Mode service account in target namespace

docs/region-configuration.md

@@ -60,7 +60,8 @@ Users can work on Onyxia as a User or as a Group to which they belong. Each user
 | `groupNamespacePrefix`        | "projet-" | User in a group groupId can access the namespace groupeNamespacePrefix + groupId. This prefix is also used for the Vault group directory.                                                                                                                                                                          |                                                                                                   |
 | `usernamePrefix`              | | If set, the Kubernetes user corresponding to the Onyxia user is named usernamePrefix + userId on impersonation mode, otherwise it is identified only as userId                                                                                                                                                     | "user-"                                                                                           |
 | `groupPrefix`                 | | not used                                                                                                                                                                                                                                                                                                           |                                                                                                   |
-| `authenticationMode`          | serviceAccount | serviceAccount, impersonate or tokenPassthrough : on serviceAccount mode Onyxia API uses its own serviceAccount (by default admin or cluster-admin), with impersonate mode Onyxia requests the API with user's permissions (helm option `--kube-as-user`). With tokenPassthrough, the authentication token is passed to the API server. |                                                                                                   |
+| `authenticationMode`          | serviceAccount | serviceAccount, serviceAccountInTargetNamespace, impersonate or tokenPassthrough : on serviceAccount mode Onyxia API uses its own serviceAccount (by default admin or cluster-admin), with serviceAccountInTargetNamespace mode Onyxia impersonates the service account named `targetNamespaceServiceAccount` created by the onboarding API in each namespace (its own serviceAccount only needs the `impersonate` verb on `serviceaccounts` with that name), with impersonate mode Onyxia requests the API with user's permissions (helm option `--kube-as-user`). With tokenPassthrough, the authentication token is passed to the API server. |                                                                                                   |
+| `targetNamespaceServiceAccount` | onyxia-local | Name of the service account, created by the onboarding API in each namespace, impersonated with serviceAccountInTargetNamespace authentication. | |
 | `expose`                      | | When users request to expose their service, only subdomain of this object domain are allowed                                                                                                                                                                                                                       | See [Expose properties](#expose-properties)                                                       |
 | `monitoring`                  | | Define the URL pattern of the monitoring service that is to be launched with each service. Only for client purposes.                                                                                                                                                                                               | {URLPattern: "https://$NAMESPACE-$INSTANCE.mymonitoring.sspcloud.fr"}                             |                                            |
 | `allowedURIPattern`           | "^https://" | Init scripts set by the user have to respect this pattern.                                                                                                                                                                                                                                                         |                                                                                                   |

helm-wrapper/src/main/java/io/github/inseefrlab/helmwrapper/utils/Command.java

@@ -2,6 +2,8 @@
 
 import io.github.inseefrlab.helmwrapper.configuration.HelmConfiguration;
 import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.concurrent.TimeoutException;
@@ -30,7 +32,9 @@
                 new ProcessListener() {
                     @Override
                     public void afterStart(Process process, ProcessExecutor executor) {
-                        process.info().commandLine().ifPresent(cli -> LOGGER.info(cli));
+                        process.info()
+                                .commandLine()
+                                .ifPresent(cli -> LOGGER.info(redactToken(cli)));
                         super.afterStart(process, executor);
                     }
                 });
@@ -114,6 +118,29 @@
         if (helmConfiguration.getAsKubeUser() != null) {
             newCommand =
                     newCommand.concat(" --kube-as-user " + helmConfiguration.getAsKubeUser() + " ");
+
+            // Temp fix for https://github.com/kubernetes/kubernetes/issues/93474
+            try {
+                String token =
+                        Files.readString(
+                                        Path.of(
+                                                "/var/run/secrets/kubernetes.io/serviceaccount/token"))
+                                .trim();
+                String apiserver =
+                        "https://"
+                                + System.getenv("KUBERNETES_SERVICE_HOST")
+                                + ":"
+                                + System.getenv("KUBERNETES_SERVICE_PORT");
+                newCommand =
+                        newCommand.concat(
+                                " --kube-ca-file=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt --kube-token="
+                                        + token
+                                        + " --kube-apiserver="
+                                        + apiserver
+                                        + " ");
+            } catch (IOException e) {
+                LOGGER.debug("Could not retrieve in-cluster token");
+            }
         }
         String kubeConfig = null;
         if (StringUtils.isNotEmpty(helmConfiguration.getApiserverUrl())) {
@@ -146,6 +173,10 @@
         return newCommand;
     }
 
+    private static String redactToken(String commandLine) {
+        return commandLine.replaceAll("--kube-token[= ]+[^\\s]+", "--kube-token=[REDACTED]");
+    }
+
     public static void safeConcat(StringBuilder currentCommand, String toConcat)
             throws IllegalArgumentException {
         if (!safeToConcatenate.matcher(toConcat).matches()) {

helm-wrapper/src/test/java/io/github/inseefrlab/helmwrapper/utils/RedactTokenTest.java

@@ -0,0 +1,62 @@
+package io.github.inseefrlab.helmwrapper.utils;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import java.lang.reflect.Method;
+import org.junit.jupiter.api.Test;
+
+public class RedactTokenTest {
+
+    private String invokeRedactToken(String commandLine) throws Exception {
+        Method method = Command.class.getDeclaredMethod("redactToken", String.class);
+        method.setAccessible(true);
+        return (String) method.invoke(null, commandLine);
+    }
+
+    @Test
+    public void shouldRedactKubeTokenWithEquals() throws Exception {
+        String input =
+                "helm ls --kube-token=eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0In0.test";
+        String result = invokeRedactToken(input);
+        assertEquals("helm ls --kube-token=[REDACTED]", result);
+    }
+
+    @Test
+    public void shouldRedactKubeTokenWithSpace() throws Exception {
+        String input =
+                "helm ls --kube-token eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0In0.test";
+        String result = invokeRedactToken(input);
+        assertEquals("helm ls --kube-token=[REDACTED]", result);
+    }
+
+    @Test
+    public void shouldRedactMultipleKubeTokens() throws Exception {
+        String input = "helm ls --kube-token=token1 --kube-token=token2";
+        String result = invokeRedactToken(input);
+        assertEquals("helm ls --kube-token=[REDACTED] --kube-token=[REDACTED]", result);
+    }
+
+    @Test
+    public void shouldLeaveOtherOptionsUnchanged() throws Exception {
+        String input =
+                "helm ls --kubeconfig=/path/to/config --kube-apiserver=https://api.example.com";
+        String result = invokeRedactToken(input);
+        assertEquals(
+                "helm ls --kubeconfig=/path/to/config --kube-apiserver=https://api.example.com",
+                result);
+    }
+
+    @Test
+    public void shouldNotRedactIfNoToken() throws Exception {
+        String input = "helm ls --namespace default";
+        String result = invokeRedactToken(input);
+        assertEquals("helm ls --namespace default", result);
+    }
+
+    @Test
+    public void shouldRedactTokenWithTrailingOptions() throws Exception {
+        String input = "helm ls --kube-token=secret123 --namespace myns --output json";
+        String result = invokeRedactToken(input);
+        assertEquals("helm ls --kube-token=[REDACTED] --namespace myns --output json", result);
+    }
+}

onyxia-api/src/main/java/fr/insee/onyxia/api/configuration/kubernetes/HelmClientProvider.java

@@ -27,7 +27,7 @@ public HelmVersionService defaultHelmVersionService() {
         return new HelmVersionService();
     }
 
-    public HelmConfiguration getConfiguration(Region region, User user) {
+    public HelmConfiguration getConfiguration(Region region, User user, String namespace) {
         final HelmConfiguration helmConfiguration = new HelmConfiguration();
         if (region.getServices().getServer() != null) {
             final Region.Auth auth = region.getServices().getServer().getAuth();
@@ -47,6 +47,13 @@ public HelmConfiguration getConfiguration(Region region, User user) {
             helmConfiguration.setAsKubeUser(username);
         }
 
+        if (region.getServices().getAuthenticationMode()
+                == Region.Services.AuthenticationMode.SERVICEACCOUNTINTARGETNAMESPACE) {
+            helmConfiguration.setAsKubeUser(
+                    KubernetesClientProvider.getTargetNamespaceServiceAccountUsername(
+                            region, namespace));
+        }
+
         if (region.getServices().getAuthenticationMode()
                 == Region.Services.AuthenticationMode.TOKEN_PASSTHROUGH) {
             helmConfiguration.setKubeToken((String) user.getAttributes().get("access_token"));

onyxia-api/src/main/java/fr/insee/onyxia/api/configuration/kubernetes/KubernetesClientProvider.java

@@ -38,7 +38,23 @@
         return rootKubernetesClientCache.get(region.getId());
     }
 
-    public KubernetesClient getUserClient(Region region, User user) {
+    /**
+     * Username of the service account created by the onboarding in the given namespace,
+     * impersonated in SERVICEACCOUNTINTARGETNAMESPACE mode.
+     */
+    public static String getTargetNamespaceServiceAccountUsername(Region region, String namespace) {
+        return String.format(
+                "system:serviceaccount:%s:%s",
+                namespace, region.getServices().getTargetNamespaceServiceAccount());
+    }
+
+    /**
+     * Client to act on the given namespace on behalf of the user.
+     *
+     * @param namespace the namespace the client will act on, used to impersonate its service
+     *     account in SERVICEACCOUNTINTARGETNAMESPACE mode
+     */
+    public KubernetesClient getUserClient(Region region, User user, String namespace) {
         // In case of SERVICEACCOUNT authentication, we can safely mutualize and use a single
         // KubernetesClient
         if (region.getServices().getAuthenticationMode()
@@ -52,6 +68,20 @@
             return client;
         }
         final Config config = getDefaultConfiguration(region).build();
+
+        if (region.getServices().getAuthenticationMode()
+                == Region.Services.AuthenticationMode.SERVICEACCOUNTINTARGETNAMESPACE) {
+            if (StringUtils.isEmpty(namespace)) {
+                throw new IllegalArgumentException(
+                        "A namespace is required to impersonate its service account");
+            }
+            config.setImpersonateUsername(
+                    getTargetNamespaceServiceAccountUsername(region, namespace));
+            // Without explicit groups, the API server adds the service account groups itself
+            config.setImpersonateGroups(null);
+            return new KubernetesClientBuilder().withConfig(config).build();
+        }
+
         String username = user.getIdep();
         if (region.getServices().getUsernamePrefix() != null) {
             username = region.getServices().getUsernamePrefix() + user.getIdep();
@@ -60,7 +90,7 @@
         if (region.getServices().getAuthenticationMode()
                 == Region.Services.AuthenticationMode.IMPERSONATE) {
             config.setImpersonateUsername(username);
             config.setImpersonateGroups(null);
         }
 
         if (region.getServices().getAuthenticationMode()

onyxia-api/src/main/java/fr/insee/onyxia/api/configuration/properties/RegionsConfiguration.java

@@ -9,6 +9,7 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
+import org.apache.commons.lang3.StringUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -39,7 +40,7 @@
     }
 
     @PostConstruct
     public void load() throws Exception {
         resolvedRegions = Arrays.asList(mapper.readValue(regions, Region[].class));
         resolvedRegions.forEach(
                 region -> {
@@ -66,6 +67,37 @@
                                 "Using token passthrough authentication for region {}. User token will be used by Onyxia to interact with the API Server.",
                                 region.getId());
                     }
+
+                    if (region.getServices()
+                            .getAuthenticationMode()
+                            .equals(
+                                    Region.Services.AuthenticationMode
+                                            .SERVICEACCOUNTINTARGETNAMESPACE)) {
+                        if (StringUtils.isBlank(
+                                region.getServices().getTargetNamespaceServiceAccount())) {
+                            throw new IllegalStateException(
+                                    "services.targetNamespaceServiceAccount is required with serviceAccountInTargetNamespace authentication for region "
+                                            + region.getId());
+                        }
+                        LOGGER.info(
+                                "Using the {} service account of each namespace for region {}.",
+                                region.getServices().getTargetNamespaceServiceAccount(),
+                                region.getId());
+                        if (!region.getServices().isSingleNamespace()
+                                && region.getServices().isAllowNamespaceCreation()) {
+                            // Namespaces and their service account are created by the onboarding
+                            // API, the API has no permission to do it in this mode
+                            LOGGER.warn(
+                                    "Namespace creation is disabled for region {}: the onboarding API must be used with serviceAccountInTargetNamespace authentication.",
+                                    region.getId());
+                            region.getServices().setAllowNamespaceCreation(false);
+                        }
+                    } else if (!region.getServices().isSingleNamespace()
+                            && region.getServices().isAllowNamespaceCreation()) {
+                        LOGGER.warn(
+                                "Namespace creation by Onyxia API (allowNamespaceCreation) is deprecated for region {} and will be removed, use the onboarding API instead.",
+                                region.getId());
+                    }
                 });
     }
 

onyxia-api/src/main/java/fr/insee/onyxia/api/controller/api/onboarding/OnboardingController.java

@@ -35,10 +35,16 @@
         this.userProvider = userProvider;
     }
 
+    /**
+     * @deprecated namespaces should be created by the onboarding API. Disabled with
+     *     serviceAccountInTargetNamespace authentication.
+     */
+    @Deprecated
     @Operation(
             summary = "Init a namespace for a user or a group.",
             description =
-                    "create or replace the namespace of the user or the namespace of a group if the user is in the requested group and the according rbac policies. with the group prefix / user prefix of the region",
+                    "Deprecated: use the onboarding API instead. create or replace the namespace of the user or the namespace of a group if the user is in the requested group and the according rbac policies. with the group prefix / user prefix of the region",
+            deprecated = true,
             parameters = {
                 @Parameter(
                         name = "ONYXIA-REGION",
@@ -48,7 +54,7 @@
                         schema = @Schema(name = "ONYXIA-REGION", type = "string"))
             })
     @PostMapping
     public void onboard(
             @Parameter(hidden = true) Region region, @RequestBody OnboardingRequest request) {
         if (region.getServices().isSingleNamespace()) {
             throw new NamespaceAlreadyExistException();