66
77import com .fasterxml .jackson .core .JsonProcessingException ;
88import com .fasterxml .jackson .databind .ObjectMapper ;
9+ import com .oracle .bmc .auth .ServiceAccountTokenSupplier ;
910import com .oracle .bmc .auth .SessionKeySupplier ;
1011import com .oracle .bmc .auth .internal .AbstractFederationClient ;
1112import com .oracle .bmc .auth .internal .AuthUtils ;
@@ -41,13 +42,12 @@ public class OkeWorkloadIdentityResourcePrincipalsFederationClient
4142 private static final Logger LOG =
4243 org .slf4j .LoggerFactory .getLogger (
4344 OkeWorkloadIdentityResourcePrincipalsFederationClient .class );
44- private final String KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH =
45- "/var/run/secrets/kubernetes.io/serviceaccount/token" ;
4645 private final String AUTHORIZATION_HEADER = "Authorization" ;
4746 private final String OPC_REQUEST_ID_HEADER = "opc-request-id" ;
4847 private static final String JWT_FORMAT = "Bearer %s" ;
4948 private final String KUBERNETES_SERVICE_HOST = "KUBERNETES_SERVICE_HOST" ;
5049 private final int PROXYMUX_SERVER_PORT = 12250 ;
50+ private final ServiceAccountTokenSupplier serviceAccountTokenSupplier ;
5151
5252 /**
5353 * The authentication provider to sign the internal requests.
@@ -64,6 +64,7 @@ public class OkeWorkloadIdentityResourcePrincipalsFederationClient
6464 public OkeWorkloadIdentityResourcePrincipalsFederationClient (
6565 String federationEndpoint ,
6666 SessionKeySupplier sessionKeySupplier ,
67+ ServiceAccountTokenSupplier serviceAccountTokenSupplier ,
6768 OkeTenancyOnlyAuthenticationDetailsProvider okeTenancyOnlyAuthenticationDetailsProvider ,
6869 ClientConfigurator clientConfigurator ,
6970 CircuitBreakerConfiguration circuitBreakerConfiguration ) {
@@ -76,7 +77,7 @@ public OkeWorkloadIdentityResourcePrincipalsFederationClient(
7677 okeTenancyOnlyAuthenticationDetailsProvider ,
7778 clientConfigurator ,
7879 circuitBreakerConfiguration );
79-
80+ this . serviceAccountTokenSupplier = serviceAccountTokenSupplier ;
8081 this .provider = okeTenancyOnlyAuthenticationDetailsProvider ;
8182 }
8283
@@ -88,15 +89,18 @@ public OkeWorkloadIdentityResourcePrincipalsFederationClient(
8889 */
8990 @ Override
9091 public String getSecurityToken () {
92+ SecurityTokenAdapter securityTokenAdapter = getSecurityTokenAdapter ();
9193 try {
9294 Duration time = Duration .ZERO ;
93- if (getSecurityTokenAdapter ().isValid ()) {
94- time = getSecurityTokenAdapter ().getTokenValidDuration ().dividedBy (2 );
95+ if (securityTokenAdapter .isValid ()) {
96+ if (securityTokenAdapter .getTokenValidDuration () != null ) {
97+ time = securityTokenAdapter .getTokenValidDuration ().dividedBy (2 );
98+ }
9599 }
96100 return refreshAndGetSecurityTokenIfExpiringWithin (time );
97101 } catch (Exception e ) {
98102 LOG .info ("Refresh RPST token failed, use cached RPST token." , e );
99- return getSecurityTokenAdapter () .getSecurityToken ();
103+ return securityTokenAdapter .getSecurityToken ();
100104 }
101105 }
102106
@@ -123,14 +127,7 @@ protected Response makeCallToOke(
123127 protected SecurityTokenAdapter getSecurityTokenFromServer () {
124128 LOG .info ("Getting security token from the proxymux server" );
125129 //Get service account token.
126- String token = null ;
127- try {
128- token =
129- new String (
130- Files .readAllBytes (Paths .get (KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH )));
131- } catch (IOException e ) {
132- throw new IllegalArgumentException ("Kubernetesservice account token doesn't exist." , e );
133- }
130+ String token = serviceAccountTokenSupplier .getServiceAccountToken ();
134131
135132 //Generate private/public key pair.
136133 KeyPair keyPair = sessionKeySupplier .getKeyPair ();
@@ -182,7 +179,7 @@ protected SecurityTokenAdapter getSecurityTokenFromServer() {
182179 // Remove duplicated "ST$" for the token.
183180 String jwtToken = getOkeResourcePrincipalSessionTokenResponse .getToken ().substring (3 );
184181
185- // Create security token based on the reponse .
182+ // Create security token based on the response .
186183 X509FederationClient .SecurityToken securityToken =
187184 new X509FederationClient .SecurityToken (jwtToken );
188185 return new SecurityTokenAdapter (securityToken .getToken (), sessionKeySupplier );
0 commit comments