chore(deployment tooling): Update Prowler API with rotating K8S access keys #6986
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Context
newer versions of the kubernetes API do not allow long-lived/non-expiring tokens to be bound to a service account, while there are workarounds, certain clusters (Auto EKS from my current experience and others on the Community Slack) do now allow non-expiring tokens and force the TTL/Expiry down to a global value.
Solution here is the Kubernetes-documented way to access rotating service credentials, via a 'projected' volume type into a POD inside the k8s cluster; which will provide a mount with a rotating token for that service account.
Example Pod Snippet:
This PR adds a simple deployment, running a pod, mounting the existing prowler
prowler-ns/prowler-sa
service account and a filesystem listener to auto update our Prowler API with any auth changes.Description
See documentation in PR.
Checklist
API
License
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.