@elinpf/dsh-ops-access-k8s 0.1.7 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/lib/index.js +1 -0
  2. package/package.json +3 -3
package/lib/index.js CHANGED
@@ -31,6 +31,7 @@ export const provider = {
31
31
  schema: entrySchema,
32
32
  fieldsDoc: 'kubeconfig: path to the kubeconfig file (~ is expanded)',
33
33
  fileFields: ['kubeconfig'],
34
+ knownLimits: 'the ro tier is a ServiceAccount bound to the built-in view ClusterRole: cluster-scoped resources (nodes, persistentvolumes, storageclasses, volumeattachments) and Secret contents are NOT readable — a Forbidden there is the credential boundary, not a cluster fault; do not retry it, inspect nodes over ssh instead',
34
35
  derivationDoc: "from the rw kubeconfig: create a ServiceAccount named <id>-ro (naming convention), bind it to the built-in view ClusterRole (read-most, no Secret contents), mint a long-lived token via a Secret of type kubernetes.io/service-account-token for the SA (kubectl create token output expires); extract the cluster server and CA with kubectl config view --raw (without --raw the CA shows as DATA+OMITTED); build the ro kubeconfig reusing the rw cluster entry, naming both context and user <id>-ro and setting current-context to <id>-ro (kubectl cannot select a context without it); register it via register_access; then verify BOTH directions — kubectl get pods must succeed and a write attempt (e.g. kubectl create configmap ro-write-check --dry-run=server) must be forbidden. If every rw call fails with 'context was not found', the rw kubeconfig's current-context is broken — report it to the operator instead of working around it with --context",
35
36
  process(entry) {
36
37
  const { kubeconfig } = entry;
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@elinpf/dsh-ops-access-k8s",
3
- "version": "0.1.7",
3
+ "version": "0.2.0",
4
4
  "description": "Ops access provider for Kubernetes — validates k8s registry entries and expands kubeconfig paths.",
5
5
  "type": "module",
6
6
  "main": "lib/index.js",
@@ -40,14 +40,14 @@
40
40
  "peerDependencies": {
41
41
  "@deepseek-ai/cordis": "^4.0.1",
42
42
  "@deepseek-ai/dsh-invariants": "^0.1.0-rc.8",
43
- "@elinpf/dsh-ops-access": "^0.1.7"
43
+ "@elinpf/dsh-ops-access": "^0.2.0"
44
44
  },
45
45
  "devDependencies": {
46
46
  "@deepseek-ai/cordis": "4.0.1",
47
47
  "typescript": "^5.4.0",
48
48
  "vitest": "^4.1.11",
49
49
  "@types/node": "^22.0.0",
50
- "@elinpf/dsh-ops-access": "0.1.7"
50
+ "@elinpf/dsh-ops-access": "0.2.0"
51
51
  },
52
52
  "license": "MIT",
53
53
  "publishConfig": {