Skip to content

Generate kubeconfigs only for warnet-user #772 #773

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pranitaurlam wants to merge 2 commits into from
Closed

Generate kubeconfigs only for warnet-user #772 #773

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f08069f
Limit kubeconfig generation to warnet-user service account
pranitaurlam Jan 28, 2026
3bb3ba6
Fix filter to exclude commander accounts instead of only allowing war…
pranitaurlam Jan 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions src/warnet/admin.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
K8sError,
get_cluster_of_current_context,
get_namespaces_by_type,
get_service_accounts_in_namespace,
get_warnet_user_service_accounts_in_namespace,
open_kubeconfig,
)
from .namespaces import copy_namespaces_defaults, namespaces
Expand Down Expand Up @@ -84,7 +84,7 @@ def create_kubeconfigs(kubeconfig_dir, token_duration):
for v1namespace in warnet_namespaces:
namespace = v1namespace.metadata.name
click.echo(f"Processing namespace: {namespace}")
service_accounts = get_service_accounts_in_namespace(namespace)
service_accounts = get_warnet_user_service_accounts_in_namespace(namespace)

for sa in service_accounts:
# Create a token for the ServiceAccount with specified duration
Expand Down
6 changes: 3 additions & 3 deletions src/warnet/k8s.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -489,14 +489,14 @@ def get_namespaces_by_type(namespace_type: str) -> list[V1Namespace]:
return [ns for ns in namespaces if ns.metadata.name.startswith(namespace_type)]


def get_service_accounts_in_namespace(namespace):
def get_warnet_user_service_accounts_in_namespace(namespace):
"""
Get all service accounts in a namespace. Returns an empty list if no service accounts are found in the specified namespace.
"""
command = f"kubectl get serviceaccounts -n {namespace} -o jsonpath={{.items[*].metadata.name}}"
# skip the default service account created by k8s
# skip the default service account created by k8s and commander service accounts created by scenarios
service_accounts = run_command(command).split()
return [sa for sa in service_accounts if sa != "default"]
return [sa for sa in service_accounts if sa != "default" and not sa.startswith("commander-")]
Copy link
Contributor

@pinheadmz pinheadmz Jan 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd rather not use any more name parsing magic this in warnet. I think a better approach would be to add a tag to the ServiceAccounts we create for users in deploy_namespaces() which would probably actually mean adding metadata to the chart in resources/charts/namespaces/templates/rolebinding.yaml and then here in this function, we filter for SA's with the right tag.



def can_delete_pods(namespace: Optional[str] = None) -> bool:
Expand Down
Loading