CL-Softwares
/
telegraf
8
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(inputs.kubernetes): refresh token from file at each read (#11578)

This commit is contained in:
Joshua Powers 2022-08-03 13:10:42 -06:00 committed by GitHub
parent d606899737
commit 388be518f8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 18 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
plugins/inputs/kubernetes/README.md
View File

@ -45,7 +45,11 @@ avoid cardinality issues:
## Use bearer token for authorization. ('bearer_token' takes priority) ## Use bearer token for authorization. ('bearer_token' takes priority)
## If both of these are empty, we'll use the default serviceaccount: ## If both of these are empty, we'll use the default serviceaccount:
## at: /run/secrets/kubernetes.io/serviceaccount/token ## at: /run/secrets/kubernetes.io/serviceaccount/token
# bearer_token = "/path/to/bearer/token" ##
## To re-read the token at each interval, please use a file with the
## bearer_token option. If given a string, Telegraf will always use that
## token.
# bearer_token = "/run/secrets/kubernetes.io/serviceaccount/token"
## OR ## OR
# bearer_token_string = "abc_123" # bearer_token_string = "abc_123"

17
plugins/inputs/kubernetes/kubernetes.go
View File

@ -27,7 +27,7 @@ type Kubernetes struct {
// Bearer Token authorization file path // Bearer Token authorization file path
BearerToken string `toml:"bearer_token"` BearerToken string `toml:"bearer_token"`
BearerTokenString string `toml:"bearer_token_string"` BearerTokenString string `toml:"bearer_token_string" deprecated:"1.24.0;use 'BearerToken' with a file instead"`
LabelInclude []string `toml:"label_include"` LabelInclude []string `toml:"label_include"`
LabelExclude []string `toml:"label_exclude"` LabelExclude []string `toml:"label_exclude"`
@ -65,14 +65,6 @@ func (k *Kubernetes) Init() error {
k.BearerToken = defaultServiceAccountPath k.BearerToken = defaultServiceAccountPath
} }
if k.BearerToken != "" {
token, err := os.ReadFile(k.BearerToken)
if err != nil {
return err
}
k.BearerTokenString = strings.TrimSpace(string(token))
}
labelFilter, err := filter.NewIncludeExcludeFilter(k.LabelInclude, k.LabelExclude) labelFilter, err := filter.NewIncludeExcludeFilter(k.LabelInclude, k.LabelExclude)
if err != nil { if err != nil {
return err return err
@ -186,6 +178,13 @@ func (k *Kubernetes) LoadJSON(url string, v interface{}) error {
ResponseHeaderTimeout: time.Duration(k.ResponseTimeout), ResponseHeaderTimeout: time.Duration(k.ResponseTimeout),
} }
} }
if k.BearerToken != "" {
token, err := os.ReadFile(k.BearerToken)
if err != nil {
return err
}
k.BearerTokenString = strings.TrimSpace(string(token))
}
req.Header.Set("Authorization", "Bearer "+k.BearerTokenString) req.Header.Set("Authorization", "Bearer "+k.BearerTokenString)
req.Header.Add("Accept", "application/json") req.Header.Add("Accept", "application/json")
resp, err = k.RoundTripper.RoundTrip(req) resp, err = k.RoundTripper.RoundTrip(req)

6
plugins/inputs/kubernetes/sample.conf
View File

@ -6,7 +6,11 @@
## Use bearer token for authorization. ('bearer_token' takes priority) ## Use bearer token for authorization. ('bearer_token' takes priority)
## If both of these are empty, we'll use the default serviceaccount: ## If both of these are empty, we'll use the default serviceaccount:
## at: /run/secrets/kubernetes.io/serviceaccount/token ## at: /run/secrets/kubernetes.io/serviceaccount/token
# bearer_token = "/path/to/bearer/token" ##
## To re-read the token at each interval, please use a file with the
## bearer_token option. If given a string, Telegraf will always use that
## token.
# bearer_token = "/run/secrets/kubernetes.io/serviceaccount/token"
## OR ## OR
# bearer_token_string = "abc_123" # bearer_token_string = "abc_123"