CLOUDP-373260 Atlas Service Accounts support - phase 1#3323
Open
MaciejKaras wants to merge 17 commits intomainfrom
Open
CLOUDP-373260 Atlas Service Accounts support - phase 1#3323MaciejKaras wants to merge 17 commits intomainfrom
MaciejKaras wants to merge 17 commits intomainfrom
Conversation
MaciejKaras
commented
Apr 20, 2026
MaciejKaras
commented
Apr 20, 2026
MaciejKaras
force-pushed
the
CLOUDP-373260/service-accounts-phase-1
branch
2 times, most recently
from
db36adc to
be90f98
Compare
MaciejKaras
force-pushed
the
CLOUDP-373260/service-accounts-phase-1
branch
from
cec4603 to
1c17e19
Compare
4 tasks
josvazg
reviewed
Apr 23, 2026
Collaborator
|
Added label |
Adds a third guard to getServiceAccountAccessToken: after the staleness hash check, parse the access token Secret's expiry field and refuse a token whose RFC3339 expiry is missing, unparseable, or already past. The service-account-token controller is expected to refresh ahead of expiry; this check defends against controller lag or clock skew so the consumer never hands a downstream reconciler a token Atlas would already reject. Addresses PR #3323 review comment on credentials.go:144.
The pre-existing token Secret had no credentialsHash, so the staleness branch (hash mismatch against current creds) was the actual trigger for the refresh — the expired expiry was never exercised. Pre-populate a matching credentialsHash so only the expired expiry can drive the refresh.
Replace the four standalone t.Run subtests plus the inner four-case table with a single 8-case table. Each row carries credSecret + optional tokenSecret directly; the ref is derived from credSecret. A small tokenSecret() factory and a shared saCredSecret keep each row to its meaningful inputs. Resolves the dupl warnings from golangci-lint and gives all SA-path scenarios one consistent shape.
Match the table-driven shape used by TestGetConnectionConfig_*. Each row carries the input Secret data plus an expectedError string; the assertion uses require.EqualError for whole-message equality.
hash.Hash.Write is documented to never return an error, so the error paths in DeriveSecretName and CredentialsHash were dead code. Simplify both helpers to return only a string and update all callers.
igor-karpukhin
approved these changes
Apr 30, 2026
Collaborator
igor-karpukhin
left a comment
igor-karpukhin
left a comment
There was a problem hiding this comment.
LGTM. Great work @MaciejKaras! I tested it in my local cluster as well, it works 🎉
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds Service Account (OAuth 2.0) authentication support to the Atlas Kubernetes Operator. Users can supply
clientId/clientSecretin a Connection Secret; a newServiceAccountTokencontroller obtains short-lived bearer tokens and caches them for all reconcilers to consume. Existing API-key authentication is unchanged.See the Technical Design.
Related: #3329 — the Helm chart changes that expose these credentials via
helm install/--set.Proof of Work
Passing all new unit and e2e tests.
Checklist
Reminder (Please remove this when merging)