Merge pull request #18 from observatorium/ttl

fix: use durations for TTL

.github/workflows/ci.yml

@@ -54,6 +54,7 @@ jobs:
           namespace: namespace-provisioner
         data:
           server: "$SERVER"
+          ttl: 1h
         EOF
         kubectl apply -f manifests/example-grants/pods.yaml
         kubectl -n namespace-provisioner set image deployment namespace-provisioner namespace-provisioner=quay.io/observatorium/namespace-provisioner:test
@@ -62,7 +63,7 @@ jobs:
       run: |
         kubectl -n namespace-provisioner port-forward service/namespace-provisioner 8080 &
         until lsof -nP -iTCP:8080 -sTCP:LISTEN >/dev/null; do sleep 1; done
-        curl localhost:8080/api/v1/namespace?ttl=1 -X POST -H "Authorization: bearer PASSWORD" > kubeconfig
+        curl localhost:8080/api/v1/namespace?ttl=1s -X POST -H "Authorization: bearer PASSWORD" > kubeconfig
         kubectl --kubeconfig kubeconfig get pods
         sleep 5
         [ $(kubectl get ns | grep np- | wc -l) -eq 0 ]

README.md

@@ -29,7 +29,7 @@ The Namespace Provisioner runs an API server over HTTP that exposes two API endp
 #### Namespace Creation - POST /api/v1/namespace
 
 The Namespace creation endpoint accepts the following optional query parameters:
-1. `ttl`: the time in seconds that the Namespace should exist in the Kubernetes cluster; if 0 is given, then the Namespace Provisioner’s default lifetime is applied.
+1. `ttl`: the duration, e.g. `30s`, `5m`, `1h`, that the Namespace should exist in the Kubernetes cluster; if 0 is given, then the Namespace Provisioner’s default lifetime is applied.
 All provisioned Namespaces will be labeled with a Unix timestamp equal to the current time plus this duration; and
 1. `url`; the URL of the Kubernetes API that the generated Kubeconfig should use.
 

manifests/namespace-provisioner.yaml

@@ -36,6 +36,7 @@ metadata:
     app.kubernetes.io/part-of: namespace-provisioner
 data:
   server: https://kubernetes
+  ttl: 1h
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -163,6 +164,7 @@ spec:
         - --listen-internal=:9090
         - --cluster-role=namespace-provisioner-grant
         - --server=$(SERVER)
+        - --ttl=$(TTL)
         - --token=$(TOKEN)
         env:
         - name: TOKEN
@@ -175,6 +177,11 @@ spec:
             configMapKeyRef:
               name: namespace-provisioner
               key: server
+        - name: TTL
+          valueFrom:
+            configMapKeyRef:
+              name: namespace-provisioner
+              key: ttl
         ports:
         - containerPort: 8080
           name: http

server.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
-	"strconv"
 	"strings"
 	"time"
 
@@ -98,13 +97,12 @@ func (h *handler) create(w http.ResponseWriter, r *http.Request) {
 	}(start)
 
 	ttl := h.ttl
+	var err error
 	if r.URL.Query().Has("ttl") {
-		s, err := strconv.Atoi(r.URL.Query().Get("ttl"))
-		if err != nil {
+		if ttl, err = time.ParseDuration(r.URL.Query().Get("ttl")); err != nil {
 			http.Error(w, err.Error(), http.StatusBadRequest)
 			return
 		}
-		ttl = time.Duration(s) * time.Second
 		if ttl == 0 || (h.ttl > 0 && ttl > h.ttl) {
 			ttl = h.ttl
 		}
@@ -143,8 +141,7 @@ func (h *handler) create(w http.ResponseWriter, r *http.Request) {
 			Labels:    h.labels,
 		},
 	}
-	sa, err := h.c.CoreV1().ServiceAccounts(namespace).Create(r.Context(), sa, metav1.CreateOptions{})
-	if err != nil {
+	if sa, err = h.c.CoreV1().ServiceAccounts(namespace).Create(r.Context(), sa, metav1.CreateOptions{}); err != nil {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
 	}