feat: 接入 OpenBao Kubernetes 认证与短期会话续期

internal/database/adapter/openbao/authentication.go

@@ -0,0 +1,141 @@
+/*
+Copyright 2026.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package openbao
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	kubernetesauth "github.com/openbao/openbao/api/auth/kubernetes/v2"
+	bao "github.com/openbao/openbao/api/v2"
+)
+
+var ErrAuthenticationConfiguration = errors.New("invalid OpenBao Kubernetes authentication configuration")
+
+// KubernetesSession 为专用 SDK client 维护短期登录，不持久化或对外返回 token。
+// 登录失败或 lease 不再可用时清空 client token，依赖恢复后重新读取投射的 SA token。
+// 续期调度由官方 LifetimeWatcher 负责，不实现自己的 lease 算法。
+type KubernetesSession struct {
+	client    *bao.Client
+	mount     string
+	role      string
+	tokenPath string
+	running   sync.Mutex
+	ready     atomic.Bool
+}
+
+func NewKubernetesSession(client *bao.Client, mount, role, tokenPath string) (*KubernetesSession, error) {
+	if client == nil || !validPath(mount) || !pathSegment.MatchString(role) || !filepath.IsAbs(tokenPath) {
+		return nil, ErrAuthenticationConfiguration
+	}
+	client.ClearToken()
+	client.SetMaxRetries(0)
+	client.SetClientTimeout(15 * time.Second)
+	return &KubernetesSession{client: client, mount: mount, role: role, tokenPath: tokenPath}, nil
+}
+
+// Ready 仅代表当前登录 lease 正由 SDK 管理，不保证下一次后端请求一定成功。
+func (s *KubernetesSession) Ready() bool { return s.ready.Load() }
+
+// Start 可交给 manager 管理；关闭时清空本地 token，不撤销共享后端数据。
+// SDK 的 Stop 不取消已发出的续期 HTTP 请求，因此等待该请求结束后才退出，最长受 client timeout 限制。
+func (s *KubernetesSession) Start(ctx context.Context) error {
+	if !s.running.TryLock() {
+		return errors.New("OpenBao authentication is already running")
+	}
+	defer s.running.Unlock()
+	defer s.clear()
+	for ctx.Err() == nil {
+		s.clear()
+		secret := s.login(ctx)
+		if secret != nil {
+			s.watch(ctx, secret)
+		}
+		s.clear()
+		// 登录失败及不能继续续期均有限速，防止依赖故障时形成请求忙循环。
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-time.After(5 * time.Second):
+		}
+	}
+	return nil
+}
+
+func (s *KubernetesSession) clear() {
+	s.ready.Store(false)
+	s.client.ClearToken()
+}
+
+func (s *KubernetesSession) login(ctx context.Context) *bao.Secret {
+	// 只读取指定投射位置；SDK 的空 token 选项会回退默认路径，必须在此拒绝空文件。
+	data, err := os.ReadFile(s.tokenPath)
+	if err != nil || strings.TrimSpace(string(data)) == "" {
+		return nil
+	}
+	// helper 会缓存 token，不能跨登录轮次复用。
+	method, err := kubernetesauth.NewKubernetesAuth(s.role,
+		kubernetesauth.WithMountPath(s.mount),
+		kubernetesauth.WithServiceAccountToken(strings.TrimSpace(string(data))),
+	)
+	if err != nil {
+		return nil
+	}
+	// 先检查短期 lease，再发布到共享 client，避免暴露不合规的登录结果。
+	secret, err := method.Login(ctx, s.client)
+	if err != nil || secret == nil || secret.Auth == nil || secret.Auth.ClientToken == "" || secret.Auth.LeaseDuration <= 0 {
+		return nil
+	}
+	if ctx.Err() != nil {
+		return nil
+	}
+	s.client.SetToken(secret.Auth.ClientToken)
+	return secret
+}
+
+func (s *KubernetesSession) watch(ctx context.Context, secret *bao.Secret) {
+	behavior := bao.RenewBehaviorErrorOnErrors
+	if !secret.Auth.Renewable {
+		behavior = bao.RenewBehaviorRenewDisabled
+	}
+	watcher, err := s.client.NewLifetimeWatcher(&bao.LifetimeWatcherInput{Secret: secret, RenewBehavior: behavior})
+	if err != nil {
+		return
+	}
+	s.ready.Store(true)
+	go watcher.Start()
+	for {
+		select {
+		case <-ctx.Done():
+			s.clear()
+			watcher.Stop()
+			<-watcher.DoneCh()
+			return
+		case <-watcher.DoneCh():
+			watcher.Stop()
+			return
+		case <-watcher.RenewCh():
+			// 不记录 SDK Secret 或 token；无需复制 SDK 已处理的续期数据。
+		}
+	}
+}