Capture LastUsed time for ClusterAuthTokens

[andreas-kupries]

rancher/rancher#45732

Related changes:

• Capture last used time for Tokens rancher#46313
• Validate LastUsedAt for Token and ClusterAuthToken webhook#480

If ACE was used to authenticate a request capture the last used time for the token in the corresponding ClusterAuthToken, which is then sync'ed back to the upstream Token object.

[andreas-kupries]

Interesting trick with an anonymous nested function to get an early block abort without aborting the outer sequence.

Given that k-a-a is unversioned how does it work now distinguishing an old rancher not supporting last-used-at, versus one which supports it ?

[pmatseykanets]

Given that k-a-a is unversioned how does it work now distinguishing an old rancher not supporting last-used-at, versus one which supports it?

It is versioned, it's just the same version can be (but doesn't have to be) used across multiple release lines. The version is pinned here. We can tag this change with v0.3.0 and use it only for v2.10+ leaving the room for potential updates/hotfixes for lower release lines. Now even without that, since the field is optional it may work just fine as is, needs to be tested well though.

[andreas-kupries]

Given that k-a-a is unversioned how does it work now distinguishing an old rancher not supporting last-used-at, versus one which supports it?

It is versioned, it's just the same version can be (but doesn't have to be) used across multiple release lines. The version is pinned here. We can tag this change with v0.3.0 and use it only for v2.10+ leaving the room for potential updates/hotfixes for lower release lines. Now even without that, since the field is optional it may work just fine as is, needs to be tested well though.

💡