kagenti · davidhadas · Jun 11, 2026
@@ -133,14 +133,14 @@ require (
 	go.uber.org/zap v1.28.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.52.0 // indirect
+	golang.org/x/crypto v0.53.0 // indirect
 	golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 // indirect
 	golang.org/x/mod v0.36.0 // indirect
 	golang.org/x/net v0.55.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
-	golang.org/x/term v0.43.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/term v0.44.0 // indirect
+	golang.org/x/text v0.38.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	golang.org/x/tools v0.45.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect

@@ -437,8 +437,8 @@ go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
-golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
+golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
+golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
 golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 h1:fQsdNF2N+/YewlRZiricy4P1iimyPKZ/xwniHj8Q2a0=
 golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93/go.mod h1:EPRbTFwzwjXj9NpYyyrvenVh9Y+GFeEvMNh7Xuz7xgU=
 golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
@@ -449,12 +449,12 @@ golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
 golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
-golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
-golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
+golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
+golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
+golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=

@@ -5,6 +5,7 @@
 # Services:
 #   1. kagenti-controller-manager (operator)
 #   2. bundle-service (OPA bundle server)
+#   3. token-broker (OAuth token management)
 #
 # Usage:
 #   ./hack/kind-reload-all.sh [kind-cluster-name] [namespace]
@@ -25,6 +26,7 @@ IMAGE_TAG="$(git -C "${ROOT_DIR}" rev-parse --short HEAD)"
 
 OPERATOR_IMG="localhost/kagenti-operator:${IMAGE_TAG}"
 BUNDLE_IMG="localhost/bundle-service:${IMAGE_TAG}"
+TOKEN_BROKER_IMG="localhost/token-broker:${IMAGE_TAG}"
 
 echo "============================================"
 echo " Building and loading to Kind: ${CLUSTER}"
@@ -52,16 +54,31 @@ echo ""
 echo "==> Building kagenti-operator image"
 ${CONTAINER_TOOL} build -t "${OPERATOR_IMG}" -f "${ROOT_DIR}/Dockerfile" "${ROOT_DIR}"
 
-echo ""
-echo "==> Building bundle-service image"
-${CONTAINER_TOOL} build -t "${BUNDLE_IMG}" -f "${ROOT_DIR}/cmd/bundle-service/Dockerfile" "${ROOT_DIR}"
+if [ -f "${ROOT_DIR}/cmd/bundle-service/Dockerfile" ]; then
+  echo ""
+  echo "==> Building bundle-service image"
+  ${CONTAINER_TOOL} build -t "${BUNDLE_IMG}" -f "${ROOT_DIR}/cmd/bundle-service/Dockerfile" "${ROOT_DIR}"
+fi
+
+if [ -f "${ROOT_DIR}/cmd/token-broker/Dockerfile" ]; then
+  echo ""
+  echo "==> Building token-broker image"
+  ${CONTAINER_TOOL} build -t "${TOKEN_BROKER_IMG}" -f "${ROOT_DIR}/cmd/token-broker/Dockerfile" "${ROOT_DIR}"
+fi
 
 # --- Load into Kind ---
 
 echo ""
 echo "==> Loading images into Kind cluster '${CLUSTER}'"
 kind load docker-image "${OPERATOR_IMG}" --name "${CLUSTER}"
-kind load docker-image "${BUNDLE_IMG}" --name "${CLUSTER}"
+
+if [ -f "${ROOT_DIR}/cmd/bundle-service/Dockerfile" ]; then
+  kind load docker-image "${BUNDLE_IMG}" --name "${CLUSTER}"
+fi
+
+if [ -f "${ROOT_DIR}/cmd/token-broker/Dockerfile" ]; then
+  kind load docker-image "${TOKEN_BROKER_IMG}" --name "${CLUSTER}"
+fi
 
 # --- Deploy kagenti-controller-manager ---
 
@@ -76,8 +93,9 @@ else
   echo "    (the controller-manager requires webhook certs, RBAC, and CRDs from kustomize)"
 fi
 
-# --- Deploy bundle-service ---
+# --- Deploy bundle-service (if source exists) ---
 
+if [ -f "${ROOT_DIR}/cmd/bundle-service/Dockerfile" ]; then
 echo ""
 echo "==> Deploying bundle-service"
 
@@ -210,23 +228,87 @@ spec:
       targetPort: http
       protocol: TCP
 EOF
+fi
+
+# --- Deploy token-broker (if source exists) ---
+
+if [ -f "${ROOT_DIR}/cmd/token-broker/Dockerfile" ]; then
+echo ""
+echo "==> Deploying token-broker"
+
+# Load OAuth credentials from .env
+if [ -f "${ROOT_DIR}/.env" ]; then
+  export $(grep -v '^#' "${ROOT_DIR}/.env" | grep -v '^\s*$' | xargs)
+fi
+
+if [ -z "${GITHUB_OAUTH_CLIENT_ID:-}" ] || [ -z "${GITHUB_OAUTH_CLIENT_SECRET:-}" ]; then
+  echo "    ERROR: OAuth credentials not set."
+  echo "    Create ${ROOT_DIR}/.env with:"
+  echo "      GITHUB_OAUTH_CLIENT_ID=<your-client-id>"
+  echo "      GITHUB_OAUTH_CLIENT_SECRET=<your-client-secret>"
+  echo "    See .env.example for reference."
+  exit 1
+fi
+
+# Create/update OAuth secret
+kubectl delete secret github-oauth-credentials -n "${NAMESPACE}" 2>/dev/null || true
+kubectl create secret generic github-oauth-credentials \
+  --from-literal=client-id="${GITHUB_OAUTH_CLIENT_ID}" \
+  --from-literal=client-secret="${GITHUB_OAUTH_CLIENT_SECRET}" \
+  --namespace="${NAMESPACE}"
+echo "    OAuth secret created"
+
+# Apply the deployment manifests (single source of truth).
+# These pin namespace kagenti-system and include the OAuth-callback HTTPRoute
+# (attached to the shared "http" gateway). The secret is created above from
+# .env, so the secret example manifest is intentionally skipped.
+DEPLOY_DIR="${ROOT_DIR}/cmd/token-broker/deploy"
+kubectl apply \
+  -f "${DEPLOY_DIR}/00-serviceaccount.yaml" \
+  -f "${DEPLOY_DIR}/02-deployment.yaml" \
+  -f "${DEPLOY_DIR}/03-service.yaml" \
+  -f "${DEPLOY_DIR}/04-httproute.yaml"
+
+# Inject the freshly built, git-tagged image (the manifest carries a placeholder
+# tag with imagePullPolicy: IfNotPresent; kind-loaded images need Never).
+kubectl set image deployment/token-broker \
+  token-broker="${TOKEN_BROKER_IMG}" \
+  -n "${NAMESPACE}"
+kubectl patch deployment/token-broker -n "${NAMESPACE}" --type=json \
+  -p='[{"op":"replace","path":"/spec/template/spec/containers/0/imagePullPolicy","value":"Never"}]'
+echo "    token-broker manifests applied (image ${TOKEN_BROKER_IMG})"
+fi
 
 # --- Delete pods to pick up the new images ---
 
 echo ""
 echo "==> Deleting pods to pick up new images"
-kubectl delete pods -n "${NAMESPACE}" -l app=bundle-service --wait=false
 kubectl delete pods -n "${NAMESPACE}" -l control-plane=controller-manager --wait=false 2>/dev/null || true
 
+if [ -f "${ROOT_DIR}/cmd/bundle-service/Dockerfile" ]; then
+  kubectl delete pods -n "${NAMESPACE}" -l app=bundle-service --wait=false
+fi
+
+if [ -f "${ROOT_DIR}/cmd/token-broker/Dockerfile" ]; then
+  kubectl delete pods -n "${NAMESPACE}" -l app=token-broker --wait=false
+fi
+
 # --- Wait for rollouts ---
 
 echo ""
 echo "==> Waiting for kagenti-controller-manager rollout"
 kubectl rollout status deployment/kagenti-controller-manager -n "${NAMESPACE}" --timeout=120s 2>/dev/null || \
   echo "    WARNING: kagenti-controller-manager rollout did not complete"
 
-echo "==> Waiting for bundle-service rollout"
-kubectl rollout status deployment/bundle-service -n "${NAMESPACE}" --timeout=60s
+if [ -f "${ROOT_DIR}/cmd/bundle-service/Dockerfile" ]; then
+  echo "==> Waiting for bundle-service rollout"
+  kubectl rollout status deployment/bundle-service -n "${NAMESPACE}" --timeout=60s
+fi
+
+if [ -f "${ROOT_DIR}/cmd/token-broker/Dockerfile" ]; then
+  echo "==> Waiting for token-broker rollout"
+  kubectl rollout status deployment/token-broker -n "${NAMESPACE}" --timeout=60s
+fi
 
 # --- Summary ---
 
@@ -236,12 +318,35 @@ echo " Done!"
 echo ""
 echo " Images loaded:"
 echo "   ${OPERATOR_IMG}"
-echo "   ${BUNDLE_IMG}"
+if [ -f "${ROOT_DIR}/cmd/bundle-service/Dockerfile" ]; then
+  echo "   ${BUNDLE_IMG}"
+fi
+if [ -f "${ROOT_DIR}/cmd/token-broker/Dockerfile" ]; then
+  echo "   ${TOKEN_BROKER_IMG}"
+fi
 echo ""
 echo " Namespace: ${NAMESPACE}"
 echo "   - kagenti-controller-manager"
-echo "   - bundle-service"
+if [ -f "${ROOT_DIR}/cmd/bundle-service/Dockerfile" ]; then
+  echo "   - bundle-service"
+fi
+if [ -f "${ROOT_DIR}/cmd/token-broker/Dockerfile" ]; then
+  echo "   - token-broker"
+fi
 echo ""
-echo " bundle-service URL: http://bundle-service.${NAMESPACE}.svc.cluster.local:8080"
-echo " To port-forward: kubectl port-forward -n ${NAMESPACE} svc/bundle-service 8080:8080"
+if [ -f "${ROOT_DIR}/cmd/bundle-service/Dockerfile" ]; then
+  echo " bundle-service URL: http://bundle-service.${NAMESPACE}.svc.cluster.local:8080"
+fi
+if [ -f "${ROOT_DIR}/cmd/token-broker/Dockerfile" ]; then
+  echo " token-broker URL:   http://token-broker.${NAMESPACE}.svc.cluster.local:8190"
+  echo " OAuth callback:     http://token-broker.localtest.me:8080/oauth/callback (via 'http' gateway)"
+fi
+echo ""
+echo " To port-forward:"
+if [ -f "${ROOT_DIR}/cmd/bundle-service/Dockerfile" ]; then
+  echo "   kubectl port-forward -n ${NAMESPACE} svc/bundle-service 8080:8080"
+fi
+if [ -f "${ROOT_DIR}/cmd/token-broker/Dockerfile" ]; then
+  echo "   kubectl port-forward -n ${NAMESPACE} svc/token-broker 8190:8190"
+fi
 echo "============================================"
@@ -0,0 +1,21 @@
+FROM --platform=$BUILDPLATFORM docker.io/golang:1.26 AS builder
+ARG TARGETOS
+ARG TARGETARCH
+
+WORKDIR /workspace
+COPY go.mod go.mod
+COPY go.sum go.sum
+RUN go mod download
+
+COPY cmd/ cmd/
+COPY internal/ internal/
+COPY pkg/ pkg/
+
+RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -o token-broker ./cmd/
+
+FROM gcr.io/distroless/static:nonroot
+WORKDIR /
+COPY --from=builder /workspace/token-broker .
+USER 65532:65532
+
+ENTRYPOINT ["/token-broker"]