Relationships
#4222 Add expiring service-account token requests and authorization checks to RBAC
Opened by chippawah · 10/31/2026
The RBAC behavior exposes ServiceAccount reads but lacks the TokenRequest API and SubjectAccessReview. Please add a method that requests a bounded-expiration service-account token, marks the token as a sensitive resource field so it is vaulted before persistence, and records the expiration. A companion fan-out method could evaluate resource authorization checks for the service-account identity. This supports token-authenticated dashboards without permanent token Secrets or shelling out to kubectl.
Upstream repository: https://github.com/swamp-club/swamp-extensions
Environment
- Extension:
@swamp/kubernetes@2026.10.25.2 - swamp:
20261023.003850.0-sha.6482ce42 - OS:
linux(x86_64) - Deno:
2.9.8 - Shell:
/usr/bin/zsh
Open
No activity in this phase yet.
system commented 10/31/2026, 8:21:38 AM
Classified automatically when this issue was filed.
- Source: Extensions
If you feel this classification is incorrect, add a ripple to tell us so.
Sign in to post a ripple.