Authenticate Requests from ApiServerSources

cmd/controller/main.go

@@ -26,6 +26,7 @@ import (
 	"os"
 	"time"
 
+	filteredFactory "knative.dev/pkg/client/injection/kube/informers/factory/filtered"
 	"knative.dev/pkg/injection/sharedmain"
 	"knative.dev/pkg/signals"
 
@@ -73,6 +74,9 @@ func main() {
 		}
 	}()
 
+	oidcSelector := "role=oidc-token-creator"
+	ctx = filteredFactory.WithSelectors(ctx, oidcSelector)
+
 	sharedmain.MainWithContext(ctx, "controller",
 		// Messaging
 		channel.NewController,

pkg/reconciler/apiserversource/apiserversource_test.go

@@ -21,6 +21,8 @@ import (
 	"fmt"
 	"testing"
 
+	"knative.dev/pkg/kmeta"
+
 	rbacv1 "k8s.io/api/rbac/v1"
 
 	"github.com/stretchr/testify/require"
@@ -1337,13 +1339,34 @@ func makeSubjectAccessReview(resource, verb, sa string) *authorizationv1.Subject
 }
 
 func makeOIDCRole() *rbacv1.Role {
+	src := rttestingv1.NewApiServerSource(sourceName, testNS,
+		rttestingv1.WithApiServerSourceSpec(sourcesv1.ApiServerSourceSpec{
+			Resources: []sourcesv1.APIVersionKindSelector{{
+				APIVersion: "v1",
+				Kind:       "Namespace",
+			}},
+			EventMode:  sourcesv1.ResourceMode,
+			SourceSpec: duckv1.SourceSpec{Sink: sinkDest},
+		}),
+		rttestingv1.WithApiServerSourceUID(sourceUID),
+		// Status Update:
+		rttestingv1.WithInitApiServerSourceConditions,
+		rttestingv1.WithApiServerSourceDeployed,
+		rttestingv1.WithApiServerSourceSink(sinkURI),
+	)
 	return &rbacv1.Role{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      resources.GetOIDCTokenRoleName(sourceName),
 			Namespace: testNS,
 			Annotations: map[string]string{
 				"description": fmt.Sprintf("Role for OIDC Authentication for ApiServerSource %q", sourceName),
 			},
+			Labels: map[string]string{
+				"role": "oidc-token-creator",
+			},
+			OwnerReferences: []metav1.OwnerReference{
+				*kmeta.NewControllerRef(src),
+			},
 		},
 		Rules: []rbacv1.PolicyRule{
 			{
@@ -1358,13 +1381,34 @@ func makeOIDCRole() *rbacv1.Role {
 }
 
 func makeOIDCRoleBinding() *rbacv1.RoleBinding {
+	src := rttestingv1.NewApiServerSource(sourceName, testNS,
+		rttestingv1.WithApiServerSourceSpec(sourcesv1.ApiServerSourceSpec{
+			Resources: []sourcesv1.APIVersionKindSelector{{
+				APIVersion: "v1",
+				Kind:       "Namespace",
+			}},
+			EventMode:  sourcesv1.ResourceMode,
+			SourceSpec: duckv1.SourceSpec{Sink: sinkDest},
+		}),
+		rttestingv1.WithApiServerSourceUID(sourceUID),
+		// Status Update:
+		rttestingv1.WithInitApiServerSourceConditions,
+		rttestingv1.WithApiServerSourceDeployed,
+		rttestingv1.WithApiServerSourceSink(sinkURI),
+	)
 	return &rbacv1.RoleBinding{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      resources.GetOIDCTokenRoleBindingName(sourceName),
 			Namespace: testNS,
 			Annotations: map[string]string{
 				"description": fmt.Sprintf("Role Binding for OIDC Authentication for ApiServerSource %q", sourceName),
 			},
+			Labels: map[string]string{
+				"role": "oidc-token-creator",
+			},
+			OwnerReferences: []metav1.OwnerReference{
+				*kmeta.NewControllerRef(src),
+			},
 		},
 		RoleRef: rbacv1.RoleRef{
 			APIGroup: "rbac.authorization.k8s.io",

pkg/reconciler/apiserversource/controller.go

@@ -19,8 +19,6 @@ package apiserversource
 import (
 	"context"
 
-	filtered "knative.dev/eventing/pkg/client/injection/informers/factory/filtered"
-
 	"knative.dev/eventing/pkg/apis/feature"
 
 	"github.com/kelseyhightower/envconfig"
@@ -64,10 +62,9 @@ func NewController(
 	serviceaccountInformer := serviceaccountinformer.Get(ctx)
 
 	// Create a selector string
-	selectorString := "role=oidc-token-creator"
-	ctx = filtered.WithSelectors(ctx, selectorString)
-	roleInformer := roleinformer.Get(ctx, selectorString)
-	rolebindingInformer := rolebindinginformer.Get(ctx, selectorString)
+	oidcSelectorString := "role=oidc-token-creator"
+	roleInformer := roleinformer.Get(ctx, oidcSelectorString)
+	rolebindingInformer := rolebindinginformer.Get(ctx, oidcSelectorString)
 
 	var globalResync func(obj interface{})
 

pkg/reconciler/apiserversource/controller_test.go

@@ -20,6 +20,8 @@ import (
 	"os"
 	"testing"
 
+	filteredFactory "knative.dev/pkg/client/injection/kube/informers/factory/filtered"
+
 	"knative.dev/eventing/pkg/apis/feature"
 
 	corev1 "k8s.io/api/core/v1"
@@ -42,8 +44,13 @@ import (
 
 func TestNew(t *testing.T) {
 	ctx, _ := SetupFakeContext(t)
+
+	oidcSelector := "role=oidc-token-creator"
+	ctx = filteredFactory.WithSelectors(ctx, oidcSelector)
+
 	ctx = withCfgHost(ctx, &rest.Config{Host: "unit_test"})
 	ctx = addressable.WithDuck(ctx)
+
 	os.Setenv("METRICS_DOMAIN", "knative.dev/eventing")
 	os.Setenv("APISERVER_RA_IMAGE", "knative.dev/example")
 	c := NewController(ctx, configmap.NewStaticWatcher(&corev1.ConfigMap{

pkg/reconciler/apiserversource/resources/oidc_rolebinding.go

@@ -54,6 +54,9 @@ func MakeOIDCRole(source *v1.ApiServerSource) (*rbacv1.Role, error) {
 			Labels: map[string]string{
 				"role": "oidc-token-creator",
 			},
+			OwnerReferences: []metav1.OwnerReference{
+				*kmeta.NewControllerRef(source),
+			},
 		},
 		Rules: []rbacv1.PolicyRule{
 			rbacv1.PolicyRule{
@@ -89,6 +92,9 @@ func MakeOIDCRoleBinding(source *v1.ApiServerSource) (*rbacv1.RoleBinding, error
 			Labels: map[string]string{
 				"role": "oidc-token-creator",
 			},
+			OwnerReferences: []metav1.OwnerReference{
+				*kmeta.NewControllerRef(source),
+			},
 		},
 		RoleRef: rbacv1.RoleRef{
 			APIGroup: "rbac.authorization.k8s.io",