jetstack-secure
jetstack-secure copied to clipboard
feat: add cluster uid derived from kube-system ns
This seems like a simple enough way of uniquely identifying a cluster. Google searches show that this pattern is used elsewhere.
It seems fair to assume that if the kube-system ns UID changes, it implies that the cluster changed enough to be considered different anyway!
This is added to the context so it can be used elsewhere, on the assumption that it can be determined at startup and won't change later. We'll use this for "machinehub mode" soon.
Possible work still needed (i.e., we need to decide if the below are acceptable before we merge):
- [ ] Is it OK to hard-fail if we can't determine this on startup (i.e. if the agent isn't run in a k8s cluster or we don't have permission to get namespaces)?
- Probably not; we might need to add a dummy value if we can't determine the UID
- Also, that means that MachineHub mode won't work
- [ ] Should we add the option to error if unable to retrieve the UID from context, instead of
panicing?