Remove token-refresher sidecar, generate tokens in-process

[gjkim42]

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

Removes the kelos-token-refresher sidecar binary entirely. Spawner and ghproxy pods now generate GitHub App installation tokens in-process using a shared githubapp.TokenProvider, eliminating an extra container, two volumes, and a separate Docker image from every GitHub App pod.

Key changes:

• internal/githubapp: New TokenProvider — thread-safe, caches tokens with a 5-minute expiry margin, accepts *TokenClient and *Credentials at the constructor level (no env-var reads inside the package)
• Deployment builders: Replace sidecar + EmptyDir + Secret volume with GITHUB_APP_ID, GITHUB_APP_INSTALLATION_ID, GITHUB_APP_PRIVATE_KEY env vars injected from the workspace secret
• Spawner / ghproxy / webhook-server: Accept GitHub App credentials as command-line flags (--github-app-id, etc.) defaulting to os.Getenv(…) for backward-compatible K8s deployments. Token resolver is created in main() and passed down — no credential reads inside library packages
• internal/reporting: GitHubReporter.TokenFile replaced with TokenFunc func() string for dynamic token resolution without filesystem I/O
• Deleted: cmd/kelos-token-refresher/, its Dockerfile, all --token-refresher-* controller flags, Helm values, and CLI install options
• Upgrade path: Controller still reconciles InitContainers / Volumes diffs so existing deployments are cleaned up automatically

Which issue(s) this PR is related to:

N/A

Special notes for your reviewer:

• The GITHUB_API_BASE_URL env var is also injected for GHES so the TokenProvider calls the correct API endpoint
• Integration / e2e tests for the sidecar are rewritten to verify env-var injection instead

Does this PR introduce a user-facing change?

Action Required: The `--token-refresher-resource-requests`, `--token-refresher-resource-limits`, and `--token-refresher-image` flags are removed. Remove these flags from any automation scripts or custom controller manifests before upgrading.

Remove the token-refresher sidecar container from spawner and ghproxy pods. GitHub App installation tokens are now generated in-process, reducing per-pod resource usage and simplifying pod specs. Existing deployments are migrated automatically on the next controller reconcile.

🤖 Generated with Claude Code

---

Summary by cubic

Removed the kelos-token-refresher sidecar and now generate GitHub App tokens in-process for spawner, ghproxy, and the webhook. This simplifies deployments, cuts per-pod resources, and makes token refresh request-aware with a 10s default HTTP timeout.

• New Features

  • Added internal/githubapp.TokenProvider (thread-safe; caches with a 5‑min expiry margin; falls back to cached token on refresh errors; NewTokenClient uses a 10s timeout).
  • ghproxy token resolver now accepts context.Context, so refresh is bound to each request.
  • Spawner, ghproxy, and webhook accept PATs via --github-token and GitHub App creds via flags/env; a resolver is built in main() (secrets read after flag parsing and not shown in --help).
  • Replaced file-based tokens with TokenFunc in internal/reporting.GitHubReporter; spawner errors if reporting is enabled without a token resolver.

• Migration

  • Deleted cmd/kelos-token-refresher and removed all --token-refresher-* controller/CLI options and Helm values (images, docs, and dev workflow updated).
  • Removed --github-token-file across spawner, ghproxy, and webhook. Use --github-token or GitHub App flags/env (GITHUB_APP_ID, GITHUB_APP_INSTALLATION_ID, GITHUB_APP_PRIVATE_KEY); for GHES set --github-api-base-url.
  • Upgrades are automatic: the controller reconciles and removes stale initContainers and volumes.

^{Written for commit 7883042. Summary will update on new commits.}

[cubic-dev-ai]

9 issues found across 28 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="cmd/kelos-spawner/main_test.go">

<violation number="1" location="cmd/kelos-spawner/main_test.go:2254">
P2: This injected `TokenResolver` bypasses the env-var fallback, so the test no longer verifies `GITHUB_TOKEN`-based reporting auth.</violation>
</file>

<file name="cmd/kelos-webhook-server/main.go">

<violation number="1" location="cmd/kelos-webhook-server/main.go:55">
P1: Do not use secret env vars as `flag` defaults; they can be echoed in help/usage output and leak the token or private key.</violation>
</file>

<file name="cmd/kelos-spawner/reconciler.go">

<violation number="1" location="cmd/kelos-spawner/reconciler.go:81">
P2: Don't silently skip reporting when reporting is enabled but no token resolver is configured.</violation>

<violation number="2" location="cmd/kelos-spawner/reconciler.go:93">
P2: Returning an empty token here turns resolver failures into repeated unauthenticated GitHub write attempts for every task.</violation>
</file>

<file name="internal/controller/workspace_controller_test.go">

<violation number="1" location="internal/controller/workspace_controller_test.go:91">
P2: This test now covers only `GITHUB_APP_ID`, so it can miss regressions where the other required GitHub App env vars are absent or the deleted token-file wiring is still present.

(Based on your team's feedback about adding or extending tests for new behavior.) [FEEDBACK_USED]</violation>
</file>

<file name="cmd/kelos-spawner/main.go">

<violation number="1" location="cmd/kelos-spawner/main.go:202">
P2: Check `ts.Spec.Suspend` before resolving a GitHub token. As written, suspended GitHub-backed spawners can still mint tokens and fail the cycle instead of skipping cleanly.</violation>

<violation number="2" location="cmd/kelos-spawner/main.go:665">
P1: Do not return a nil resolver on invalid GitHub App credentials. That silently falls back to unauthenticated GitHub requests instead of failing fast on a bad secret.</violation>
</file>

<file name="cmd/ghproxy/main.go">

<violation number="1" location="cmd/ghproxy/main.go:388">
P2: Bound GitHub App token generation with a timeout. Using `context.Background()` here lets a stalled token endpoint hang proxied requests indefinitely.</violation>

<violation number="2" location="cmd/ghproxy/main.go:410">
P1: Avoid using env-derived defaults for secret flags; Go's usage output will print those values when help/usage is shown.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: Check ts.Spec.Suspend before resolving a GitHub token. As written, suspended GitHub-backed spawners can still mint tokens and fail the cycle instead of skipping cleanly.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At cmd/kelos-spawner/main.go, line 202:

<comment>Check `ts.Spec.Suspend` before resolving a GitHub token. As written, suspended GitHub-backed spawners can still mint tokens and fail the cycle instead of skipping cleanly.</comment>

<file context>
@@ -170,27 +179,27 @@ func runReportingCycle(ctx context.Context, cl client.Client, key types.Namespac
 	}
 
-	src, err := buildSourceWithProxy(&ts, githubOwner, githubRepo, ghProxyURL, githubAPIBaseURL, githubTokenFile, jiraBaseURL, jiraProject, jiraJQL, httpClient)
+	src, err := buildSourceWithProxy(ctx, &ts, githubOwner, githubRepo, ghProxyURL, githubAPIBaseURL, tokenResolver, jiraBaseURL, jiraProject, jiraJQL, httpClient)
 	if err != nil {
 		return fmt.Errorf("building source: %w", err)
</file context>

[cubic-dev-ai]

2 issues found across 8 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="internal/githubapp/token.go">

<violation number="1" location="internal/githubapp/token.go:248">
P1: Recompute the expiry check after the refresh attempt fails; using the pre-request timestamp can return an already expired cached token.</violation>
</file>

<file name="internal/githubapp/token_test.go">

<violation number="1" location="internal/githubapp/token_test.go:392">
P3: This test never verifies that the refresh was attempted, so an implementation that incorrectly skips the refresh path would still pass.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}