GCP, AWS, and NCP

refactor(k8s): apply CB-TB conventions to cluster token API

e900e09

Move token response types to core/model, remove CB-Spider references from godoc, and apply EndRequestWithLog pattern

refactor(k8s): align token types with Kubernetes ExecCredential spec

8f61c24

hanizang77 force-pushed the 260311-k8s branch from 3911cb2 to 8f61c24 Compare March 16, 2026 05:39

github-actions bot approved these changes Mar 16, 2026

View reviewed changes

github-actions bot added the approved This PR is approved and will be merged soon. label Mar 16, 2026

cb-github-robot merged commit d02234f into cloud-barista:main Mar 16, 2026
5 checks passed

hanizang77 deleted the 260311-k8s branch March 17, 2026 01:38

		// Echo router gives priority to static segments (/token) over param segments (:k8sClusterId),
		// so this does not conflict with the existing GET /:nsId/k8sCluster/:k8sClusterId route

Conversation

hanizang77 commented Mar 12, 2026

Summary

Test Results

Notes

Uh oh!

seokho-son left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hanizang77 commented Mar 13, 2026

Uh oh!

hanizang77 commented Mar 13, 2026

Uh oh!

seokho-son left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

seokho-son commented Mar 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants