Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Authenticate requests from mt-broker-ingress to underlying channel #7473

Merged
merged 2 commits into from
Nov 24, 2023
Merged

Authenticate requests from mt-broker-ingress to underlying channel #7473

merged 2 commits into from
Nov 24, 2023

Conversation

creydr
Copy link
Member

@creydr creydr commented Nov 24, 2023

Fixes #7472

Proposed Changes

  • 🎁 authenticate requests from mt-broker-filter to underlying channel (uses dedicated mt-broker-ingress-oidc service account and audience of channel)

@knative-prow knative-prow bot requested review from aliok and Leo6Leo November 24, 2023 09:01
@knative-prow knative-prow bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Nov 24, 2023
@creydr creydr mentioned this pull request Nov 24, 2023
Merged
5 tasks
@creydr creydr requested review from pierDipi and Cali0707 November 24, 2023 09:02
@codecov Codecov
Copy link

codecov bot commented Nov 24, 2023 •
edited
Loading

Codecov Report

Attention: 5 lines in your changes are missing coverage. Please review.

Comparison is base (02d572e) 76.81% compared to head (b4fab82) 76.71%.
Report is 2 commits behind head on main.

Files Patch % Lines
pkg/broker/ingress/ingress_handler.go 70.58% 3 Missing and 2 partials ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #7473      +/-   ##
==========================================
- Coverage   76.81%   76.71%   -0.10%     
==========================================
  Files         253      253              
  Lines       14136    14212      +76     
==========================================
+ Hits        10858    10903      +45     
- Misses       2736     2759      +23     
- Partials      542      550       +8

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@creydr
Copy link
Member Author

creydr commented Nov 24, 2023

@Cali0707 @Leo6Leo could you check on this PR, when you have some time?
/cc @Cali0707 @Leo6Leo

Cali0707
Cali0707 reviewed Nov 24, 2023
View reviewed changes
Copy link
Member

@Cali0707 Cali0707 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One nit, otherwise looks good! (sorry I missed the nit earlier)

config/brokers/mt-channel-broker/roles/ingress-serviceaccount-oidc.yaml Outdated Show resolved Hide resolved
@creydr creydr requested a review from Cali0707 November 24, 2023 16:21
Cali0707
Cali0707 approved these changes Nov 24, 2023
View reviewed changes
Copy link
Member

@Cali0707 Cali0707 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@knative-prow knative-prow bot added the lgtm Indicates that a PR is ready to be merged. label Nov 24, 2023
@knative-prow Knative Prow
Copy link

knative-prow bot commented Nov 24, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Cali0707, creydr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Leo6Leo
Leo6Leo reviewed Nov 24, 2023
View reviewed changes
pkg/broker/ingress/ingress_handler.go
dispatchInfo, err := h.eventDispatcher.SendEvent(ctx, *event, *channelAddress, kncloudevents.WithHeader(headers))
opts := []kncloudevents.SendOption{
kncloudevents.WithHeader(headers),
kncloudevents.WithOIDCAuthentication(&types.NamespacedName{
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

JWT token will be added when cloudEvent dispatcher is going to send the event, which is what I am implementing here https://github.com/knative/eventing/pull/7452/files right, just to confirm @creydr

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure if I understood you correctly, but this PR here is for broker-ingress. In the ApiServerSource, we need something similar. The difference is, that the ApiServerSource does not use the kncloudevents.Dispatcher, which does all this for you. The ApiServerSource uses the CloudEvents SDK client, which requires you to add the JWT "manually" as part of the Authorization header (what you're doing here).

@knative-prow knative-prow bot merged commit d989ca7 into knative:main Nov 24, 2023
32 of 34 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Leo6Leo Leo6Leo Leo6Leo left review comments

@Cali0707 Cali0707 Cali0707 approved these changes

@aliok aliok Awaiting requested review from aliok

@pierDipi pierDipi Awaiting requested review from pierDipi

Assignees

@Cali0707 Cali0707

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

mt-broker-ingress: authenticate request to underlying channel
3 participants
@creydr @Leo6Leo @Cali0707