This is an automated email from the ASF dual-hosted git repository. smolnar82 pushed a commit to branch knox_idf in repository https://gitbox.apache.org/repos/asf/knox.git
commit 8f9789cf32e62e39c0e31377ec3545e33e1a5327 Author: hanicz <[email protected]> AuthorDate: Mon Jun 29 09:31:25 2026 +0200 KNOX-3364: New loadAliasesFromK8sSecrets method in entrypoint.sh to load aliases from k8s secrets. Install jq in the container as well. (#1282) (cherry picked from commit 2fdbda09d970522cd46cba8d36ccdc439246b611) --- .../src/main/resources/docker/Dockerfile | 3 +- .../main/resources/docker/gateway-entrypoint.sh | 47 ++++++++++++++++++++++ 2 files changed, 49 insertions(+), 1 deletion(-) diff --git a/gateway-docker/src/main/resources/docker/Dockerfile b/gateway-docker/src/main/resources/docker/Dockerfile index 7121de75d..f7926ba9b 100644 --- a/gateway-docker/src/main/resources/docker/Dockerfile +++ b/gateway-docker/src/main/resources/docker/Dockerfile @@ -30,7 +30,8 @@ RUN apt-get update && \ libnss3 \ bash \ passwd \ - curl && \ + curl \ + jq && \ apt-get clean && \ rm -rf /var/lib/apt/lists/* diff --git a/gateway-docker/src/main/resources/docker/gateway-entrypoint.sh b/gateway-docker/src/main/resources/docker/gateway-entrypoint.sh index 1d7eed82b..c2ea0dd6b 100755 --- a/gateway-docker/src/main/resources/docker/gateway-entrypoint.sh +++ b/gateway-docker/src/main/resources/docker/gateway-entrypoint.sh @@ -35,6 +35,8 @@ # TRUSTSTORE_IMPORTS="myRootCA:/mountedpath/enterprise_root_cert.pem myBizPartnerCA:/mountedpath/mybiz_partner_cert.pem" # Description: # This will import the specified certificates into the truststore JKS with the provided alias name(s) during the container startup process. +# - KNOX_ALIAS_LABEL - (optional) label selector used to discover Knox alias +# Secrets in the pod's namespace, default 'knox.apache.org/alias=true'. set -e @@ -92,6 +94,49 @@ saveAlias() { fi } +## Helper function to load Knox aliases from labeled Kubernetes Secrets. +loadAliasesFromK8sSecrets() { + local sa_token_file="/var/run/secrets/kubernetes.io/serviceaccount/token" + local sa_ca_file="/var/run/secrets/kubernetes.io/serviceaccount/ca.crt" + local sa_ns_file="/var/run/secrets/kubernetes.io/serviceaccount/namespace" + local label="${KNOX_ALIAS_LABEL:-knox.apache.org/alias=true}" + + if [[ ! -r ${sa_token_file} || ! -r ${sa_ca_file} || ! -r ${sa_ns_file} ]]; then + echo "ServiceAccount token not mounted; skipping k8s-sourced Knox aliases" + return 0 + fi + + echo "Loading Knox aliases from labeled k8s Secrets (label: ${label}) ..." + local namespace token resp_file http_code secret_names + namespace=$(/bin/cat "${sa_ns_file}") + token=$(/bin/cat "${sa_token_file}") + resp_file=$(mktemp) + + http_code=$(curl -sS \ + --cacert "${sa_ca_file}" \ + -H "Authorization: Bearer ${token}" \ + -o "${resp_file}" -w "%{http_code}" \ + "https://kubernetes.default.svc/api/v1/namespaces/${namespace}/secrets?labelSelector=${label}";) || http_code="000" + + if [[ ${http_code} != "200" ]]; then + echo "WARN: failed to list Knox alias Secrets from k8s API (HTTP ${http_code}); continuing without k8s aliases" + /bin/rm -f "${resp_file}" + return 0 + fi + + secret_names=$(jq -r '.items[].metadata.name' "${resp_file}" | tr '\n' ' ') || secret_names="" + /bin/rm -f "${resp_file}" + + if [[ -z ${secret_names} ]]; then + echo "No labeled Knox alias Secrets found" + return 0 + fi + + # shellcheck disable=SC2086 + /home/knox/knox/bin/knoxcli.sh create-k8s-alias ${secret_names} --namespace "${namespace}" + echo "Knox aliases loaded from k8s Secrets: ${secret_names}" +} + export GATEWAY_SERVER_RUN_IN_FOREGROUND=true @@ -131,6 +176,8 @@ else /home/knox/knox/bin/knoxcli.sh generate-jwk --saveAlias knox.token.hash.key fi +loadAliasesFromK8sSecrets + # If keystore dir is empty use default one if [[ -z ${KEYSTORE_DIR} ]] then
