From 5652b6c9c0b0590f25fe6e26c105fd16a9226ec7 Mon Sep 17 00:00:00 2001
From: Artem Leshchev <matshch@avride.ai>
Date: Wed, 27 May 2026 10:45:07 -0500
Subject: [PATCH] cmd/k8s-operator: fix token exchange for identity federation
 (#19845)

tailscale-client-go-v2 natively supports identity federation authentication,
and in #19010 the required authentication provider is used, but the manual
token exchange was never removed, so we were exchanging JWT token to an auth
token, and then were trying to use that auth token for exchange once again.
This commit removes the legacy mechanism, fully relying on
tailscale-client-go-v2 to handle authentication.

Fixes #19844

Signed-off-by: Artem Leshchev <matshch@avride.ai>
---
 cmd/k8s-operator/depaware.txt |  2 +-
 cmd/k8s-operator/tsclient.go  | 58 ++---------------------------------
 2 files changed, 3 insertions(+), 57 deletions(-)

diff --git a/cmd/k8s-operator/depaware.txt b/cmd/k8s-operator/depaware.txt
index 1f9b38487..ec5824854 100644
--- a/cmd/k8s-operator/depaware.txt
+++ b/cmd/k8s-operator/depaware.txt
@@ -962,7 +962,7 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
    D    golang.org/x/net/route                                       from tailscale.com/net/netmon+
         golang.org/x/net/websocket                                   from tailscale.com/k8s-operator/sessionrecording/ws
         golang.org/x/oauth2                                          from golang.org/x/oauth2/clientcredentials+
-        golang.org/x/oauth2/clientcredentials                        from tailscale.com/cmd/k8s-operator+
+        golang.org/x/oauth2/clientcredentials                        from tailscale.com/client/tailscale/v2+
         golang.org/x/oauth2/internal                                 from golang.org/x/oauth2+
         golang.org/x/sync/errgroup                                   from github.com/mdlayher/socket+
         golang.org/x/sys/cpu                                         from github.com/tailscale/certstore+
diff --git a/cmd/k8s-operator/tsclient.go b/cmd/k8s-operator/tsclient.go
index 702f4cc53..0670d2bcf 100644
--- a/cmd/k8s-operator/tsclient.go
+++ b/cmd/k8s-operator/tsclient.go
@@ -6,16 +6,11 @@
 package main
 
 import (
-	"context"
 	"fmt"
 	"net/url"
 	"os"
-	"sync"
-	"time"
 
 	"go.uber.org/zap"
-	"golang.org/x/oauth2"
-	"golang.org/x/oauth2/clientcredentials"
 	"tailscale.com/client/tailscale/v2"
 
 	"tailscale.com/ipn"
@@ -58,67 +53,18 @@ func newTSClient(logger *zap.SugaredLogger, clientID, clientIDPath, clientSecret
 		}
 	} else {
 		// Use workload identity federation.
-		tokenSrc := &jwtTokenSource{
-			logger:  logger,
-			jwtPath: oidcJWTPath,
-			baseCfg: clientcredentials.Config{
-				ClientID: clientID,
-				TokenURL: fmt.Sprintf("%s%s", baseURL, "/api/v2/oauth/token-exchange"),
-			},
-		}
-
 		client.Auth = &tailscale.IdentityFederation{
 			ClientID: clientID,
 			IDTokenFunc: func() (string, error) {
-				token, err := tokenSrc.Token()
+				token, err := os.ReadFile(oidcJWTPath)
 				if err != nil {
 					return "", err
 				}
 
-				return token.AccessToken, nil
+				return string(token), nil
 			},
 		}
 	}
 
 	return client, nil
 }
-
-// jwtTokenSource implements the [oauth2.TokenSource] interface, but with the
-// ability to regenerate a fresh underlying token source each time a new value
-// of the JWT parameter is needed due to expiration.
-type jwtTokenSource struct {
-	logger  *zap.SugaredLogger
-	jwtPath string                   // Path to the file containing an automatically refreshed JWT.
-	baseCfg clientcredentials.Config // Holds config that doesn't change for the lifetime of the process.
-
-	mu         sync.Mutex         // Guards underlying.
-	underlying oauth2.TokenSource // The oauth2 client implementation. Does its own separate caching of the access token.
-}
-
-func (s *jwtTokenSource) Token() (*oauth2.Token, error) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	if s.underlying != nil {
-		t, err := s.underlying.Token()
-		if err == nil && t != nil && t.Valid() {
-			return t, nil
-		}
-	}
-
-	s.logger.Debugf("Refreshing JWT from %s", s.jwtPath)
-	tk, err := os.ReadFile(s.jwtPath)
-	if err != nil {
-		return nil, fmt.Errorf("error reading JWT from %q: %w", s.jwtPath, err)
-	}
-
-	// Shallow copy of the base config.
-	credentials := s.baseCfg
-	credentials.EndpointParams = map[string][]string{
-		"jwt": {string(tk)},
-	}
-
-	src := credentials.TokenSource(context.Background())
-	s.underlying = oauth2.ReuseTokenSourceWithExpiry(nil, src, time.Minute)
-	return s.underlying.Token()
-}