1import { getKlusterCtx } from "../k8sF/ctxF/klusterCtxF.mts"
2import { getKubeApis } from '../k8sF/getApisF.mts'
3import { getGenPlainSec } from '../../serverF/secretsF/getGenPlainSecAI.mts'
4import { betLog } from '../../sharedF/betterConsLogF.mts'
5
6// Rancher v2.13+ cacerts handler (pkg/cacerts/handler.go) has `len(crt) >= 0` (always true)
7// which panics on crt[0] when rancherd sends Authorization+X-Cattle-Nonce headers that don't
8// match any ClusterRegistrationToken hash. Harvester's rancherd sends the RKE2 cluster join
9// token as the bearer, but Rancher's default ClusterRegistrationToken has a different token.
10// Fix: patch the ClusterRegistrationToken to use the same join token so the hash lookup succeeds.
11// The Rancher-hardened nginx ingress (v1.14+) blocks proxy_set_header in snippets, so we can't
12// strip headers at the ingress level.
13export const k8sHarvSyncCacertsToken = async ({clusterTokenSecName}: {clusterTokenSecName: string}) => {
14  const {cluster_name} = getKlusterCtx()
15  const clusterToken = getGenPlainSec(clusterTokenSecName)
16  const {objectApi} = await getKubeApis({cluster_name})
17
18  const crt = {
19    apiVersion: 'management.cattle.io/v3',
20    kind: 'ClusterRegistrationToken',
21    metadata: {name: 'default-token', namespace: 'local'},
22  }
23
24  const existing = await objectApi.read(crt)
25  const existingToken = (existing as any)?.status?.token
26  if (existingToken === clusterToken) {
27    betLog({cacertsTokenAlreadySynced: true})
28    return
29  }
30
31  ;(existing as any).status ||= {}
32  ;(existing as any).status.token = clusterToken
33  await objectApi.patch(existing)
34  betLog({cacertsTokenSynced: true})
35}
36