Skip to content

Commit

Permalink
Remove token and caching details, being implemented separately
Browse files Browse the repository at this point in the history
Signed-off-by: Dipti Pai <[email protected]>
  • Loading branch information
diptipai89 committed May 16, 2024
1 parent 067180b commit fe52c15
Showing 1 changed file with 0 additions and 21 deletions.
21 changes: 0 additions & 21 deletions rfcs/0006-git-repo-passwordless-auth/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -186,24 +186,3 @@ token](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-
This token is then used as the password and [`x-access-token` as the username](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/choosing-permissions-for-a-github-app#choosing-permissions-for-git-access)
to perform HTTP basic authentication.

### Token Caching and Refreshing

To avoid calling the upstream API for a token during every reconciliation, Flux
controllers shall cache the token after fetching it. Since GitHub tokens
self-expire, the cache shall automatically evict the token after it has expired,
triggering a fetch of a fresh token.
For GCP, the [`TokenSource`](https://pkg.go.dev/golang.org/x/[email protected]#TokenSource)
object will be cached, since it automatically handles refreshing an expired
token and always returns a valid token. Since a `TokenSource` never expires, it
need not be evicted from the cache.
While Azure's managed identities subsystem caches the token, it is
[recommended for the consumer application to implement their own caching](https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-to-use-vm-token#token-caching)
as well.
The caches for all three providers are separate, i.e. there shall exist a
dedicated cache for each provider.

Since the proposed authentication methods for GitHub and GCP involve some form
of credentials stored in a Kubernetes Secret, the cache key can be the Secret's
`<namespace/name>`. Since authentication for Azure is configured directly via
the source-controller Deployment, the token can just be stored in a global
variable, which is refreshed whenever the token expires.

0 comments on commit fe52c15

Please sign in to comment.