From c62159836184dc1fe0c573a10cdb26f9df3ccbaf Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 27 Oct 2025 17:39:31 +0000 Subject: [PATCH 1/4] Initial plan From 5a779348fe4b9520f5fc8bc3faaa0d3d54dda5b8 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 27 Oct 2025 17:52:10 +0000 Subject: [PATCH 2/4] Fix macOS PoP cache isolation bug Previously, all PoP caches on macOS shared the same Keychain entry (service: "kubelogin-pop", account: "MSALCache"), which caused: 1. Test storage and actual cache to conflict 2. Test deletion could clear actual cache data 3. Multiple cache instances couldn't be isolated Now using cache filename as the account identifier to differentiate between different caches. Co-authored-by: daxakp <32614003+daxakp@users.noreply.github.com> --- pkg/internal/pop/cache/darwin.go | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/pkg/internal/pop/cache/darwin.go b/pkg/internal/pop/cache/darwin.go index 6632af0a..4c95a7c3 100644 --- a/pkg/internal/pop/cache/darwin.go +++ b/pkg/internal/pop/cache/darwin.go @@ -3,12 +3,15 @@ package cache import ( + "path/filepath" + "github.com/AzureAD/microsoft-authentication-extensions-for-go/cache/accessor" ) // storage creates a platform-specific accessor for macOS func storage(cachePath string) (accessor.Accessor, error) { - // Use "kubelogin-pop" as the service name in macOS Keychain - // "MSALCache" becomes the account identifier within that service - return accessor.New("kubelogin-pop", accessor.WithAccount("MSALCache")) + // Use the cache filename as the account identifier to differentiate between + // different caches (e.g., test cache vs actual cache) on macOS Keychain + account := filepath.Base(cachePath) + return accessor.New("kubelogin-pop", accessor.WithAccount(account)) } From 4dd5120619ca54ae3a420974558d18f8ff0d3b30 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 27 Oct 2025 18:01:53 +0000 Subject: [PATCH 3/4] Fix PoP cache isolation bug on Linux and macOS The bug affected both Linux and macOS platforms where different cache directories would share the same encryption key, causing cache conflicts and repeated login prompts. Linux: Changed keyring description from filename to full path macOS: Changed Keychain account from fixed "MSALCache" to hash of full path This ensures each cache directory (e.g., different clusters with --cache-dir) has its own isolated encryption key, preventing cache corruption and auth failures. Co-authored-by: daxakp <32614003+daxakp@users.noreply.github.com> --- pkg/internal/pop/cache/darwin.go | 12 ++++++++---- pkg/internal/pop/cache/linux.go | 5 +++-- pkg/internal/pop/cache/linux_test.go | 5 ++--- 3 files changed, 13 insertions(+), 9 deletions(-) diff --git a/pkg/internal/pop/cache/darwin.go b/pkg/internal/pop/cache/darwin.go index 4c95a7c3..94e4a3bf 100644 --- a/pkg/internal/pop/cache/darwin.go +++ b/pkg/internal/pop/cache/darwin.go @@ -3,15 +3,19 @@ package cache import ( - "path/filepath" + "crypto/sha256" + "encoding/hex" "github.com/AzureAD/microsoft-authentication-extensions-for-go/cache/accessor" ) // storage creates a platform-specific accessor for macOS func storage(cachePath string) (accessor.Accessor, error) { - // Use the cache filename as the account identifier to differentiate between - // different caches (e.g., test cache vs actual cache) on macOS Keychain - account := filepath.Base(cachePath) + // Use a hash of the full cache path as the account identifier to ensure uniqueness + // This prevents cache conflicts when multiple cache directories are used + // (e.g., different clusters with different --cache-dir settings) + // We use a hash because macOS Keychain has limitations on account name length + hash := sha256.Sum256([]byte(cachePath)) + account := hex.EncodeToString(hash[:16]) // Use first 16 bytes for reasonable uniqueness return accessor.New("kubelogin-pop", accessor.WithAccount(account)) } diff --git a/pkg/internal/pop/cache/linux.go b/pkg/internal/pop/cache/linux.go index 11e4426d..a7260302 100644 --- a/pkg/internal/pop/cache/linux.go +++ b/pkg/internal/pop/cache/linux.go @@ -67,8 +67,9 @@ func newKeyring(p string) (*keyring, error) { if persistentRing, err := unix.KeyctlInt(unix.KEYCTL_GET_PERSISTENT, -1, ringID, 0, 0); err == nil { ringID = persistentRing } - // Use the actual filename as the keyring description to ensure each file has its own encryption key - description := filepath.Base(p) + // Use the full path as the keyring description to ensure each cache directory has its own encryption key + // This prevents cache conflicts when multiple cache directories are used (e.g., different clusters) + description := p return &keyring{description: description, file: p, ringID: ringID}, nil } diff --git a/pkg/internal/pop/cache/linux_test.go b/pkg/internal/pop/cache/linux_test.go index 95b72261..5540c0b0 100644 --- a/pkg/internal/pop/cache/linux_test.go +++ b/pkg/internal/pop/cache/linux_test.go @@ -140,9 +140,8 @@ func TestKeyringDescription(t *testing.T) { k, err := newKeyring(path) require.NoError(t, err) - // Verify description is the filename - expectedDesc := filepath.Base(path) - require.Equal(t, expectedDesc, k.description) + // Verify description is the full path (changed to prevent cache conflicts) + require.Equal(t, path, k.description) // Verify each path gets a unique description require.False(t, descriptions[k.description], "description %q should be unique", k.description) From 2c2256dc546b2af7d9e15ab88f87c8a641023bb7 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 27 Oct 2025 18:03:55 +0000 Subject: [PATCH 4/4] Final validation complete - all checks passing Co-authored-by: daxakp <32614003+daxakp@users.noreply.github.com> --- .bingo/go.mod | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.bingo/go.mod b/.bingo/go.mod index 610249af..6db5a774 100644 --- a/.bingo/go.mod +++ b/.bingo/go.mod @@ -1 +1,3 @@ -module _ // Fake go.mod auto-created by 'bingo' for go -moddir compatibility with non-Go projects. Commit this file, together with other .mod files. \ No newline at end of file +module _ // Fake go.mod auto-created by 'bingo' for go -moddir compatibility with non-Go projects. Commit this file, together with other .mod files. + +go 1.24.7