Authentication check running inside the Pod for Source and BrokerCell Fanout and Retry

[grac3gao-zz]

Fixes #

Proposed Changes

• Phase one for the Second step to add the authentication check

1. Environment variable to differentiate authentication mode
2. Authentication check running inside the Pod(<-this one)
3. Additional k8s Event check for Secret absence

Note This PR only adds authentication check in Pod of Source and BrokerCell Fanout and Retry.
For Pods using kncloudevent library like Ingress, it is blocked by #1973

• Functionality includes:

1. Running authentication check inside the Pod
2. Writing Termination log into Pod once authentication check failed
3. Remark upper-level resource with authentication related Reason and Message

• Needs to add more UTs.

Release Note

🎁 Authentication check running inside the Pod for Source and BrokerCell Fanout and Retry 

Docs

[knative-prow-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: grac3gao

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [grac3gao]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[grac3gao-zz]

/test pull-google-knative-gcp-conformance-tests

[grac3gao-zz]

/test pull-google-knative-gcp-conformance-tests

[grac3gao-zz]

/test pull-google-knative-gcp-conformance-tests

[Harwayne]

Should this return under some condition? Such as if the auth check fails.

[grac3gao-zz]

It only write statue into the response, which I included in the authcheck.AuthenticationCheck previously. Based on your comment, I'll do:

if err := authcheck.AuthenticationCheck; err != nil {
			pc.logger.Error("authentication check failed", zap.Error(err))
			w.WriteHeader(http.StatusUnauthorized)
                         return
}

[grac3gao-zz]

Was trying to use specific errors, however, in Prow and local, it returns different errors. In local, it can't write error into termination file (no such file), but in Prow, it can. Tried to create file, error showed no permission to do so. Thus, I just verify whether there is an error or not.

[yolocs]

Sorry for the late comments

[yolocs]

/lgtm
/hold for others to take a look

[Harwayne]

/lgtm

[Harwayne]

/unhold

I think only @yolocs and myself were commenting.

[knative-metrics-robot]

The following is the coverage report on the affected files.
Say /test pull-google-knative-gcp-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/intevents/v1/pullsubscription_lifecycle.go	93.5%	94.3%	0.7
pkg/apis/intevents/v1alpha1/brokercell_lifecycle.go	92.5%	94.5%	2.0
pkg/broker/handler/pool.go	82.1%	81.0%	-1.1
pkg/pubsub/adapter/adapter.go	66.7%	67.5%	0.9
pkg/reconciler/brokercell/brokercell.go	95.0%	80.7%	-14.4
pkg/reconciler/intevents/pullsubscription/keda/pullsubscription.go	72.7%	64.0%	-8.7
pkg/reconciler/intevents/pullsubscription/static/pullsubscription.go	100.0%	70.0%	-30.0
pkg/utils/authcheck/authcheck.go	Do not exist	68.4%
pkg/utils/authcheck/authtype.go	85.7%	86.5%	0.8
pkg/utils/authcheck/fake.go	Do not exist	100.0%
pkg/utils/authcheck/list.go	Do not exist	84.6%
pkg/utils/authcheck/probechecker.go	Do not exist	80.0%