Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add library for OIDC token management #7315

Merged
merged 4 commits into from
Oct 4, 2023
Merged

Add library for OIDC token management #7315

merged 4 commits into from
Oct 4, 2023

Conversation

creydr
Copy link
Member

@creydr creydr commented Sep 28, 2023 •
edited
Loading

Fixes #7175

Proposed Changes

  • 🎁 Add library for OIDC token management
    • Provide OIDCTokenProvider.GetJWT() method to return a JWT for a given service account and audience
    • Provide OIDCTokenVerifier.VerifyJWT() method to verify a token with the provider configured for the cluster

Open points:

  • Add token caching (could also be done in a follow up PR to unblock other devs)

@knative-prow knative-prow bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. area/test-and-release Test infrastructure, tests or release size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Sep 28, 2023
@knative-prow
Copy link

knative-prow bot commented Sep 28, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: creydr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@knative-prow knative-prow bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 28, 2023
@codecov
Copy link

codecov bot commented Sep 28, 2023 •
edited
Loading

Codecov Report

Attention: 105 lines in your changes are missing coverage. Please review.

Comparison is base (a78c626) 77.53% compared to head (243c52e) 76.91%.
Report is 4 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #7315      +/-   ##
==========================================
- Coverage   77.53%   76.91%   -0.62%     
==========================================
  Files         250      252       +2     
  Lines       13566    13671     +105     
==========================================
- Hits        10518    10515       -3     
- Misses       2523     2630     +107     
- Partials      525      526       +1
Files Coverage Δ
pkg/auth/token_provider.go 0.00% <0.00%> (ø)
pkg/auth/token_verifier.go 0.00% <0.00%> (ø)

... and 1 file with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

pierDipi
pierDipi reviewed Sep 28, 2023
View reviewed changes
pkg/auth/token_handler.go Outdated Show resolved Hide resolved
pkg/auth/token_handler.go Outdated Show resolved Hide resolved
pkg/auth/token_handler.go Outdated Show resolved Hide resolved
pkg/auth/token_handler.go Outdated Show resolved Hide resolved
pkg/auth/token_handler.go Outdated Show resolved Hide resolved
pkg/auth/token_handler.go Outdated Show resolved Hide resolved
pkg/auth/token_handler.go Outdated Show resolved Hide resolved
pierDipi
pierDipi reviewed Oct 2, 2023
View reviewed changes
pkg/channel/event_receiver.go Outdated Show resolved Hide resolved
pkg/auth/token_handler.go Outdated Show resolved Hide resolved
@creydr creydr changed the title [WIP] Add library for OIDC token management Add library for OIDC token management Oct 2, 2023
@knative-prow knative-prow bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 2, 2023
@creydr
Copy link
Member Author

creydr commented Oct 2, 2023

@pierDipi I changed this PR to only include the library. Will do the dispatcher changes in a separate PR. Also I split the library into a provider and a verifier. Could you PTAL?
Thanks in advance

/cc @pierDipi

@knative-prow knative-prow bot requested a review from pierDipi October 2, 2023 12:31
@creydr creydr mentioned this pull request Oct 2, 2023
Merged
pierDipi
pierDipi reviewed Oct 4, 2023
View reviewed changes
Copy link
Member

@pierDipi pierDipi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are you planning to add some unit tests?

hack/create-kind-cluster.sh
@@ -34,7 +34,7 @@ kubeadmConfigPatches:
kind: ClusterConfiguration
apiServer:
extraArgs:
"service-account-issuer": "kubernetes.default.svc"
"service-account-issuer": "https://kubernetes.default.svc"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does that mean https:// is required? Could we infer it when it's missing since without it is considered valid by the k8s API server?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

afaik, https for OIDC is required, so assuming scheme = https would work

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When I setup a kind cluster without https://, I got a 404 on /.well-known/...
From the docs:

The issuer URL must comply with the OIDC Discovery Spec. In practice, this means it must use the https scheme, and should serve an OpenID provider configuration at {service-account-issuer}/.well-known/openid-configuration

@creydr
Copy link
Member Author

creydr commented Oct 4, 2023

Are you planning to add some unit tests?

The token_provider is mostly a wrapper around the TokenRequest API without much additional logic. So I don't see value here yet.
The token_verifier is mostly a wrapper around the coreos/oidc library. IMO only the loading of the config could be tested, but this would require some mocking of a OIDC config provider server (.well-known/ endpoints) and I am not sure if it is worth that, as we will have e2e tests for the whole flow.

@creydr creydr requested a review from pierDipi October 4, 2023 13:34
@pierDipi
Copy link
Member

pierDipi commented Oct 4, 2023

/lgtm

@knative-prow knative-prow bot added the lgtm Indicates that a PR is ready to be merged. label Oct 4, 2023
@knative-prow knative-prow bot merged commit 402f6ac into knative:main Oct 4, 2023
33 of 39 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@matzew matzew Awaiting requested review from matzew

@mgencur mgencur Awaiting requested review from mgencur

@pierDipi pierDipi Awaiting requested review from pierDipi

Assignees

@pierDipi pierDipi

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/test-and-release Test infrastructure, tests or release lgtm Indicates that a PR is ready to be merged. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Provide a library for OIDC token management
2 participants
@creydr @pierDipi