Skip to content

Conversation

@thisiskazem
Copy link

Description
This PR adds the ability to query a Liqo cluster's version without establishing full peering, using minimal token-based authentication.

Summary of Changes
Version Query Infrastructure:

Created liqo-version ConfigMap to expose cluster version
Set up liqo-version-reader ServiceAccount with minimal RBAC (read access restricted to one specific ConfigMap only)
Auto-generated long-lived token stored in liqo-version-reader-token Secret
All resources created automatically at liqo-controller-manager startup
Public API Functions:

QueryRemoteVersion(): Query remote cluster version with API URL + token
GetLocalVersion(): Retrieve local cluster version from ConfigMap
GetVersionReaderToken(): Extract token from Secret for sharing
Security:

Token restricted to read ONE ConfigMap (liqo-version) in liqo namespace
No list, create, update, or delete permissions
Cannot access any other resources
Motivation
Administrators need to check version compatibility between clusters before initiating peering. This feature enables version queries using only a read-only token, without requiring full peering setup or exchanging cluster credentials.

Fixes # (no related issue)

How Has This Been Tested?
Unit Tests

All 17 version package unit tests pass

Tenant controller unit tests added
Integration Testing

Version resources (ConfigMap, Secret, Role, RoleBinding) created automatically on startup

Token successfully extracted from Secret

Token restricted to read only [object Object] ConfigMap (tested with kubectl)

Token cannot access other ConfigMaps or resources (verified permission denied)

RBAC auto-generated correctly via [object Object]
Test Configuration
Environment: k3s cluster
Liqo installation: liqoctl + custom build script
Kubernetes version: v1.31+

@adamjensenbot
Copy link
Collaborator

Hi @thisiskazem. Thanks for your PR!

I am @adamjensenbot.
You can interact with me issuing a slash command in the first line of a comment.
Currently, I understand the following commands:

  • /rebase: Rebase this PR onto the master branch (You can add the option test=true to launch the tests
    when the rebase operation is completed)
  • /merge: Merge this PR into the master branch
  • /build Build Liqo components
  • /test Launch the E2E and Unit tests
  • /hold, /unhold Add/remove the hold label to prevent merging with /merge

Make sure this PR appears in the liqo changelog, adding one of the following labels:

  • feat: 🚀 New Feature
  • fix: 🐛 Bug Fix
  • refactor: 🧹 Code Refactoring
  • docs: 📝 Documentation
  • style: 💄 Code Style
  • perf: 🐎 Performance Improvement
  • test: ✅ Tests
  • chore: 🚚 Dependencies Management
  • build: 📦 Builds Management
  • ci: 👷 CI/CD
  • revert: ⏪ Reverts Previous Changes

@github-actions github-actions bot added the feat Adds a new feature to the codebase label Nov 19, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

feat Adds a new feature to the codebase size/XXL

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants