Skip to content

feat(QOV-1953): add --read-only flag to cluster kubeconfig and get-token#653

Open
Guimove wants to merge 1 commit into
mainfrom
feat/QOV-1953-read-only-kubeconfig
Open

feat(QOV-1953): add --read-only flag to cluster kubeconfig and get-token#653
Guimove wants to merge 1 commit into
mainfrom
feat/QOV-1953-read-only-kubeconfig

Conversation

@Guimove
Copy link
Copy Markdown
Contributor

@Guimove Guimove commented May 30, 2026

QOV-1953

Adds --read-only (-r) flag to:

  • qovery cluster kubeconfig --cluster-id --read-only
  • qovery cluster get-token --cluster-id --read-only

How it works:

  • cluster kubeconfig --read-only downloads a kubeconfig whose exec plugin calls get-token --read-only, backed by a Kubernetes ServiceAccount with the view ClusterRole (RBAC-enforced read-only)
  • Output file is named kubeconfig-readonly-.yaml
  • cluster get-token --read-only requests a 1h ServiceAccount token from the backend instead of an admin cloud-provider token

No behavior change on existing commands, all callers pass readOnly=false explicitly.

Dependency: requires qovery-client-go to be regenerated after the spec PR (Qovery/qovery-openapi-spec#1107) is merged. After the client is published, run go get github.com/qovery/qovery-client-go@latest && go mod tidy.

https://qovery.atlassian.net/browse/QOV-1953

- cluster kubeconfig --read-only: downloads a kubeconfig with read-only
  exec plugin (calls get-token --read-only), output file named
  kubeconfig-readonly-<id>.yaml
- cluster get-token --read-only: requests a SA-backed read-only token
  instead of an admin cloud-provider token
- All existing callers pass readOnly=false explicitly — no behavior change

CLI will compile once qovery-client-go is regenerated from the spec
(ReadOnly() method on ApiGetClusterKubeconfigRequest and
ApiGetClusterTokenByClusterIdRequest).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant