Key cache on cluster server URL + user name when available

kcc-injector now sets provideClusterInfo on injected exec configs, so
kubectl passes the target API server URL to kcc-cache via
KUBERNETES_EXEC_INFO. kcc-cache uses that server URL together with the
kubeconfig user name (KUBE_CREDENTIAL_CACHE_USER) as the cache key.

This makes the key stable against cosmetic argv changes (avoiding
needless re-auth) while still discriminating both the target cluster and
the identity, so one user's credentials are never served for another on
the same cluster. When the server URL is unavailable (provideClusterInfo
not set, or a manual setup) it falls back to the previous argv + env key.

Re-running `kcc-injector -i ~/.kube/config` once enables it; no other
manual setup is required.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DHL4n3s3iBGwQR34JxpDn9

Author: claude

cmd/kcc-cache/main.go

@@ -57,18 +57,47 @@ func main() {
 	}
 
 	// cache key
-	var cacheKey = strings.Join(os.Args[1:], " ")
+	//
+	// When kubectl provides cluster info (provideClusterInfo: true, which
+	// kcc-injector enables), the target API server URL is available via the
+	// KUBERNETES_EXEC_INFO env var. Combined with the kubeconfig user name
+	// (KUBE_CREDENTIAL_CACHE_USER, also set by kcc-injector) this yields a
+	// stable cache key: it survives cosmetic argv changes and never serves one
+	// identity's credentials for another identity on the same cluster.
+	//
+	// If the server URL is unavailable (provideClusterInfo not set, or a manual
+	// setup), fall back to the legacy argv + env based key.
+	var cacheKey string
 	{
-		env := ""
-		for _, key := range cacheKeyEnvlist {
-			v := os.Getenv(key)
-			if v == "" {
-				continue
+		server := ""
+		if e := os.Getenv("KUBERNETES_EXEC_INFO"); e != "" {
+			var execInfo struct {
+				Spec struct {
+					Cluster struct {
+						Server string `json:"server"`
+					} `json:"cluster"`
+				} `json:"spec"`
+			}
+			if err := json.Unmarshal([]byte(e), &execInfo); err == nil {
+				server = execInfo.Spec.Cluster.Server
 			}
-			env = fmt.Sprintf("%s %s='%s'", env, key, v)
 		}
-		if env != "" {
-			cacheKey = fmt.Sprintf("%s # env:%s", cacheKey, env)
+
+		if server != "" {
+			cacheKey = fmt.Sprintf("user=%q server=%q", os.Getenv("KUBE_CREDENTIAL_CACHE_USER"), server)
+		} else {
+			cacheKey = strings.Join(os.Args[1:], " ")
+			env := ""
+			for _, key := range cacheKeyEnvlist {
+				v := os.Getenv(key)
+				if v == "" {
+					continue
+				}
+				env = fmt.Sprintf("%s %s='%s'", env, key, v)
+			}
+			if env != "" {
+				cacheKey = fmt.Sprintf("%s # env:%s", cacheKey, env)
+			}
 		}
 	}
 

cmd/kcc-injector/main.go

@@ -73,6 +73,7 @@ func main() {
 			if user.Exec.Command == replaceCmd {
 				user.Exec.Command = user.Exec.Args[0]
 				user.Exec.Args = user.Exec.Args[1:]
+				user.Exec.ProvideClusterInfo = false
 			}
 
 			search := func() (index int) {
@@ -103,6 +104,11 @@ func main() {
 				user.Exec.Command = replaceCmd
 			}
 
+			// Expose the target cluster's API server URL to kcc-cache via the
+			// KUBERNETES_EXEC_INFO env var, so it can key the cache on the
+			// cluster (server URL) in addition to the user name.
+			user.Exec.ProvideClusterInfo = true
+
 			found := false
 			userEnv := api.ExecEnvVar{
 				Name:  "KUBE_CREDENTIAL_CACHE_USER",