2 files changed, 37 insertions, 7 deletions

diff --git a/lib/api/internal/base.rb b/lib/api/internal/base.rb
index 17599c72243..ff687a57888 100644
--- a/lib/api/internal/base.rb
+++ b/lib/api/internal/base.rb
@@ -241,14 +241,16 @@ module API
             break { success: false, message: "Invalid token expiry date: '#{params[:expires_at]}'" }
           end
 
-          access_token = nil
+          result = ::PersonalAccessTokens::CreateService.new(
+            user, name: params[:name], scopes: params[:scopes], expires_at: expires_at
+          ).execute
 
-          ::Users::UpdateService.new(current_user, user: user).execute! do |user|
-            access_token = user.personal_access_tokens.create!(
-              name: params[:name], scopes: params[:scopes], expires_at: expires_at
-            )
+          unless result.status == :success
+            break { success: false, message: "Failed to create token: #{result.message}" }
           end
 
+          access_token = result.payload[:personal_access_token]
+
           { success: true, token: access_token.token, scopes: access_token.scopes, expires_at: access_token.expires_at }
         end
 
diff --git a/lib/api/internal/kubernetes.rb b/lib/api/internal/kubernetes.rb
index 7f64fd7efe3..6d5dfd086e7 100644
--- a/lib/api/internal/kubernetes.rb
+++ b/lib/api/internal/kubernetes.rb
@@ -4,7 +4,16 @@ module API
   # Kubernetes Internal API
   module Internal
     class Kubernetes < Grape::API::Instance
+      before do
+        check_feature_enabled
+        authenticate_gitlab_kas_request!
+      end
+
       helpers do
+        def authenticate_gitlab_kas_request!
+          unauthorized! unless Gitlab::Kas.verify_api_request(headers)
+        end
+
         def agent_token
           @agent_token ||= cluster_agent_token_from_authorization_token
         end
@@ -36,7 +45,7 @@ module API
         end
 
         def check_feature_enabled
-          not_found! unless Feature.enabled?(:kubernetes_agent_internal_api)
+          not_found! unless Feature.enabled?(:kubernetes_agent_internal_api, default_enabled: true, type: :ops)
         end
 
         def check_agent_token
@@ -47,7 +56,6 @@ module API
       namespace 'internal' do
         namespace 'kubernetes' do
           before do
-            check_feature_enabled
             check_agent_token
           end
 
@@ -89,6 +97,26 @@ module API
             }
           end
         end
+
+        namespace 'kubernetes/usage_metrics' do
+          desc 'POST usage metrics' do
+            detail 'Updates usage metrics for agent'
+          end
+          params do
+            requires :gitops_sync_count, type: Integer, desc: 'The count to increment the gitops_sync metric by'
+          end
+          post '/' do
+            gitops_sync_count = params[:gitops_sync_count]
+
+            if gitops_sync_count < 0
+              bad_request!('gitops_sync_count must be greater than or equal to zero')
+            else
+              Gitlab::UsageDataCounters::KubernetesAgentCounter.increment_gitops_sync(gitops_sync_count)
+
+              no_content!
+            end
+          end
+        end
       end
     end
   end