Key cache on cluster server URL + user name when available - #2
Merged
Conversation
kcc-injector now sets provideClusterInfo on injected exec configs, so kubectl passes the target API server URL to kcc-cache via KUBERNETES_EXEC_INFO. kcc-cache uses that server URL together with the kubeconfig user name (KUBE_CREDENTIAL_CACHE_USER) as the cache key. This makes the key stable against cosmetic argv changes (avoiding needless re-auth) while still discriminating both the target cluster and the identity, so one user's credentials are never served for another on the same cluster. When the server URL is unavailable (provideClusterInfo not set, or a manual setup) it falls back to the previous argv + env key. Re-running `kcc-injector -i ~/.kube/config` once enables it; no other manual setup is required. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DHL4n3s3iBGwQR34JxpDn9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Makes the credential cache key more robust by keying on the kubeconfig user name + cluster API server URL when that URL is available, instead of relying solely on the command args + a hand-picked env allowlist.
This came out of a security review of the cache-key collision risk (serving one identity's cached credentials for another, or for the wrong cluster). The kubeconfig user name discriminates the identity; the server URL discriminates the target cluster — together they're both collision-resistant and stable against cosmetic argv changes (so you don't re-auth for trivial flag reordering).
Changes
kcc-injector: on inject, setsprovideClusterInfo: trueon each injected exec config, so kubectl passes the API server URL to the plugin viaKUBERNETES_EXEC_INFO. On restore, clears it back for entries it un-injects.kcc-cache: builds the cache key asuser=… server=…(reading the server URL fromKUBERNETES_EXEC_INFO) when the URL is present. Falls back to the previous argv + env-list key when it isn't (e.g.provideClusterInfonot set, or a manual setup). No new env vars, no new imports.Usage
No new manual setup — re-running
kcc-injector -i ~/.kube/configonce enables it (the injector flips onprovideClusterInfo; the user name is already injected).Notes
cache.jsonentries are re-fetched once and the old ones age out. Harmless.provideClusterInfo: truewas set manually before injecting, restore sets it to false (the tool doesn't record the original value) — consistent with how restore already handles the injected env var.🤖 Generated with Claude Code
Generated by Claude Code