Documentation
¶
Overview ¶
Package jointoken is the codec for the compact join token that carries admin access to a freshly bootstrapped single-VPS k3s cluster from `burrow bootstrap` (run once on the VPS) to `burrow join` (run on the laptop) — ADR-0044. The bootstrap has the k3s admin kubeconfig rewritten to the node's public IP; it encodes the parts of that kubeconfig into one paste-able string, and the laptop decodes it to record admin access locally and land the scoped agent credential (ADR-0038).
The token is ADMIN-grade: it carries the cluster's admin credential (a client cert+key, or a bearer token), so it must be handled like a kubeconfig — transmitted over a private channel, not logged, and not committed. It is deliberately self-contained (no network round-trip to decode) and versioned so the format can evolve.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Token ¶
type Token struct {
// Version is the payload schema version; it must equal the prefix's version ("v1" today).
Version string `json:"version"`
// Server is the API server URL, e.g. https://<public-ip>:6443.
Server string `json:"server"`
// CertificateAuthorityData is the cluster CA certificate (PEM bytes).
CertificateAuthorityData []byte `json:"certificateAuthorityData"`
// ClientCertificateData and ClientKeyData carry the admin client certificate and key (k3s's
// admin credential). Both are set together, or both empty when BearerToken is used instead.
ClientCertificateData []byte `json:"clientCertificateData,omitempty"`
ClientKeyData []byte `json:"clientKeyData,omitempty"`
// BearerToken is an admin bearer token, the alternative to the client cert+key. Exactly one of
// {client cert+key, bearer token} is present in a valid token.
BearerToken string `json:"bearerToken,omitempty"`
// Namespace is the burrowd control-plane namespace on the bootstrapped cluster.
Namespace string `json:"namespace"`
// ContextName is the kube context (and cluster) name to record admin access under locally, and
// the name the environment handle points at.
ContextName string `json:"contextName"`
}
Token is the decoded join token (ADR-0044). It carries everything `burrow join` needs to reach the freshly bootstrapped cluster as admin and to record it locally:
- Server + CertificateAuthorityData locate and authenticate the API server;
- exactly one admin credential form — a client cert+key (k3s's admin) or a bearer token;
- Namespace is the burrowd control-plane namespace on the cluster;
- ContextName is the kube context/cluster name to record admin access under locally.
It is ADMIN-grade (see the package doc): treat a Token, and its encoded form, like a kubeconfig.
Source Files