Please include openssl about k8s HOT 4 CLOSED

Hi, thank you for the recommendation. We have considered to use this approach. I have decided to use an alpine/openssl init container to generate the JWT token that will be used by the alpine/k8s container to request for the installation token then save the token into a Kubernetes secret. Both can be done in a single Kubernetes cronjob since the JWT token has a shorter expiry period than the installation token.

from k8s.

could you show me the command of cronjob you run with?

from k8s.

Our current use-case is different from the example I mentioned. We are currently using the following function based in Github's example as part of our script to generate a JWT token in order to request Github app installation tokens for one of our deployments:

function generate_jwt() {
  local app_id
  local pem
  local jwt
  app_id=$1 # App ID as first argument
  pem=$2 # file path of the private key as second argument

  now=$(date +%s)
  iat=$((now - 60)) # Issues 60 seconds in the past
  exp=$((now + 600)) # Expires 10 minutes in the future

  b64enc() { openssl base64 | tr -d '=' | tr '/+' '_-' | tr -d '\n'; }

  header_json='{
      "typ":"JWT",
      "alg":"RS256"
  }'
  # Header encode
  header=$( echo -n "${header_json}" | b64enc )

  payload_json='{
      "iat":'"${iat}"',
      "exp":'"${exp}"',
      "iss":'"${app_id}"'
  }'
  # Payload encode
  payload=$( echo -n "${payload_json}" | b64enc )

  # Signature
  header_payload="${header}"."${payload}"
  signature=$( 
      openssl dgst -sha256 -sign <(echo -n "${pem}") \
      <(echo -n "${header_payload}") | b64enc 
  )

  # Create JWT
  jwt="${header_payload}"."${signature}"
  echo -n "${jwt}"
}

The acquired Github app installation token is then added to a secret in the cluster using kubectl.

I haven't found a way to do this yet without openssl but am open to suggestions.

from k8s.

So we need split it.

• job 1, get the jwt, you can do it in another docker, which you can install openssl in it with git and other tools. These tools are more generic more than k8s.
• job 2, feed the jwt to docker alpine/k8s

Will this be fine for you?

from k8s.