From 3789dfefcce5161ccc786b76c42db91834e26df9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christoph=20St=C3=A4bler?= Date: Wed, 18 Sep 2024 11:24:17 +0200 Subject: [PATCH] Make pkg/auth independent from eventpolicy informer (#872) --- cmd/broker/filter/main.go | 4 +++- cmd/broker/ingress/main.go | 3 ++- cmd/jobsink/main.go | 3 ++- pkg/auth/token_verifier.go | 6 +++--- pkg/broker/filter/filter_handler_test.go | 5 +++-- pkg/broker/ingress/ingress_handler_test.go | 3 ++- pkg/reconciler/inmemorychannel/dispatcher/controller.go | 3 ++- 7 files changed, 17 insertions(+), 10 deletions(-) diff --git a/cmd/broker/filter/main.go b/cmd/broker/filter/main.go index 8d7d9612745..0278ddde7c2 100644 --- a/cmd/broker/filter/main.go +++ b/cmd/broker/filter/main.go @@ -21,6 +21,8 @@ import ( "fmt" "log" + eventpolicyinformer "knative.dev/eventing/pkg/client/injection/informers/eventing/v1alpha1/eventpolicy" + "github.com/google/uuid" "github.com/kelseyhightower/envconfig" "go.uber.org/zap" @@ -151,7 +153,7 @@ func main() { oidcTokenProvider := auth.NewOIDCTokenProvider(ctx) // We are running both the receiver (takes messages in from the Broker) and the dispatcher (send // the messages to the triggers' subscribers) in this binary. - oidcTokenVerifier := auth.NewOIDCTokenVerifier(ctx) + oidcTokenVerifier := auth.NewOIDCTokenVerifier(ctx, eventpolicyinformer.Get(ctx).Lister()) trustBundleConfigMapInformer := configmapinformer.Get(ctx, eventingtls.TrustBundleLabelSelector).Lister().ConfigMaps(system.Namespace()) handler, err = filter.NewHandler(logger, oidcTokenVerifier, oidcTokenProvider, triggerinformer.Get(ctx), brokerinformer.Get(ctx), reporter, trustBundleConfigMapInformer, ctxFunc) if err != nil { diff --git a/cmd/broker/ingress/main.go b/cmd/broker/ingress/main.go index 456154e7508..082091d424e 100644 --- a/cmd/broker/ingress/main.go +++ b/cmd/broker/ingress/main.go @@ -49,6 +49,7 @@ import ( "knative.dev/eventing/pkg/broker/ingress" eventingclient "knative.dev/eventing/pkg/client/injection/client" brokerinformer "knative.dev/eventing/pkg/client/injection/informers/eventing/v1/broker" + eventpolicyinformer "knative.dev/eventing/pkg/client/injection/informers/eventing/v1alpha1/eventpolicy" eventtypeinformer "knative.dev/eventing/pkg/client/injection/informers/eventing/v1beta2/eventtype" "knative.dev/eventing/pkg/eventingtls" "knative.dev/eventing/pkg/eventtype" @@ -167,7 +168,7 @@ func main() { reporter := ingress.NewStatsReporter(env.ContainerName, kmeta.ChildName(env.PodName, uuid.New().String())) oidcTokenProvider := auth.NewOIDCTokenProvider(ctx) - oidcTokenVerifier := auth.NewOIDCTokenVerifier(ctx) + oidcTokenVerifier := auth.NewOIDCTokenVerifier(ctx, eventpolicyinformer.Get(ctx).Lister()) trustBundleConfigMapInformer := configmapinformer.Get(ctx, eventingtls.TrustBundleLabelSelector).Lister().ConfigMaps(system.Namespace()) handler, err = ingress.NewHandler(logger, reporter, broker.TTLDefaulter(logger, int32(env.MaxTTL)), brokerInformer, oidcTokenVerifier, oidcTokenProvider, trustBundleConfigMapInformer, ctxFunc) if err != nil { diff --git a/cmd/jobsink/main.go b/cmd/jobsink/main.go index 0f8c99646b4..fa28b0e9a12 100644 --- a/cmd/jobsink/main.go +++ b/cmd/jobsink/main.go @@ -54,6 +54,7 @@ import ( "knative.dev/eventing/pkg/apis/sinks" sinksv "knative.dev/eventing/pkg/apis/sinks/v1alpha1" "knative.dev/eventing/pkg/auth" + eventpolicyinformer "knative.dev/eventing/pkg/client/injection/informers/eventing/v1alpha1/eventpolicy" "knative.dev/eventing/pkg/client/injection/informers/sinks/v1alpha1/jobsink" sinkslister "knative.dev/eventing/pkg/client/listers/sinks/v1alpha1" "knative.dev/eventing/pkg/eventingtls" @@ -117,7 +118,7 @@ func main() { k8s: kubeclient.Get(ctx), lister: jobsink.Get(ctx).Lister(), withContext: ctxFunc, - oidcTokenVerifier: auth.NewOIDCTokenVerifier(ctx), + oidcTokenVerifier: auth.NewOIDCTokenVerifier(ctx, eventpolicyinformer.Get(ctx).Lister()), } tlsConfig, err := getServerTLSConfig(ctx) diff --git a/pkg/auth/token_verifier.go b/pkg/auth/token_verifier.go index 0d87cf11f69..29acd7ba5e7 100644 --- a/pkg/auth/token_verifier.go +++ b/pkg/auth/token_verifier.go @@ -26,13 +26,13 @@ import ( "time" duckv1 "knative.dev/eventing/pkg/apis/duck/v1" - eventpolicyinformer "knative.dev/eventing/pkg/client/injection/informers/eventing/v1alpha1/eventpolicy" "knative.dev/eventing/pkg/client/listers/eventing/v1alpha1" "github.com/coreos/go-oidc/v3/oidc" "go.uber.org/zap" "k8s.io/client-go/rest" "knative.dev/eventing/pkg/apis/feature" + listerseventingv1alpha1 "knative.dev/eventing/pkg/client/listers/eventing/v1alpha1" "knative.dev/pkg/injection" "knative.dev/pkg/logging" ) @@ -57,11 +57,11 @@ type IDToken struct { AccessTokenHash string } -func NewOIDCTokenVerifier(ctx context.Context) *OIDCTokenVerifier { +func NewOIDCTokenVerifier(ctx context.Context, eventPolicyLister listerseventingv1alpha1.EventPolicyLister) *OIDCTokenVerifier { tokenHandler := &OIDCTokenVerifier{ logger: logging.FromContext(ctx).With("component", "oidc-token-handler"), restConfig: injection.GetConfig(ctx), - eventPolicyLister: eventpolicyinformer.Get(ctx).Lister(), + eventPolicyLister: eventPolicyLister, } if err := tokenHandler.initOIDCProvider(ctx); err != nil { diff --git a/pkg/broker/filter/filter_handler_test.go b/pkg/broker/filter/filter_handler_test.go index e220e401774..9322a396d3e 100644 --- a/pkg/broker/filter/filter_handler_test.go +++ b/pkg/broker/filter/filter_handler_test.go @@ -51,6 +51,7 @@ import ( brokerinformerfake "knative.dev/eventing/pkg/client/injection/informers/eventing/v1/broker/fake" triggerinformerfake "knative.dev/eventing/pkg/client/injection/informers/eventing/v1/trigger/fake" + eventpolicyinformerfake "knative.dev/eventing/pkg/client/injection/informers/eventing/v1alpha1/eventpolicy/fake" // Fake injection client _ "knative.dev/eventing/pkg/client/injection/informers/eventing/v1alpha1/eventpolicy/fake" @@ -439,7 +440,7 @@ func TestReceiver(t *testing.T) { logger := zaptest.NewLogger(t, zaptest.WrapOptions(zap.AddCaller())) oidcTokenProvider := auth.NewOIDCTokenProvider(ctx) - oidcTokenVerifier := auth.NewOIDCTokenVerifier(ctx) + oidcTokenVerifier := auth.NewOIDCTokenVerifier(ctx, eventpolicyinformerfake.Get(ctx).Lister()) for _, trig := range tc.triggers { // Replace the SubscriberURI to point at our fake server. @@ -638,7 +639,7 @@ func TestReceiver_WithSubscriptionsAPI(t *testing.T) { logger := zaptest.NewLogger(t, zaptest.WrapOptions(zap.AddCaller())) oidcTokenProvider := auth.NewOIDCTokenProvider(ctx) - oidcTokenVerifier := auth.NewOIDCTokenVerifier(ctx) + oidcTokenVerifier := auth.NewOIDCTokenVerifier(ctx, eventpolicyinformerfake.Get(ctx).Lister()) // Replace the SubscriberURI to point at our fake server. for _, trig := range tc.triggers { diff --git a/pkg/broker/ingress/ingress_handler_test.go b/pkg/broker/ingress/ingress_handler_test.go index db6a18dda4c..1938292d1f7 100644 --- a/pkg/broker/ingress/ingress_handler_test.go +++ b/pkg/broker/ingress/ingress_handler_test.go @@ -44,6 +44,7 @@ import ( "knative.dev/eventing/pkg/broker" brokerinformerfake "knative.dev/eventing/pkg/client/injection/informers/eventing/v1/broker/fake" + eventpolicyinformerfake "knative.dev/eventing/pkg/client/injection/informers/eventing/v1alpha1/eventpolicy/fake" // Fake injection client _ "knative.dev/eventing/pkg/client/injection/informers/eventing/v1alpha1/eventpolicy/fake" @@ -290,7 +291,7 @@ func TestHandler_ServeHTTP(t *testing.T) { } tokenProvider := auth.NewOIDCTokenProvider(ctx) - tokenVerifier := auth.NewOIDCTokenVerifier(ctx) + tokenVerifier := auth.NewOIDCTokenVerifier(ctx, eventpolicyinformerfake.Get(ctx).Lister()) h, err := NewHandler(logger, &mockReporter{}, diff --git a/pkg/reconciler/inmemorychannel/dispatcher/controller.go b/pkg/reconciler/inmemorychannel/dispatcher/controller.go index fbe1cd4fde3..859f04ac73f 100644 --- a/pkg/reconciler/inmemorychannel/dispatcher/controller.go +++ b/pkg/reconciler/inmemorychannel/dispatcher/controller.go @@ -54,6 +54,7 @@ import ( "knative.dev/eventing/pkg/apis/feature" "knative.dev/eventing/pkg/channel" eventingclient "knative.dev/eventing/pkg/client/injection/client" + eventpolicyinformer "knative.dev/eventing/pkg/client/injection/informers/eventing/v1alpha1/eventpolicy" eventtypeinformer "knative.dev/eventing/pkg/client/injection/informers/eventing/v1beta2/eventtype" inmemorychannelinformer "knative.dev/eventing/pkg/client/injection/informers/messaging/v1/inmemorychannel" inmemorychannelreconciler "knative.dev/eventing/pkg/client/injection/reconciler/messaging/v1/inmemorychannel" @@ -136,7 +137,7 @@ func NewController( eventingClient: eventingclient.Get(ctx).EventingV1beta2(), eventTypeLister: eventtypeinformer.Get(ctx).Lister(), eventDispatcher: kncloudevents.NewDispatcher(clientConfig, oidcTokenProvider), - tokenVerifier: auth.NewOIDCTokenVerifier(ctx), + tokenVerifier: auth.NewOIDCTokenVerifier(ctx, eventpolicyinformer.Get(ctx).Lister()), clientConfig: clientConfig, }