Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

warn users when they create tokens on sites without link access #1958

Open
pwright opened this issue Feb 13, 2025 · 1 comment
Open

warn users when they create tokens on sites without link access #1958

pwright opened this issue Feb 13, 2025 · 1 comment
Assignees

Comments

@pwright
Copy link
Member

pwright commented Feb 13, 2025

Is your feature request related to a problem? Please describe.

After performing the hello world example using v2 preview 2, you can do the following in east ns, even tho link access is disabled:

$ skupper token issue ~/token.yaml
Waiting for token status ...

Grant "east-91a87489-8768-44f8-b911-f9d15e932147" is ready
Token file /home/paulwright/token.yaml created

Transfer this file to a remote site. At the remote site,
create a link to this site using the "skupper token redeem" command:

        skupper token redeem <file>

The token expires after 1 use(s) or after 15m0s.

This token can never be redeemed.

Describe the solution you'd like

A message, something like:

'Link access is not enabled. This token cannot be redeemed.'

Describe alternatives you've considered

Disable 'token issue' for sites that do not have link access enabled.
would require more code for an edge case (grant server enabled, but also a site without link access)

Additional context

The token issue cmd works because the west site on same cluster has link access enabled and therefore:

$ kubectl -n skupper get svc
NAME                   TYPE           CLUSTER-IP     EXTERNAL-IP    PORT(S)          AGE
skupper-grant-server   LoadBalancer   10.111.69.54   10.111.69.54   9090:30984/TCP   36m

Depending on the solution implemented, we should consider updating wording at https://skupperproject.github.io/refdog/commands/token/issue.html

@lynnemorrison lynnemorrison self-assigned this Feb 18, 2025
@lynnemorrison
Copy link
Collaborator

@ssorj @nluaces What I'm thinking is that in the code when creating the token, we verify that there is an active site before creating the token. I will also add a check that the site has LinkAccess enabled. If not enabled, then add a warning and not create the token.

"A site must have link access enabled before a token can be created."

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants