feat: initial implementation

.github/dependabot.yml

@@ -0,0 +1,50 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      security:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
+      actions:
+        applies-to: version-updates
+        patterns:
+          - "*"
+
+  - package-ecosystem: gomod
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      security:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
+      metal-stack:
+        applies-to: version-updates
+        patterns:
+          - "github.com/metal-stack/*"
+          - "google.golang.org/protobuf"
+          - "connectrpc.com/*"
+
+      other:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
+        patterns:
+          - "*"
+        exclude-patterns:
+          - "github.com/metal-stack/*"
+          - "google.golang.org/protobuf"
+          - "connectrpc.com/*"

.github/workflows/metal-stack-component.yaml

@@ -0,0 +1,27 @@
+---
+name: metal-stack component release
+
+on:
+  pull_request:
+    branches:
+      - main
+  release:
+    types:
+      - published
+  push:
+    branches:
+      - main
+
+jobs:
+  draft:
+    uses: metal-stack/actions-common/.github/workflows/release-drafter.yaml@v1
+
+  spell-check:
+    uses: metal-stack/actions-common/.github/workflows/spell-check.yaml@v1
+
+  go-build:
+    uses: metal-stack/actions-common/.github/workflows/go-build.yaml@v1
+    secrets: inherit
+    with:
+      test-command: make test
+      build-command: make token-refresher

.gitignore

@@ -7,6 +7,7 @@
 *.dll
 *.so
 *.dylib
+bin
 
 # Test binary, built with `go test -c`
 *.test

CODEWONERS

@@ -0,0 +1 @@
+*	@metal-stack/metal-token-refresher-maintainers

Dockerfile

@@ -0,0 +1,5 @@
+# nonroot cannot be chosen because the lack of permissions
+# to write the kubeconfig and token file into the desired place in the fs
+FROM gcr.io/distroless/static-debian13:latest
+COPY bin/token-refresher /token-refresher
+CMD ["/token-refresher"]

Makefile

@@ -0,0 +1,38 @@
+SHA := $(shell git rev-parse --short=8 HEAD)
+GITVERSION := $(shell git describe --long --all)
+# gnu date format iso-8601 is parsable with Go RFC3339
+BUILDDATE := $(shell date --iso-8601=seconds)
+VERSION := $(or ${VERSION},$(shell git describe --tags --exact-match 2> /dev/null || git symbolic-ref -q --short HEAD || git rev-parse --short HEAD))
+
+CGO_ENABLED := 1
+LINKMODE := -extldflags '-static -s -w'
+
+ifeq ($(CI),true)
+  GO_TEST_ARGS=-p 1 -count=1
+else
+  GO_TEST_ARGS=
+endif
+
+all: fmt test token-refresher
+
+.PHONY: token-refresher
+token-refresher: fmt
+	go build -tags netgo,osusergo,urfave_cli_no_docs \
+		 -ldflags "$(LINKMODE) -X 'github.com/metal-stack/v.Version=$(VERSION)' \
+								   -X 'github.com/metal-stack/v.Revision=$(GITVERSION)' \
+								   -X 'github.com/metal-stack/v.GitSHA1=$(SHA)' \
+								   -X 'github.com/metal-stack/v.BuildDate=$(BUILDDATE)'" \
+	   -o bin/token-refresher github.com/metal-stack/metal-token-refresher/cmd/token-refresher
+	strip bin/token-refresher
+
+.PHONY: test
+test:
+	go test ./... -race -coverpkg=./... -coverprofile=coverage.out -covermode=atomic $(GO_TEST_ARGS) -timeout=300s && go tool cover -func=coverage.out
+
+.PHONY: fmt
+fmt:
+	go fmt ./...
+
+.PHONY: golint
+golint:
+	golangci-lint run -p bugs -p unused -D protogetter

README.md

@@ -1,2 +1,87 @@
 # metal-token-refresher
-Refreshes metal-apiserver tokens
+
+Refreshes metal-apiserver-tokens stored in Kubernetes secrets as a CronJob.
+
+## Configuration
+
+To configure the metal-token-refresher to refresh a secret, set the following environment variables accordingly.
+
+- `METAL_APISERVER_URL`
+- `TOKEN_SECRET_NAMESPACE`
+- `TOKEN_SECRET_NAME`
+- `TOKEN_SECRET_KEY`
+
+```yaml
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: metal-token-refresher
+spec:
+  schedule: "@hourly"
+  jobTemplate:
+    metadata:
+      name: metal-token-refresher
+    spec:
+      template:
+        spec:
+          serviceAccountName: metal-token-refresher
+          restartPolicy: OnFailure
+          containers:
+          - name: token-refresher
+            image: ghcr.io/metal-stack/metal-token-refresher
+            env:
+            - name: METAL_APISERVER_URL
+              value: http://metal-apiserver:8080
+            - name: TOKEN_SECRET_NAMESPACE
+              value: "metal-control-plane"
+            - name: TOKEN_SECRET_NAME
+              value: "token-secret"
+            - name: TOKEN_SECRET_KEY
+              value: "token"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: token-secret
+data:
+  token: "..."
+```
+
+Also make sure to configure the service account accordingly.
+
+```yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: metal-token-renewal
+  namespace: metal-stack
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: metal-console-token
+  namespace: metal-stack
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "update", "patch"]
+- apiGroups: [""]
+  resources: ["secrets"]
+  resourceNames: ["token-secret"]
+  verbs: ["get", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: metal-token-renewal
+  namespace: metal-stack
+subjects:
+- kind: ServiceAccount
+  name: metal-token-renewal
+  namespace: metal-stack
+roleRef:
+  kind: Role
+  name: metal-token-renewal
+  apiGroup: rbac.authorization.k8s.io
+```

cmd/token-refresher/main.go

@@ -0,0 +1,65 @@
+package main
+
+import (
+	"context"
+	"log/slog"
+	"os"
+
+	apiclient "github.com/metal-stack/api/go/client"
+	"github.com/metal-stack/metal-token-refresher/refresher"
+	"github.com/metal-stack/metal-token-refresher/spec"
+	"github.com/metal-stack/v"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+)
+
+func main() {
+	jsonHandler := slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{})
+	log := slog.New(jsonHandler)
+
+	log.Info("starting metal-token-refresher",
+		"version", v.Version,
+		"revision", v.Revision,
+		"git-sha1", v.GitSHA1,
+		"build-date", v.BuildDate,
+	)
+
+	cfg, err := spec.LoadConfig()
+	if err != nil {
+		log.Error("configuration error", "error", err)
+		os.Exit(1)
+	}
+
+	restCfg, err := rest.InClusterConfig()
+	if err != nil {
+		log.Error("failed to fetch in cluster rest config", "error", err)
+		os.Exit(1)
+	}
+	cs, err := kubernetes.NewForConfig(restCfg)
+	if err != nil {
+		log.Error("failed to create in cluster client", "error", err)
+		os.Exit(1)
+	}
+
+	log.Info("refreshing metal-apiserver token", "metal-apiserver-url", cfg.MetalAPIServerURL)
+
+	refresh := refresher.New(log, cs, func(token string) (apiclient.Client, error) {
+		dial := &apiclient.DialConfig{
+			BaseURL: cfg.MetalAPIServerURL,
+			Log:     log,
+			Token:   token,
+		}
+
+		return apiclient.New(dial)
+	})
+
+	err = refresh.RefreshSecret(context.Background(), refresher.TokenSecretKeyRef{
+		Namespace: cfg.SecretNamespace,
+		Name:      cfg.SecretName,
+		Key:       cfg.SecretKey,
+	})
+	if err != nil {
+		// error will be logged by refresh.RefreshSecret
+		os.Exit(1)
+	}
+}

go.mod

@@ -0,0 +1,59 @@
+module github.com/metal-stack/metal-token-refresher
+
+go 1.26.4
+
+require (
+	github.com/metal-stack/api v0.2.3
+	github.com/metal-stack/v v1.0.3
+	github.com/stretchr/testify v1.11.1
+	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af
+	k8s.io/api v0.36.2
+	k8s.io/apimachinery v0.36.2
+	k8s.io/client-go v0.36.2
+)
+
+require (
+	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1 // indirect
+	connectrpc.com/connect v1.20.0 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonreference v0.20.2 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/klauspost/compress v1.18.6 // indirect
+	github.com/klauspost/connect-compress/v2 v2.1.1 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/minio/minlz v1.1.1 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/stretchr/objx v0.5.3 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/net v0.49.0 // indirect
+	golang.org/x/oauth2 v0.34.0 // indirect
+	golang.org/x/sys v0.40.0 // indirect
+	golang.org/x/term v0.39.0 // indirect
+	golang.org/x/text v0.38.0 // indirect
+	golang.org/x/time v0.14.0 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/klog/v2 v2.140.0 // indirect
+	k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
+	k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
+)