Affected by GO-2025-3696 and 3 other vulnerabilities

GO-2025-3696: Gardener allows bypassing project secret validation which can lead to privilege escalation in github.com/gardener/gardener

GO-2025-3698: Gardener allows metadata injection for a project secret which can lead to privilege escalation in github.com/gardener/gardener

GO-2026-6568: Gardener: Authorization Bypass via Group Subject Injection in gardener/gardener

tokenrequest

package

v1.77.3 Latest Latest Go to latest Published: Sep 7, 2023 License: Apache-2.0, BSD-2-Clause, MIT, + 1 more Imports: 16 Imported by: 5

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/gardener/gardener

Links

Open Source Insights

Documentation ¶

Index ¶

func GenerateGenericTokenKubeconfig(ctx context.Context, secretsManager secretsmanager.Interface, ...) (*corev1.Secret, error)
func IsTokenPopulated(secret *corev1.Secret) (bool, error)
func RenewAccessSecrets(ctx context.Context, c client.Client, opts ...client.ListOption) error

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func GenerateGenericTokenKubeconfig ¶

func GenerateGenericTokenKubeconfig(ctx context.Context, secretsManager secretsmanager.Interface, namespace, kubeAPIServerAddress string) (*corev1.Secret, error)

GenerateGenericTokenKubeconfig generates a generic token kubeconfig in the given namespace for the given kube-apiserver address

func IsTokenPopulated ¶

func IsTokenPopulated(secret *corev1.Secret) (bool, error)

IsTokenPopulated checks if a `kubeconfig` secret already contains a token.

func RenewAccessSecrets ¶

func RenewAccessSecrets(ctx context.Context, c client.Client, opts ...client.ListOption) error

RenewAccessSecrets drops the serviceaccount.resources.gardener.cloud/token-renew-timestamp annotation from all access secrets selected by the given list options. This will make the token-requestor controller in gardener-resource-manager/gardenlet issue new tokens immediately.

Types ¶

This section is empty.

Source Files ¶

View all Source files

secrets.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL