NO-ISSUE: Pass OC_IMPERSONATE to osac login token-script

[sk-ilya]

OC_IMPERSONATE defines a bash function wrapper around oc, but osac spawns oc as a child process that bypasses the wrapper. Forward the --as flag into the token-script string when OC_IMPERSONATE is set.

Summary by CodeRabbit

• New Features
  • Enhanced Kubernetes/OpenShift authentication with conditional user impersonation support in login workflows. When enabled, the token generation process automatically applies specified user impersonation settings to authentication requests. Full backward compatibility is maintained, allowing standard deployments to continue operating with existing behavior.

[openshift-ci-robot]

@sk-ilya: This pull request explicitly references no jira issue.

Details

In response to this:

OC_IMPERSONATE defines a bash function wrapper around oc, but osac spawns oc as a child process that bypasses the wrapper. Forward the --as flag into the token-script string when OC_IMPERSONATE is set.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sk-ilya
Once this PR has been reviewed and has the lgtm label, please assign danmanor for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Walkthrough

In scripts/prepare-fulfillment-service.sh, the create_hub function now checks the OC_IMPERSONATE environment variable. When set, it constructs an _impersonate_flag (--as ${OC_IMPERSONATE}) and injects it into the oc create token command used by the osac login token-script. When unset, behavior is unchanged.

Changes

Conditional User Impersonation in create_hub

Layer / File(s)	Summary
OC_IMPERSONATE flag injection into oc create token scripts/prepare-fulfillment-service.sh	create_hub conditionally computes _impersonate_flag from OC_IMPERSONATE and injects it as --as into the oc create token command passed to osac login via retry_command; when OC_IMPERSONATE is unset, the command is unchanged.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~5 minutes

Possibly related PRs

• osac-project/osac-installer#105: Both PRs implement OpenShift user impersonation via OC_IMPERSONATE, with this earlier PR introducing an oc CLI wrapper that injects --as and the current PR extending the same pattern into the create_hub token creation flow.

Suggested reviewers

• eranco74
• larsks

Poem

🔐 When OC_IMPERSONATE speaks, the token obeys,
--as slips in, a flag through the haze.
One variable set, a new identity worn,
Unset? No trace — as if never born.
⚠️ Privilege escalation risk: handle with care,
For who holds the flag holds the cluster's affair.

---

🔕 Pre-merge checks override applied

The pre-merge checks have been overridden successfully. You can now proceed with the merge.

Overridden by @sk-ilya via checkbox on 2026-06-14T09:49:48.189Z.

❌ Failed checks (2 errors, 1 warning)

Check name	Status	Explanation	Resolution
No-Injection-Vectors	❌ Error [IGNORED]	Shell injection vector identified: OC_IMPERSONATE variable is interpolated without escaping in line 27 and embedded into a shell command string passed to osac login. Shell metacharacters in OC_IMPE...	Use printf %q to properly escape OC_IMPERSONATE: _impersonate_flag="--as $(printf '%q' "${OC_IMPERSONATE}")" before embedding in token-script string.
No-Sensitive-Data-In-Logs	❌ Error [IGNORED]	The retry_command function logs complete commands including arguments via echo. The new code exposes sensitive data: Kubernetes token creation commands, service account names (via OC_IMPERSONATE)...	Use printf %q to escape OC_IMPERSONATE for safe shell interpolation, or suppress logging of token-script arguments by modifying retry_command to redact sensitive arguments or use alternative logging mechanisms.
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (8 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the primary change: passing OC_IMPERSONATE to the osac login token-script, which matches the core modification in the changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	PR changes contain no hardcoded secrets: all sensitive values (OC_IMPERSONATE, INSTALLER_NAMESPACE) come from environment variables, not hardcoded credentials.
No-Weak-Crypto	✅ Passed	No weak cryptographic algorithms (MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB), custom crypto implementations, or non-constant-time secret comparisons detected. Changes are limited to shell script env...
Container-Privileges	✅ Passed	This PR modifies only a bash deployment script (scripts/prepare-fulfillment-service.sh), not container or K8s manifests. The container-privileges check is not applicable to bash scripts.
Ai-Attribution	✅ Passed	AI tool (Claude Code) was used and properly attributed with Assisted-by trailer in commit message, following Red Hat conventions.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/prepare-fulfillment-service.sh`:
- Around line 24-28: The `_impersonate_flag` variable is constructed by directly
interpolating the `OC_IMPERSONATE` environment variable into a command string
that will be executed as a shell command by osac. This creates a command
injection vulnerability if the variable contains shell metacharacters. Use
printf %q to properly escape the OC_IMPERSONATE value before embedding it in the
_impersonate_flag assignment, ensuring that any special shell characters are
safely quoted for deferred shell execution in the token-script parameter.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 484b4987-0ede-47b3-a71c-97529770119a

📥 Commits

Reviewing files that changed from the base of the PR and between bffd729 and 94694d6.

📒 Files selected for processing (1)

• scripts/prepare-fulfillment-service.sh