How do I create TokenRequest with kube-rs?

[pbzweihander]

In order to create a token from ServiceAccount, I should create TokenRequest object. But when I use following code...

use k8s_openapi::api::authentication::v1::{TokenRequest, TokenRequestSpec};
use kube::{api::Api, core::ObjectMeta, Client};

#[tokio::main]
async fn main() -> anyhow::Result<()> {
    tracing_subscriber::fmt::init();

    let client = Client::try_default().await?;
    let tokenrequest_api = Api::<TokenRequest>::namespaced(client, "default");

    let tokenrequest = tokenrequest_api
        .create(
            &Default::default(),
            &TokenRequest {
                metadata: ObjectMeta {
                    name: Some("default".to_string()),
                    ..Default::default()
                },
                spec: TokenRequestSpec {
                    audiences: vec!["api".to_string()],
                    ..Default::default()
                },
                status: None,
            },
        )
        .await?;

    println!("{:#?}", tokenrequest);

    Ok(())
}

... with this Cargo.toml ...

[package]
name = "playground"
version = "0.1.0"
edition = "2021"

[dependencies]
anyhow = { version = "1.0.60", features = ["backtrace"] }
k8s-openapi = { version = "0.15.0", features = ["v1_24", "schemars"] }
kube = { version = "0.74.0", default-features = false, features = ["openssl-tls", "client"] }
schemars = "0.8.10"
serde = { version = "1.0.143", features = ["derive"] }
serde_json = "1.0.83"
tokio = { version = "1.20.1", features = ["macros", "rt-multi-thread"] }
tracing = "0.1.36"
tracing-subscriber = { version = "0.3.15", features = ["fmt"] }

... I got following error:

Error: ApiError: the server could not find the requested resource: NotFound (ErrorResponse { status: "Failure", message: "the server could not find the requested resource", reason: "NotFound", code: 404 })

Caused by:
    the server could not find the requested resource: NotFound

When I ran with RUST_LOG=debug, the log looks like:

2022-08-18T08:37:57.835846Z DEBUG tower::buffer::worker: service.ready=true processing request
2022-08-18T08:37:57.836029Z DEBUG HTTP{http.method=POST http.url=https://127.0.0.1:38775/apis/authentication.k8s.io/v1/namespaces/default/token? otel.name="create" otel.kind="client"}: kube_client::client::builder: requesting
2022-08-18T08:37:57.836317Z DEBUG HTTP{http.method=POST http.url=https://127.0.0.1:38775/apis/authentication.k8s.io/v1/namespaces/default/token? otel.name="create" otel.kind="client"}: hyper::client::connect::http: connecting to 127.0.0.1:38775
2022-08-18T08:37:57.836540Z DEBUG HTTP{http.method=POST http.url=https://127.0.0.1:38775/apis/authentication.k8s.io/v1/namespaces/default/token? otel.name="create" otel.kind="client"}: hyper::client::connect::http: connected to 127.0.0.1:38775
2022-08-18T08:37:57.839962Z DEBUG hyper::proto::h1::io: flushed 272 bytes
2022-08-18T08:37:57.840804Z DEBUG hyper::proto::h1::io: parsed 6 headers
2022-08-18T08:37:57.840825Z DEBUG hyper::proto::h1::conn: incoming body is content-length (174 bytes)
2022-08-18T08:37:57.840883Z DEBUG hyper::proto::h1::conn: incoming body completed
2022-08-18T08:37:57.840981Z DEBUG hyper::client::pool: pooling idle connection for ("https", 127.0.0.1:38775)
2022-08-18T08:37:57.841063Z DEBUG kube_client::client: Unsuccessful: ErrorResponse { status: "Failure", message: "the server could not find the requested resource", reason: "NotFound", code: 404 }
Error: ApiError: the server could not find the requested resource: NotFound (ErrorResponse { status: "Failure", message: "the server could not find the requested resource", reason: "NotFound", code: 404 })

Caused by:
    the server could not find the requested resource: NotFound

It seems like kube-rs use /apis/authentication.k8s.io/v1/namespaces/{namespace}/token as a URL, but it should be /api/v1/namespaces/{namespace}/serviceaccounts/{name}/token (Reference: https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/token-request-v1/#http-request)

How do I request with correct URL?

[clux]

TokenRequest is a subresource and needs to acted on an Api::<ServiceAccount> with the methods that exists for that.

Unfortunately, TokenRequest is actually one of those few ones that is missing its create_token_request method #127 (even though it's not particularly hard to add)

You might be able to use the general helpers like Api::patch_subresource with subresource_name="token" and (serverside apply parameters to be equivalent to create), but I think we should add the Api::create_token_request to subresource.rs ala https://github.com/kube-rs/kube-rs/pull/773/files - along with a generic Api::create_subresource

[pbzweihander]

Thanks!

[pbzweihander]

Workaround before #989 is merged:

use k8s_openapi::api::{authentication::v1::TokenRequest, core::v1::ServiceAccount};
use kube::{Client, Resource};

async fn create_token_request(
    client: Client,
    name: &str,
    namespace: &str,
    token_request: &TokenRequest,
) -> kube::Result<TokenRequest> {
    let url_path = format!(
        "{}/{}/token",
        ServiceAccount::url_path(
            &<ServiceAccount as Resource>::DynamicType::default(),
            Some(namespace)
        ),
        name
    );
    let body = serde_json::to_vec(token_request).map_err(kube::Error::SerdeError)?;
    let mut req = http::Request::post(url_path)
        .header(http::header::CONTENT_TYPE, "application/json")
        .body(body)
        .map_err(|e| kube::Error::BuildRequest(kube::core::request::Error::BuildRequest(e)))?;
    req.extensions_mut().insert("create_token_request");
    client.request(req).await
}