iframe-proxy

Cameron Childress (cchildress) · 2026-08-21T15:51:13Z

Adds token-refresher as an unbounded component. It will watch secrets in kube-system and regenerate the bootstrap token if it expires. We update any bootstrapTokenRefs in machine resources to match as well.

Copilot

Pull request overview

Adds token-refresher as a new operator-managed cluster singleton component that maintains per-Site Kubernetes bootstrap token Secrets, and wires it into the build/release/manifests pipeline and Site API surface.

Changes:

Introduces a new token-refresher controller binary + container image, plus templated/embedded deployment manifests.
Registers the component in the operator’s default component registry and extends overrides/image coverage/manifest guard tests accordingly.
Extends the Site API (spec.components.tokenRefresher) with defaults + print column, and updates kubectl unbounded site init templates to set it explicitly.

Show a summary per file

File	Description
Makefile	Adds build, image, and manifest-render targets for token-refresher; wires into `all/test/build/vulncheck/release-manifests`.
internal/operator/reconciler.go	Registers token-refresher as a cluster singleton component.
internal/operator/reconciler_test.go	Updates default registry condition expectations and override-kind coverage for the new component.
internal/operator/override/validate.go	Adds `token-refresher` to the override component/kind allowlist.
internal/operator/override_examples_test.go	Adds embedded token-refresher manifests to override examples validation.
internal/operator/manifests_guard_test.go	Includes token-refresher in embedded-manifest tag guard coverage.
internal/operator/imagecoverage_test.go	Adds token-refresher to operator-managed image coverage map.
internal/operator/crd_defaults_test.go	Adds test guarding default enabled=true for `spec.components.tokenRefresher`.
internal/operator/components/tokenrefresher/tokenrefresher.go	New operator component implementation: plan/apply/cleanup + config-hash annotation.
internal/operator/components/tokenrefresher/tokenrefresher_test.go	New unit tests for component enablement and planned ops.
images/token-refresher/Containerfile	New container build for the token-refresher binary.
hack/test-goreleaser-hook.sh	Ensures token-refresher manifests are rendered/restored during goreleaser hook testing.
hack/cmd/release-bom/main.go	Adds token-refresher image name to the release BOM generator input list.
docs/content/reference/workload-overrides.md	Documents token-refresher as an overridable workload component and its kind.
deploy/token-refresher/rendered/.gitignore	Keeps rendered directory present for `go:embed` prior to rendering.
deploy/token-refresher/render_test.go	Adds render-time RBAC least-privilege assertions for token-refresher.
deploy/token-refresher/embed.go	Embeds rendered token-refresher manifests for operator usage.
deploy/token-refresher/03-deployment.yaml.tmpl	New Deployment template for token-refresher controller.
deploy/token-refresher/02-configmap.yaml.tmpl	New ConfigMap template for controller-runtime settings.
deploy/token-refresher/01-rbac.yaml.tmpl	New RBAC templates (ClusterRole + Roles/Bindings) for Sites + kube-system Secrets + leader-election Leases.
deploy/machina/crd/unbounded-cloud.io_sites.yaml	Updates generated Site CRD schema/printcolumns for tokenRefresher defaults and visibility.
cmd/token-refresher/tokenrefresher/tokenrefresher.go	New cobra root command wiring `controller` and `version`.
cmd/token-refresher/tokenrefresher/controller/token_controller.go	New reconciler that ensures a valid per-Site bootstrap token Secret exists and requeues to expiry.
cmd/token-refresher/tokenrefresher/controller/token_controller_test.go	New tests for token creation/retention/ignore behavior and secret-to-site mapping.
cmd/token-refresher/tokenrefresher/controller/manager.go	New controller-runtime manager setup, cache scoping for kube-system Secrets, and leader-election configuration.
cmd/token-refresher/tokenrefresher/controller/config.go	YAML config loader with defaults.
cmd/token-refresher/tokenrefresher/controller/config_test.go	Unit tests for config loading behavior.
cmd/token-refresher/tokenrefresher/controller/cmd.go	Adds `controller --config=...` cobra subcommand.
cmd/token-refresher/main.go	New binary entrypoint.
cmd/kubectl-unbounded/app/site_init.go	Extends site init config to explicitly set tokenRefresher enabled false for cluster site / true for remote.
cmd/kubectl-unbounded/app/site_init_test.go	Updates rendering/ownership tests to include tokenRefresher enabled flag.
cmd/kubectl-unbounded/app/assets/unbounded-net-site/site.yaml	Emits `spec.components.tokenRefresher.enabled` from site-init template config.
api/machina/v1alpha3/zz_generated.deepcopy.go	Updates generated deep-copies for the new TokenRefresher component spec.
api/machina/v1alpha3/site_types.go	Adds `TokenRefresher` component spec field, default marker, and print column.
api/machina/v1alpha3/site_types_test.go	Extends DeepCopy isolation test to cover TokenRefresher enabled field.
.goreleaser.yml	Renders token-refresher manifests prior to release builds.
.github/workflows/release.yaml	Adds token-refresher image build/push to release workflow.
.github/workflows/release-upgrade.yaml	Includes token-refresher in upgrade validation and applied-image checks.
.github/workflows/nightly.yaml	Includes token-refresher in nightly image build matrix and rollout checks.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Files not reviewed (1)

api/machina/v1alpha3/zz_generated.deepcopy.go: Generated file

Files reviewed: 38/39 changed files
Comments generated: 2
Review effort level: Lite

Jason Wilder (jwilder) · 2026-08-21T20:56:14Z

Should we look for tokens that are about to expire vs already expired and rotate at some threshold? Then gradually update refs to the new? The PR description says it updates Machines but I don't see that code. Wondering what happens if we have 100k machines to update.

Jordan Olshevski (jveski) · 2026-08-24T14:43:29Z

Can this just be a controller compiled into the unbounded operator? Seems like it's small/simple enough to avoid adding another binary.

Also we might consider switching to short-lived service account tokens to avoid the need for long lived tokens in the first place.

Cameron Childress (cchildress) · 2026-08-24T20:41:13Z

Jordan Olshevski (jveski)

LGTM - we'll just need to address the hot update loop at some point in the future

…s available for machina.

Cameron Childress (cchildress) requested a review from a team August 21, 2026 15:51

Cameron Childress (cchildress) force-pushed the cachildr/token_refresh branch from 64f4db7 to 4a85ada Compare August 21, 2026 19:35

Jason Wilder (jwilder) requested a lite review from Copilot August 21, 2026 20:43

Copilot started reviewing on behalf of Jason Wilder (jwilder) August 21, 2026 20:44

View session

Copilot AI reviewed Aug 21, 2026

View reviewed changes

Comment thread cmd/token-refresher/tokenrefresher/controller/token_controller.go

Comment thread cmd/token-refresher/tokenrefresher/controller/token_controller.go Outdated

Cameron Childress (cchildress) force-pushed the cachildr/token_refresh branch 3 times, most recently from fde9026 to 5092feb Compare August 25, 2026 18:40

Cameron Childress (cchildress) enabled auto-merge August 25, 2026 19:25

Jason Wilder (jwilder) requested changes Aug 31, 2026

View reviewed changes

Comment thread cmd/token-refresher/tokenrefresher/controller/token_controller.go

Jordan Olshevski (jveski) previously approved these changes Aug 31, 2026

View reviewed changes

Cameron Childress (cchildress) added 8 commits August 31, 2026 17:37

Create a token refresher service to ensure a bootstrap token is alway…

e320788

…s available for machina.

Bump to Go 1.27.

04a6738

Drop the service endpoint.

7be1b3b

Needed to run make generate.

55d92eb

Restore the missing ebpf file.

8412f89

Rotate machine bootstrap refs as needed.

b395c41

Rotate bootstrap tokens at 80% life.

0a86f3d

Limit machine bootstrap token refs to batches of 1000.

e98df55

Cameron Childress (cchildress) dismissed Jordan Olshevski (jveski)’s stale review via e98df55 August 31, 2026 18:12

Cameron Childress (cchildress) force-pushed the cachildr/token_refresh branch from 5092feb to e98df55 Compare August 31, 2026 18:12

Jason Wilder (jwilder) approved these changes Aug 31, 2026

View reviewed changes

Cameron Childress (cchildress) added this pull request to the merge queue Aug 31, 2026

Merged via the queue into main with commit 896cc73 Aug 31, 2026
35 of 36 checks passed

Cameron Childress (cchildress) deleted the cachildr/token_refresh branch August 31, 2026 18:55

Philip Lombardi (plombardi89) mentioned this pull request Sep 2, 2026

release: make the build survive a re-run #700

Merged

Philip Lombardi (plombardi89) mentioned this pull request Sep 2, 2026

releng: a new component image fails its first release because its GHCR package does not exist #701

Open

Sunbelt Computer Software

PL/B Language Development and Support

Navigation Menu

Repository navigation

Add token-refresher - #646

Add token-refresher#646
Cameron Childress (cchildress) merged 8 commits into
mainfrom
cachildr/token_refresh

Cameron Childress (cchildress) commented Aug 21, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Jason Wilder (jwilder) commented Aug 21, 2026

Uh oh!

Jordan Olshevski (jveski) commented Aug 24, 2026

Uh oh!

Cameron Childress (cchildress) commented Aug 24, 2026

Uh oh!

Uh oh!

Jordan Olshevski (jveski) left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Sunbelt Computer Software

PL/B Language Development and Support

Conversation

Cameron Childress (cchildress) commented Aug 21, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Uh oh!

Jason Wilder (jwilder) commented Aug 21, 2026

Uh oh!

Jordan Olshevski (jveski) commented Aug 24, 2026

Uh oh!

Cameron Childress (cchildress) commented Aug 24, 2026

Uh oh!

Uh oh!

Jordan Olshevski (jveski) left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants