feat(*): support for projected service account token

app/kuma-dp/pkg/dataplane/envoy/remote_bootstrap.go

@@ -130,10 +130,11 @@ func (b *remoteBootstrap) requestForBootstrap(ctx context.Context, url *net_url.
 		ProxyType: cfg.Dataplane.ProxyType,
 		// if not set in config, the 0 will be sent which will result in providing default admin port
 		// that is set in the control plane bootstrap params
-		AdminPort:         cfg.Dataplane.AdminPort.Lowest(),
-		DataplaneToken:    token,
-		DataplaneResource: dataplaneResource,
-		CaCert:            cfg.ControlPlane.CaCert,
+		AdminPort:          cfg.Dataplane.AdminPort.Lowest(),
+		DataplaneToken:     token,
+		DataplaneTokenPath: cfg.DataplaneRuntime.TokenPath,
+		DataplaneResource:  dataplaneResource,
+		CaCert:             cfg.ControlPlane.CaCert,
 		Version: types.Version{
 			KumaDp: types.KumaDpVersion{
 				Version:   kuma_version.Build.Version,

app/kuma-dp/pkg/dataplane/envoy/remote_bootstrap_test.go

@@ -135,6 +135,52 @@ var _ = Describe("Remote Bootstrap", func() {
 				}
 			}()),
 
+		Entry("should read token from the file and include file path",
+			func() testCase {
+				cfg := kuma_dp.DefaultConfig()
+				cfg.Dataplane.Mesh = "demo"
+				cfg.Dataplane.Name = "sample"
+				cfg.Dataplane.AdminPort = config_types.MustPortRange(4321, 8765) // port range
+				cfg.DataplaneRuntime.TokenPath = "testdata/token"
+
+				return testCase{
+					config:               cfg,
+					sidecarConfiguration: &types.KumaSidecarConfiguration{},
+					dataplane: &rest.Resource{
+						Meta: rest.ResourceMeta{
+							Type: "Dataplane",
+							Mesh: "demo",
+							Name: "sample",
+						},
+					},
+					expectedBootstrapRequest: `
+                    {
+                      "mesh": "demo",
+                      "name": "sample",
+                      "proxyType": "dataplane",
+                      "adminPort": 4321,
+					  "dataplaneToken": "token1234",
+                      "dataplaneTokenPath": "testdata/token",
+                      "dataplaneResource": "{\"type\":\"Dataplane\",\"mesh\":\"demo\",\"name\":\"sample\",\"creationTime\":\"0001-01-01T00:00:00Z\",\"modificationTime\":\"0001-01-01T00:00:00Z\"}",
+                      "version": {
+                        "kumaDp": {
+                          "version": "0.0.1",
+                          "gitTag": "v0.0.1",
+                          "gitCommit": "91ce236824a9d875601679aa80c63783fb0e8725",
+                          "buildDate": "2019-08-07T11:26:06Z"
+                        },
+                        "envoy": {
+                          "version": "1.15.0",
+                          "build": "hash/1.15.0/RELEASE",
+                          "kumaDpCompatible": false
+                        }
+                      },
+                      "caCert": "",
+                      "dynamicMetadata": null
+                    }`,
+				}
+			}()),
+
 		Entry("should support port range with multiple ports (choose the lowest port)",
 			func() testCase {
 				cfg := kuma_dp.DefaultConfig()

app/kuma-dp/pkg/dataplane/envoy/testdata/token

@@ -0,0 +1 @@
+token1234

pkg/api-server/config_ws_test.go

@@ -102,7 +102,8 @@ var _ = Describe("Config WS", func() {
 		  },
 		  "dpServer": {
 			"auth": {
-			  "type": ""
+			  "type": "",
+			  "useTokenPath": false
 			},
 			"hds": {
 			  "checkDefaults": {
@@ -260,7 +261,8 @@ var _ = Describe("Config WS", func() {
             "tlsCertFile": "",
             "tlsKeyFile": "",
             "auth": {
-              "type": ""
+              "type": "",
+			  "useTokenPath": false
             },
             "hds": {
               "checkDefaults": {

pkg/config/dp-server/config.go

@@ -37,6 +37,8 @@ type DpServerAuthConfig struct {
 	// Type of authentication. Available values: "serviceAccountToken", "dpToken", "none".
 	// If empty, autoconfigured based on the environment - "serviceAccountToken" on Kubernetes, "dpToken" on Universal.
 	Type string `yaml:"type" envconfig:"kuma_dp_server_auth_type"`
+	// UseTokenPath define if should use config for ads with path to token that can be reloaded.
+	UseTokenPath bool `yaml:"useTokenPath" envconfig:"kuma_dp_server_auth_use_token_path"`
 }
 
 func (a *DpServerAuthConfig) Validate() error {
@@ -63,7 +65,8 @@ func DefaultDpServerConfig() *DpServerConfig {
 	return &DpServerConfig{
 		Port: 5678,
 		Auth: DpServerAuthConfig{
-			Type: "", // autoconfigured from the environment
+			Type:         "", // autoconfigured from the environment
+			UseTokenPath: false,
 		},
 		Hds: DefaultHdsConfig(),
 	}

pkg/config/loader_test.go

@@ -596,6 +596,7 @@ experimental:
 				"KUMA_DP_SERVER_TLS_CERT_FILE":                                                             "/test/path",
 				"KUMA_DP_SERVER_TLS_KEY_FILE":                                                              "/test/path/key",
 				"KUMA_DP_SERVER_AUTH_TYPE":                                                                 "dpToken",
+				"KUMA_DP_SERVER_AUTH_USE_TOKEN_PATH":                                                       "true",
 				"KUMA_DP_SERVER_PORT":                                                                      "9876",
 				"KUMA_DP_SERVER_HDS_ENABLED":                                                               "false",
 				"KUMA_DP_SERVER_HDS_INTERVAL":                                                              "11s",

pkg/xds/bootstrap/components.go

@@ -11,6 +11,7 @@ func RegisterBootstrap(rt core_runtime.Runtime) error {
 		rt.Config().BootstrapServer,
 		rt.Config().DpServer.TlsCertFile,
 		rt.Config().DpServer.Auth.Type != dp_server.DpServerAuthNone,
+		rt.Config().DpServer.Auth.UseTokenPath,
 		rt.Config().DpServer.Hds.Enabled,
 		rt.Config().GetEnvoyAdminPort(),
 	)

pkg/xds/bootstrap/generator.go

@@ -35,6 +35,7 @@ func NewDefaultBootstrapGenerator(
 	config *bootstrap_config.BootstrapServerConfig,
 	dpServerCertFile string,
 	dpAuthEnabled bool,
+	dpUseTokenPath bool,
 	hdsEnabled bool,
 	defaultAdminPort uint32,
 ) (BootstrapGenerator, error) {
@@ -50,6 +51,7 @@ func NewDefaultBootstrapGenerator(
 		config:           config,
 		xdsCertFile:      dpServerCertFile,
 		dpAuthEnabled:    dpAuthEnabled,
+		dpUseTokenPath:   dpUseTokenPath,
 		hostsAndIps:      hostsAndIps,
 		hdsEnabled:       hdsEnabled,
 		defaultAdminPort: defaultAdminPort,
@@ -60,6 +62,7 @@ type bootstrapGenerator struct {
 	resManager       core_manager.ResourceManager
 	config           *bootstrap_config.BootstrapServerConfig
 	dpAuthEnabled    bool
+	dpUseTokenPath   bool
 	xdsCertFile      string
 	hostsAndIps      SANSet
 	hdsEnabled       bool
@@ -82,6 +85,7 @@ func (b *bootstrapGenerator) Generate(ctx context.Context, request types.Bootstr
 		XdsConnectTimeout:     b.config.Params.XdsConnectTimeout,
 		AccessLogPipe:         envoy_common.AccessLogSocketName(request.Name, request.Mesh),
 		DataplaneToken:        request.DataplaneToken,
+		DataplaneTokenPath:    request.DataplaneTokenPath,
 		DataplaneResource:     request.DataplaneResource,
 		KumaDpVersion:         request.Version.KumaDp.Version,
 		KumaDpGitTag:          request.Version.KumaDp.GitTag,
@@ -155,7 +159,7 @@ func (b *bootstrapGenerator) Generate(ctx context.Context, request types.Bootstr
 		return nil, kumaDpBootstrap, err
 	}
 
-	config, err := genConfig(params)
+	config, err := genConfig(params, b.dpUseTokenPath)
 	if err != nil {
 		return nil, kumaDpBootstrap, errors.Wrap(err, "failed creating bootstrap conf")
 	}
@@ -218,7 +222,7 @@ func (b *bootstrapGenerator) getMetricsConfig(
 }
 
 func (b *bootstrapGenerator) validateRequest(request types.BootstrapRequest) error {
-	if b.dpAuthEnabled && request.DataplaneToken == "" {
+	if b.dpAuthEnabled && request.DataplaneToken == "" && request.DataplaneTokenPath == "" {
 		return DpTokenRequired
 	}
 	if b.config.Params.XdsHost == "" { // XdsHost takes precedence over Host in the request, so validate only when it is not set

pkg/xds/bootstrap/generator_test.go

@@ -95,6 +95,7 @@ var _ = Describe("bootstrapGenerator", func() {
 		config             func() *bootstrap_config.BootstrapServerConfig
 		dataplane          func() *core_mesh.DataplaneResource
 		dpAuthEnabled      bool
+		useTokenPath       bool
 		request            types.BootstrapRequest
 		expectedConfigFile string
 		hdsEnabled         bool
@@ -105,7 +106,7 @@ var _ = Describe("bootstrapGenerator", func() {
 			err := resManager.Create(context.Background(), given.dataplane(), store.CreateByKey("name.namespace", "mesh"))
 			Expect(err).ToNot(HaveOccurred())
 
-			generator, err := NewDefaultBootstrapGenerator(resManager, given.config(), filepath.Join("..", "..", "..", "test", "certs", "server-cert.pem"), given.dpAuthEnabled, given.hdsEnabled, 0)
+			generator, err := NewDefaultBootstrapGenerator(resManager, given.config(), filepath.Join("..", "..", "..", "test", "certs", "server-cert.pem"), given.dpAuthEnabled, given.useTokenPath, given.hdsEnabled, 0)
 			Expect(err).ToNot(HaveOccurred())
 
 			// when
@@ -361,6 +362,32 @@ var _ = Describe("bootstrapGenerator", func() {
 			expectedConfigFile: "generator.default-config.golden.yaml",
 			hdsEnabled:         true,
 		}),
+		Entry("default config with useTokenPath", testCase{
+			dpAuthEnabled: true,
+			config: func() *bootstrap_config.BootstrapServerConfig {
+				cfg := bootstrap_config.DefaultBootstrapServerConfig()
+				cfg.Params.XdsHost = "localhost"
+				cfg.Params.XdsPort = 5678
+				return cfg
+			},
+			dataplane: func() *core_mesh.DataplaneResource {
+				dp := defaultDataplane()
+				dp.Spec.Networking.Admin.Port = 1234
+				return dp
+			},
+			request: types.BootstrapRequest{
+				Mesh:               "mesh",
+				Name:               "name.namespace",
+				DataplaneToken:     "token",
+				Version:            defaultVersion,
+				DNSPort:            53001,
+				EmptyDNSPort:       53002,
+				DataplaneTokenPath: "/path/to/file",
+			},
+			expectedConfigFile: "generator.default-config-token-path.golden.yaml",
+			hdsEnabled:         true,
+			useTokenPath:       true,
+		}),
 	)
 
 	type errTestCase struct {
@@ -375,7 +402,7 @@ var _ = Describe("bootstrapGenerator", func() {
 
 			cfg := bootstrap_config.DefaultBootstrapServerConfig()
 
-			generator, err := NewDefaultBootstrapGenerator(resManager, cfg, filepath.Join("..", "..", "..", "test", "certs", "server-cert.pem"), false, true, 9901)
+			generator, err := NewDefaultBootstrapGenerator(resManager, cfg, filepath.Join("..", "..", "..", "test", "certs", "server-cert.pem"), false, false, true, 9901)
 			Expect(err).ToNot(HaveOccurred())
 
 			// when
@@ -508,7 +535,7 @@ Provide CA that was used to sign a certificate used in the control plane by usin
 		err = resManager.Create(context.Background(), dataplane, store.CreateByKey("name.namespace", "metrics"))
 		Expect(err).ToNot(HaveOccurred())
 
-		generator, err := NewDefaultBootstrapGenerator(resManager, config(), filepath.Join("..", "..", "..", "test", "certs", "server-cert.pem"), true, false, 0)
+		generator, err := NewDefaultBootstrapGenerator(resManager, config(), filepath.Join("..", "..", "..", "test", "certs", "server-cert.pem"), true, false, false, 0)
 		Expect(err).ToNot(HaveOccurred())
 
 		// when
@@ -599,7 +626,7 @@ Provide CA that was used to sign a certificate used in the control plane by usin
 		err = resManager.Create(context.Background(), dataplane, store.CreateByKey("name.namespace", "metrics"))
 		Expect(err).ToNot(HaveOccurred())
 
-		generator, err := NewDefaultBootstrapGenerator(resManager, config(), filepath.Join("..", "..", "..", "test", "certs", "server-cert.pem"), true, false, 0)
+		generator, err := NewDefaultBootstrapGenerator(resManager, config(), filepath.Join("..", "..", "..", "test", "certs", "server-cert.pem"), true, false, false, 0)
 		Expect(err).ToNot(HaveOccurred())
 
 		// when

pkg/xds/bootstrap/parameters.go

@@ -23,6 +23,7 @@ type configParameters struct {
 	XdsConnectTimeout     time.Duration
 	AccessLogPipe         string
 	DataplaneToken        string
+	DataplaneTokenPath    string
 	DataplaneResource     string
 	CertBytes             []byte
 	KumaDpVersion         string

pkg/xds/bootstrap/server_test.go

@@ -79,7 +79,7 @@ var _ = Describe("Bootstrap Server", func() {
 		}
 		dpServer := server.NewDpServer(dpServerCfg, metrics)
 
-		generator, err := bootstrap.NewDefaultBootstrapGenerator(resManager, config, filepath.Join("..", "..", "..", "test", "certs", "server-cert.pem"), true, true, 0)
+		generator, err := bootstrap.NewDefaultBootstrapGenerator(resManager, config, filepath.Join("..", "..", "..", "test", "certs", "server-cert.pem"), true, false, true, 0)
 		Expect(err).ToNot(HaveOccurred())
 		bootstrapHandler := bootstrap.BootstrapHandler{
 			Generator: generator,