Passing downstream user’s private key to the upstream backend in the K8s plugin

[dharmjit]

Awesome project! I was going through the K8s plugin Pipe CRD API specs and was wondering whether its possible to omit the AuthorizedKeys in the FromSpec and the PrivateKeySecret in the ToSpec or they are required?

The reasoning is that the authorized key would already be present in the target upstream pod, and the private key could be provided by the downstream user at runtime.

type FromSpec struct {
	Username             string                      `json:"username"`
	UsernameRegexMatch   bool                        `json:"username_regex_match,omitempty"`
	AuthorizedKeysData   string                      `json:"authorized_keys_data,omitempty"`
	AuthorizedKeysFile   string                      `json:"authorized_keys_file,omitempty"`
	AuthorizedKeysSecret corev1.LocalObjectReference `json:"authorized_keys_secret,omitempty"`
	HtpasswdData         string                      `json:"htpasswd_data,omitempty"`
	HtpasswdFile         string                      `json:"htpasswd_file,omitempty"`
}

type ToSpec struct {
	Username         string                      `json:"username,omitempty"`
	Host             string                      `json:"host"`
	PrivateKeySecret corev1.LocalObjectReference `json:"private_key_secret,omitempty"`
	PasswordSecret   corev1.LocalObjectReference `json:"password_secret,omitempty"`
	KnownHostsData   string                      `json:"known_hosts_data,omitempty"`
	IgnoreHostkey    bool                        `json:"ignore_hostkey,omitempty"`
}

[tg123]

no way to forward privatekey to upstream