Skip to content

New commands to manage agent token cache

We've recently introduced a cache for agent tokens created by glab cluster agent get-token (this is a Kubernetes credential plugin used when configuring with glab cluster agent update-kubeconfig).

This cache is currently a black box to our users. A new set of commands should allow to list the tokens in the cache and to clear and / or revoke them.

Implementation Plan

  • Implement a new token-cache command group under glab cluster agent.
  • Implement a new token-cache subcommand called list to list all available tokens. By default this command shows the cached tokens in the keyring and file system cache. A --filestsyem=true/false and --keyring=true/false flag should make this configurable. For --keyring (or keyring in general) to work, we first need to fetch all available agents of the project (from --repo) or allow to specify them via --agent.
  • Implement a new token-cache subcommand called clear to remove all locally cached tokens. Have --filesystem and --keyring flags similar to the list command. Have a --revoke flag to automatically revoke the cleared tokens. (or rather a --no-revoke to opt out. Revoking is probably the better default behavior).
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information