@knowttl/kubernetes-axi 0.0.0-stage → 0.1.0

package/dist/native.js

@@ -0,0 +1,143 @@
+import { execFile } from 'node:child_process';
+import { createServer } from 'node:net';
+import { chmod, rm } from 'node:fs/promises';
+import { delimiter, dirname, isAbsolute, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
+import { Failure } from './errors.js';
+import { readPrivate, writePrivate } from './private-files.js';
+const execute = promisify(execFile);
+export async function inspectNative(binary, snapshot, redactor, signal) {
+    try {
+        const result = await execute(binary, ['--kubeconfig', snapshot, 'config', 'view', '--merge=false', '--raw', '-o', 'json'], { signal, timeout: 5000, maxBuffer: 4 * 1024 * 1024 });
+        const config = JSON.parse(result.stdout);
+        for (const { user } of config.users ?? [])
+            if (user) {
+                redactor.register(...['token', 'password'].map(key => typeof user[key] === 'string' ? user[key] : undefined));
+                for (const key of ['client-key-data', 'client-certificate-data'])
+                    if (typeof user[key] === 'string')
+                        redactor.register(Buffer.from(user[key], 'base64').toString());
+                const helper = user.exec;
+                if (helper)
+                    redactor.register(...(helper.env ?? []).map(item => item.value));
+            }
+        return config;
+    }
+    catch {
+        throw new Failure('CONFIG_INVALID', 'The selected native kubeconfig is invalid.');
+    }
+}
+export async function nativeConfig(binary, selection, context, directory, trustExec, redactor, signal, resourceMutation) {
+    const paths = selection === 'ambient' ? (process.env.KUBECONFIG ? process.env.KUBECONFIG.split(delimiter).filter(Boolean) : [join((await import('node:os')).homedir(), '.kube', 'config')]) : [selection];
+    if (!paths.length || paths.some(path => !isAbsolute(path)))
+        throw new Failure('CONFIG_INVALID', 'Select absolute native kubeconfig paths.');
+    const merged = { clusters: [], users: [], contexts: [] };
+    const origins = new Map();
+    for (const [index, path] of paths.entries()) {
+        let contents;
+        try {
+            contents = await readPrivate(path, false);
+        }
+        catch (error) {
+            if (selection === 'ambient' && error.code === 'ENOENT')
+                continue;
+            throw error;
+        }
+        const snapshot = join(directory, `source-${index}.json`);
+        await writePrivate(snapshot, contents);
+        let parsed;
+        try {
+            parsed = await inspectNative(binary, snapshot, redactor, signal);
+        }
+        finally {
+            await rm(snapshot, { force: true });
+        }
+        for (const key of ['clusters', 'users', 'contexts']) {
+            for (const entry of parsed[key] ?? [])
+                if (!merged[key].some(existing => existing.name === entry.name)) {
+                    merged[key].push(entry);
+                    origins.set(entry, path);
+                }
+        }
+        if (!merged['current-context'] && parsed['current-context'])
+            merged['current-context'] = parsed['current-context'];
+    }
+    const name = context ?? merged['current-context'];
+    const selected = merged.contexts.find(entry => entry.name === name)?.context;
+    const clusterEntry = merged.clusters.find(entry => entry.name === selected?.cluster);
+    const userEntry = merged.users.find(entry => entry.name === selected?.user);
+    if (!selected || !clusterEntry?.cluster || !userEntry?.user)
+        throw new Failure('CONFIG_INVALID', 'Select an existing native context with a cluster and identity.');
+    const cluster = { ...clusterEntry.cluster };
+    const user = { ...userEntry.user };
+    if (user.exec && resourceMutation)
+        throw new Failure('AUTH_HELPER_MUTATION_UNAVAILABLE', 'ExecCredential helper identities cannot prepare, confirm or server-dry-run resource mutations until principal binding is supported. Use a static token or client-certificate identity.');
+    if (['as', 'as-uid', 'as-groups', 'as-user-extra'].some(field => Object.hasOwn(user, field)))
+        throw new Failure('USAGE', 'Native kubeconfig impersonation is unavailable under the isolated bounded-read policy (impersonation).', 2);
+    const server = new URL(String(cluster.server));
+    if (server.protocol !== 'https:' || server.username || server.password || cluster['insecure-skip-tls-verify'] || cluster['proxy-url'])
+        throw new Failure('CONFIG_INVALID', 'Native contexts require verified HTTPS without a proxy override.');
+    if (user['auth-provider'] || user.tokenFile || user.username || user.password)
+        throw new Failure('CONFIG_INVALID', 'Use native token, certificate or a trusted ExecCredential helper.');
+    for (const [target, entry, field, secret] of [[cluster, clusterEntry, 'certificate-authority', false], [user, userEntry, 'client-certificate', false], [user, userEntry, 'client-key', true]]) {
+        if (target[field] && !target[`${field}-data`])
+            target[`${field}-data`] = Buffer.from(await readPrivate(resolve(dirname(origins.get(entry)), String(target[field])), secret)).toString('base64');
+        delete target[field];
+    }
+    if (!cluster['certificate-authority-data'])
+        throw new Failure('CONFIG_INVALID', 'Supply explicit native certificate authority trust.');
+    if (!user.exec && !user.token && !(user['client-certificate-data'] && user['client-key-data']))
+        throw new Failure('AUTH_REQUIRED', 'Supply authentication in the selected native identity.');
+    redactor.register(typeof user.token === 'string' ? user.token : undefined, ...['client-key-data', 'client-certificate-data'].map(key => typeof user[key] === 'string' ? Buffer.from(user[key], 'base64').toString() : undefined));
+    const binding = JSON.stringify({ cluster, user, context: name, namespace: selected.namespace ?? 'default' });
+    let close = async () => { };
+    if (user.exec) {
+        if (!trustExec)
+            throw new Failure('AUTH_HELPER_UNTRUSTED', 'Review the selected helper, then opt in with --trust-exec. Its existing cache remains helper-owned.');
+        if (process.platform === 'win32')
+            throw new Failure('AUTH_HELPER_UNAVAILABLE', 'Native Windows helper-channel commissioning is pending.');
+        const helper = user.exec;
+        if (!['client.authentication.k8s.io/v1', 'client.authentication.k8s.io/v1beta1'].includes(helper.apiVersion) || typeof helper.command !== 'string' || (helper.args && (!Array.isArray(helper.args) || helper.args.some(arg => typeof arg !== 'string'))) || !['Never', 'IfAvailable', undefined].includes(helper.interactiveMode))
+            throw new Failure('AUTH_HELPER_UNAVAILABLE', 'Select a supported non-interactive ExecCredential helper.');
+        const command = helper.command.includes('/') ? resolve(dirname(origins.get(userEntry)), helper.command) : helper.command;
+        const socketPath = join(directory, 'exec.sock');
+        let acquisitions = 0;
+        const server = createServer({ allowHalfOpen: true }, socket => {
+            let request = '';
+            socket.setEncoding('utf8');
+            socket.on('error', () => { });
+            socket.on('data', chunk => { request += chunk; if (request.length > 1024 * 1024)
+                socket.destroy(); });
+            socket.on('end', () => {
+                void (async () => {
+                    try {
+                        if (++acquisitions > 64)
+                            throw new Error('bounded');
+                        const input = JSON.parse(request);
+                        const env = { ...process.env, ...Object.fromEntries((helper.env ?? []).map(item => [item.name, item.value])), KUBERNETES_EXEC_INFO: input.info };
+                        const result = await execute(command, helper.args ?? [], { env, signal, timeout: 8000, maxBuffer: 1024 * 1024 });
+                        const credential = JSON.parse(result.stdout);
+                        const status = credential.status;
+                        if (credential.apiVersion !== helper.apiVersion || credential.kind !== 'ExecCredential' || !status || !((typeof status.token === 'string' && status.token.length > 0) || (typeof status.clientCertificateData === 'string' && typeof status.clientKeyData === 'string')) || (status.expirationTimestamp && !Number.isFinite(Date.parse(status.expirationTimestamp))))
+                            throw new Error('invalid');
+                        redactor.register(status.token, status.clientKeyData, status.clientCertificateData);
+                        // Nothing reaches kubectl until every newly acquired secret is registered.
+                        socket.end(JSON.stringify({ apiVersion: credential.apiVersion, kind: 'ExecCredential', status }));
+                    }
+                    catch {
+                        socket.end();
+                    }
+                })();
+            });
+        });
+        await new Promise((done, reject) => { server.once('error', reject); server.listen(socketPath, done); });
+        await chmod(socketPath, 0o600);
+        close = async () => { await new Promise(done => server.close(() => done())); };
+        user.exec = { apiVersion: helper.apiVersion, command: process.execPath, args: [fileURLToPath(new URL('./exec-shim.js', import.meta.url)), socketPath], interactiveMode: helper.interactiveMode ?? 'Never', provideClusterInfo: helper.provideClusterInfo ?? false };
+    }
+    return {
+        binding,
+        config: { apiVersion: 'v1', kind: 'Config', clusters: [{ name: 'selected', cluster }], users: [{ name: 'selected', user }], contexts: [{ name: name, context: { cluster: 'selected', user: 'selected', namespace: selected.namespace ?? 'default' } }], 'current-context': name },
+        source: `native:${paths.join(delimiter)} context:${name}; ambient exception; helper cache owned by helper`, namespace: selected.namespace ?? 'default', close,
+    };
+}

package/dist/private-files.d.ts

@@ -0,0 +1,9 @@
+export interface PrivateFileOptions {
+    platform?: NodeJS.Platform;
+    restrictAcl?: (path: string) => void;
+    verifyAcl?: (path: string) => void;
+    diagnostic?: boolean;
+}
+export declare function readPrivate(path: string, secret: boolean, options?: PrivateFileOptions): Promise<string>;
+export declare function privateDirectory(path: string, options?: PrivateFileOptions): Promise<void>;
+export declare function writePrivate(path: string, content: string, options?: PrivateFileOptions): Promise<void>;

package/dist/private-files.js

@@ -0,0 +1,137 @@
+import { constants } from 'node:fs';
+import { open, lstat, mkdir, chmod, rename, rm } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { setTimeout } from 'node:timers/promises';
+import { execFileSync } from 'node:child_process';
+import { Failure } from './errors.js';
+export async function readPrivate(path, secret, options = {}) {
+    const platform = options.platform ?? process.platform;
+    await unredirected(path);
+    const metadata = await lstat(path);
+    if (!metadata.isFile() || metadata.isSymbolicLink()) {
+        throw new Failure('CONFIG_INSECURE', `Use a regular, unredirected credential file: ${path}.`);
+    }
+    if (platform === 'win32' && options.diagnostic)
+        (options.verifyAcl ?? verifyWindows)(path);
+    const handle = await open(path, constants.O_RDONLY | (platform === 'win32' ? 0 : constants.O_NOFOLLOW));
+    try {
+        const stat = await handle.stat();
+        if (stat.dev !== metadata.dev || stat.ino !== metadata.ino || !stat.isFile() ||
+            (platform !== 'win32' && (stat.uid !== process.getuid?.() || (stat.mode & (secret ? 0o077 : 0o022)) !== 0))) {
+            throw new Failure('CONFIG_INSECURE', `Credential file must be owned by the current user; use chmod 600 ${path}.`);
+        }
+        return await handle.readFile('utf8');
+    }
+    finally {
+        await handle.close();
+    }
+}
+function verifyWindows(path) {
+    try {
+        execFileSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command',
+            '$ErrorActionPreference="Stop"; $acl=Get-Acl -LiteralPath $env:KUBERNETES_AXI_ACL_PATH; ' +
+                '$ids=@([System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value,"S-1-5-18","S-1-5-32-544"); ' +
+                'if(!$acl.AreAccessRulesProtected) { throw "Unprotected" }; ' +
+                'foreach($rule in $acl.Access) { $sid=$rule.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value; ' +
+                'if($rule.AccessControlType -ne "Allow" -or $sid -notin $ids) { throw "Unexpected access" } }; ' +
+                'foreach($sid in $ids) { if(!($acl.Access | Where-Object { $_.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value -eq $sid -and ($_.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -eq [System.Security.AccessControl.FileSystemRights]::FullControl })) { throw "Missing access" } }'], { env: { ...process.env, KUBERNETES_AXI_ACL_PATH: path }, stdio: 'ignore' });
+    }
+    catch {
+        throw new Failure('CONFIG_INSECURE', `Re-run the tool private write to protect the Windows ACL: ${path}.`);
+    }
+}
+function restrictWindows(path) {
+    // Paths travel through the child environment, never interpolated into PowerShell code.
+    execFileSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command',
+        '$ErrorActionPreference="Stop"; $p=$env:KUBERNETES_AXI_ACL_PATH; ' +
+            '$acl=Get-Acl -LiteralPath $p; $acl.SetAccessRuleProtection($true,$false); ' +
+            '$acl.Access | ForEach-Object { [void]$acl.RemoveAccessRuleSpecific($_) }; ' +
+            '$ids=@([System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value,"S-1-5-18","S-1-5-32-544"); ' +
+            'foreach($id in $ids) { $sid=New-Object System.Security.Principal.SecurityIdentifier($id); ' +
+            '$rule=if((Get-Item -LiteralPath $p).PSIsContainer) { New-Object System.Security.AccessControl.FileSystemAccessRule($sid,"FullControl","ContainerInherit,ObjectInherit","None","Allow") } else { New-Object System.Security.AccessControl.FileSystemAccessRule($sid,"FullControl","Allow") }; ' +
+            '$acl.AddAccessRule($rule) }; Set-Acl -LiteralPath $p -AclObject $acl'], { env: { ...process.env, KUBERNETES_AXI_ACL_PATH: path }, stdio: 'ignore' });
+}
+export async function privateDirectory(path, options = {}) {
+    const platform = options.platform ?? process.platform;
+    await unredirected(path, true);
+    const missing = [];
+    for (let current = path;; current = dirname(current)) {
+        try {
+            await lstat(current);
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            missing.push(current);
+        }
+    }
+    for (const directory of missing.reverse()) {
+        await mkdir(directory, { mode: 0o700 });
+        if (platform === 'win32')
+            (options.restrictAcl ?? restrictWindows)(directory);
+    }
+    if (platform !== 'win32') {
+        if ((await lstat(path)).uid !== process.getuid?.())
+            throw new Failure('CONFIG_INSECURE', 'Use a directory owned by the current user.');
+        await chmod(path, 0o700);
+    }
+    if (platform === 'win32' && !missing.includes(path))
+        (options.restrictAcl ?? restrictWindows)(path);
+}
+export async function writePrivate(path, content, options = {}) {
+    const platform = options.platform ?? process.platform;
+    await privateDirectory(dirname(path), options);
+    await unredirected(path, true);
+    try {
+        await readPrivate(path, true, options);
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    const temporary = join(dirname(path), `.private-${randomUUID()}`);
+    try {
+        const handle = await open(temporary, 'wx', 0o600);
+        try {
+            if (platform === 'win32')
+                (options.restrictAcl ?? restrictWindows)(temporary);
+            await handle.writeFile(content);
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        const deadline = Date.now() + 1000;
+        for (;;) {
+            try {
+                await rename(temporary, path);
+                break;
+            }
+            catch (error) {
+                if (platform !== 'win32' || !['EPERM', 'EBUSY', 'EACCES'].includes(error.code ?? '') || Date.now() >= deadline)
+                    throw error;
+                await setTimeout(50);
+            }
+        }
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+}
+async function unredirected(path, missing = false) {
+    for (let current = path;; current = dirname(current)) {
+        try {
+            const stat = await lstat(current);
+            if (stat.isSymbolicLink())
+                throw new Failure('CONFIG_INSECURE', 'Use an unredirected credential path; remove symbolic links or junctions.');
+        }
+        catch (error) {
+            if (!missing || error.code !== 'ENOENT')
+                throw error;
+        }
+        if (dirname(current) === current)
+            break;
+    }
+}

package/dist/protobuf-schema.d.ts

@@ -0,0 +1,2 @@
+import type { INamespace } from 'protobufjs';
+export declare const protobufSchema: INamespace;