How to use this client with TokenVolume Projection

[omerlh]

Hey,
I tried looking at the code but I couldn't figure how to do it. I am trying to use the more secure TokenVolume Projection to load short lived token instead of the long lived one, but I can't figure how to do it.

Can you please help me out with some examples?

[brendandburns]

You should use the tokenFile auth provider, there is an example here that uses the service account token:

https://github.com/kubernetes-client/javascript/blob/master/src/config.ts#L237

javascript/src/file_auth.ts

Line 13 in 088193a

return user.authProvider && user.authProvider.config && user.authProvider.config.tokenFile;

Hope that helps.

[omerlh]

So I guess I can't use the loadFromCluster method and has to copy most of it?

[brendandburns]

Are you trying to load from a file? Or from the service account in a Pod?

If you are trying to load from a service account in a Pod, loadFromCluster should just work.

Can you provide more details about your scenario?

[omerlh]

If I understand the code correctly, the code use the default long lived service account token (but maybe this is where I am wrong). I want to stop using the default token of the service account and use the TokenVolume projection to load a short lived token to a file and use this for authentication as it's more secure. Hope this is clearer.

[brendandburns]

ok, for that use case I would write a kubeconfig file that points to the right file location (using the tokenFile auth handler) and include that kubeconfig file in your Pod. Then you can use the methods that load a config from a file.

[omerlh]

What do you think about a PR supporting token volume projection? Given this is the recommended method and the more secure one. I can change loadFromCluster to support another env var, like TOKEN_FILE_LOCATION or something like that

[brendandburns]

Sure, if you want to send a PR for this that works for me.