Add debug logging and default TTL for credentials without expiry - #11
Merged
Conversation
Some credential plugins (e.g. the passman krew plugin) emit an ExecCredential without a status.expirationTimestamp, which decodes to the zero time. Such credentials look permanently expired, so they were re-fetched on every call and never effectively cached despite leaving an entry in the OS secret store. When a refreshed credential's expiry is more than KUBE_CREDENTIAL_CACHE_NO_EXPIRY_THRESHOLD (default 24h) in the past, treat it as "no expiry provided" and cache it for KUBE_CREDENTIAL_CACHE_DEFAULT_TTL (default 1h). Genuinely recently-expired credentials still refresh. Add KUBE_CREDENTIAL_CACHE_DEBUG to log the cache key, backend, hit/miss, expiry and refresh decisions to stderr (never credential material). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XP6Vo1jhL3S96g8hQ76umo
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds debug logging capabilities and handles credential plugins that don't report an expiration timestamp, which previously caused credentials to be re-fetched on every call.
Key Changes
Debug logging: Added
KUBE_CREDENTIAL_CACHE_DEBUGenvironment variable to enable verbose diagnostics. When enabled, logs cache key, hit/miss decisions, expiry information, and refresh operations to stderr without exposing credential material.Default TTL for credentials without expiry: Added logic to detect credentials with missing or implausibly old expiration timestamps (e.g., the zero time
0001-01-01T00:00:00Zemitted by plugins like passman) and apply a default TTL instead of treating them as permanently expired.KUBE_CREDENTIAL_CACHE_DEFAULT_TTL(default1h): TTL applied to credentials with no usable expiryKUBE_CREDENTIAL_CACHE_NO_EXPIRY_THRESHOLD(default24h): threshold for determining if an expiry is "missing" vs. genuinely recently-expiredHelper functions:
withDefaultExpiry(): Substitutes default expiry for credentials reporting no usable oneisTruthy(): Parses environment variable values as boolean flagsdebugf(): Conditional debug logging that respects the debug flagComprehensive tests: Added
TestWithDefaultExpiry()andTestIsTruthy()to validate the new functionalityDocumentation: Updated README with troubleshooting guidance for plugins without expiry timestamps and documented the new configuration options
Implementation Details
The default TTL logic distinguishes between:
defaultTTLnoExpiryCutoff): allows normal refresh behaviorThis ensures plugins that omit expiration timestamps are still cached effectively while preserving the refresh behavior for genuinely expired credentials.
https://claude.ai/code/session_01XP6Vo1jhL3S96g8hQ76umo