Skip to content

Commit 0673f36

Browse files
creydrcreydr
authored
[release-1.13] Containersource use OIDC identity of corresponding SinkBinding (#7898)
* Revert "feat: support auto generation of ContainerSource identity service account and expose in AuthStatus (#7461)" This reverts commit 116abe2. * Containersource use OIDC identity of corresponding SinkBinding * Run gofmt and goimports * Fix build issue
1 parent 1b8b450 commit 0673f36

File tree

7 files changed

+46
-255
lines changed

7 files changed

+46
-255
lines changed

‎pkg/apis/sources/v1/container_lifecycle.go‎

Lines changed: 4 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -31,14 +31,11 @@ const (
3131

3232
// ContainerSourceConditionReceiveAdapterReady has status True when the ContainerSource's ReceiveAdapter is ready.
3333
ContainerSourceConditionReceiveAdapterReady apis.ConditionType = "ReceiveAdapterReady"
34-
35-
ContainerConditionOIDCIdentityCreated apis.ConditionType = "OIDCIdentityCreated"
3634
)
3735

3836
var containerCondSet = apis.NewLivingConditionSet(
3937
ContainerSourceConditionSinkBindingReady,
4038
ContainerSourceConditionReceiveAdapterReady,
41-
ContainerConditionOIDCIdentityCreated,
4239
)
4340

4441
// GetConditionSet retrieves the condition set for this resource. Implements the KRShaped interface.
@@ -66,23 +63,7 @@ func (s *ContainerSourceStatus) InitializeConditions() {
6663
containerCondSet.Manage(s).InitializeConditions()
6764
}
6865

69-
func (s *ContainerSourceStatus) MarkOIDCIdentityCreatedSucceeded() {
70-
containerCondSet.Manage(s).MarkTrue(ContainerConditionOIDCIdentityCreated)
71-
}
72-
73-
func (s *ContainerSourceStatus) MarkOIDCIdentityCreatedSucceededWithReason(reason, messageFormat string, messageA ...interface{}) {
74-
containerCondSet.Manage(s).MarkTrueWithReason(ContainerConditionOIDCIdentityCreated, reason, messageFormat, messageA...)
75-
}
76-
77-
func (s *ContainerSourceStatus) MarkOIDCIdentityCreatedFailed(reason, messageFormat string, messageA ...interface{}) {
78-
containerCondSet.Manage(s).MarkFalse(ContainerConditionOIDCIdentityCreated, reason, messageFormat, messageA...)
79-
}
80-
81-
func (s *ContainerSourceStatus) MarkOIDCIdentityCreatedUnknown(reason, messageFormat string, messageA ...interface{}) {
82-
containerCondSet.Manage(s).MarkUnknown(ContainerConditionOIDCIdentityCreated, reason, messageFormat, messageA...)
83-
}
84-
85-
// PropagateSinkBindingStatus uses the availability of the provided Deployment to determine if
66+
// PropagateSinkBindingStatus uses the SinkBinding to determine if
8667
// ContainerSourceConditionSinkBindingReady should be marked as true, false or unknown.
8768
func (s *ContainerSourceStatus) PropagateSinkBindingStatus(status *SinkBindingStatus) {
8869
// Do not copy conditions nor observedGeneration
@@ -105,6 +86,9 @@ func (s *ContainerSourceStatus) PropagateSinkBindingStatus(status *SinkBindingSt
10586
default:
10687
containerCondSet.Manage(s).MarkUnknown(ContainerSourceConditionSinkBindingReady, cond.Reason, cond.Message)
10788
}
89+
90+
// Propagate SinkBindings AuthStatus to containersources AuthStatus
91+
s.Auth = status.Auth
10892
}
10993

11094
// PropagateReceiveAdapterStatus uses the availability of the provided Deployment to determine if

‎pkg/apis/sources/v1/container_lifecycle_test.go‎

Lines changed: 1 addition & 120 deletions
Original file line numberDiff line numberDiff line change
@@ -104,36 +104,24 @@ func TestContainerSourceStatusIsReady(t *testing.T) {
104104
}(),
105105
wantConditionStatus: corev1.ConditionUnknown,
106106
want: false,
107-
}, {
108-
name: "mark ready sa",
109-
s: func() *ContainerSourceStatus {
110-
s := &ContainerSourceStatus{}
111-
s.InitializeConditions()
112-
s.MarkOIDCIdentityCreatedSucceeded()
113-
return s
114-
}(),
115-
wantConditionStatus: corev1.ConditionUnknown,
116-
want: false,
117107
}, {
118108
name: "mark ready sb and ra",
119109
s: func() *ContainerSourceStatus {
120110
s := &ContainerSourceStatus{}
121111
s.InitializeConditions()
122112
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
123113
s.PropagateReceiveAdapterStatus(availableDeployment)
124-
s.MarkOIDCIdentityCreatedSucceeded()
125114
return s
126115
}(),
127116
wantConditionStatus: corev1.ConditionTrue,
128117
want: true,
129118
}, {
130-
name: "mark ready sb and unavailable ra ",
119+
name: "mark ready sb and unavailable ra",
131120
s: func() *ContainerSourceStatus {
132121
s := &ContainerSourceStatus{}
133122
s.InitializeConditions()
134123
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
135124
s.PropagateReceiveAdapterStatus(unavailableDeployment)
136-
s.MarkOIDCIdentityCreatedSucceeded()
137125
return s
138126
}(),
139127
wantConditionStatus: corev1.ConditionFalse,
@@ -145,55 +133,17 @@ func TestContainerSourceStatusIsReady(t *testing.T) {
145133
s.InitializeConditions()
146134
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
147135
s.PropagateReceiveAdapterStatus(unknownDeployment)
148-
s.MarkOIDCIdentityCreatedSucceeded()
149136
return s
150137
}(),
151138
wantConditionStatus: corev1.ConditionUnknown,
152139
want: false,
153-
}, {
154-
name: "mark ready sb and ra no sa",
155-
s: func() *ContainerSourceStatus {
156-
s := &ContainerSourceStatus{}
157-
s.InitializeConditions()
158-
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
159-
s.PropagateReceiveAdapterStatus(availableDeployment)
160-
s.MarkOIDCIdentityCreatedFailed("", "")
161-
return s
162-
}(),
163-
wantConditionStatus: corev1.ConditionFalse,
164-
want: false,
165-
}, {
166-
name: "mark ready sb, ra and sa unknown",
167-
s: func() *ContainerSourceStatus {
168-
s := &ContainerSourceStatus{}
169-
s.InitializeConditions()
170-
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
171-
s.PropagateReceiveAdapterStatus(availableDeployment)
172-
s.MarkOIDCIdentityCreatedUnknown("Unknown", "")
173-
return s
174-
}(),
175-
wantConditionStatus: corev1.ConditionUnknown,
176-
want: false,
177-
}, {
178-
name: "mark ready sb, ra and sa with reason",
179-
s: func() *ContainerSourceStatus {
180-
s := &ContainerSourceStatus{}
181-
s.InitializeConditions()
182-
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
183-
s.PropagateReceiveAdapterStatus(availableDeployment)
184-
s.MarkOIDCIdentityCreatedSucceededWithReason("Created", "")
185-
return s
186-
}(),
187-
wantConditionStatus: corev1.ConditionTrue,
188-
want: true,
189140
}, {
190141
name: "mark ready sb and not deployed ra",
191142
s: func() *ContainerSourceStatus {
192143
s := &ContainerSourceStatus{}
193144
s.InitializeConditions()
194145
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
195146
s.PropagateReceiveAdapterStatus(&appsv1.Deployment{})
196-
s.MarkOIDCIdentityCreatedSucceeded()
197147
return s
198148
}(),
199149
wantConditionStatus: corev1.ConditionUnknown,
@@ -206,7 +156,6 @@ func TestContainerSourceStatusIsReady(t *testing.T) {
206156
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
207157
s.PropagateReceiveAdapterStatus(availableDeployment)
208158
s.PropagateSinkBindingStatus(&notReadySinkBinding.Status)
209-
s.MarkOIDCIdentityCreatedSucceeded()
210159
return s
211160
}(),
212161
wantConditionStatus: corev1.ConditionFalse,
@@ -219,7 +168,6 @@ func TestContainerSourceStatusIsReady(t *testing.T) {
219168
s.PropagateReceiveAdapterStatus(availableDeployment)
220169
s.PropagateSinkBindingStatus(&notReadySinkBinding.Status)
221170
s.PropagateReceiveAdapterStatus(unavailableDeployment)
222-
s.MarkOIDCIdentityCreatedSucceeded()
223171
return s
224172
}(),
225173
wantConditionStatus: corev1.ConditionFalse,
@@ -231,7 +179,6 @@ func TestContainerSourceStatusIsReady(t *testing.T) {
231179
s.InitializeConditions()
232180
s.PropagateSinkBindingStatus(&notReadySinkBinding.Status)
233181
s.PropagateReceiveAdapterStatus(availableDeployment)
234-
s.MarkOIDCIdentityCreatedSucceeded()
235182
return s
236183
}(),
237184
wantConditionStatus: corev1.ConditionFalse,
@@ -244,7 +191,6 @@ func TestContainerSourceStatusIsReady(t *testing.T) {
244191
s.PropagateSinkBindingStatus(&notReadySinkBinding.Status)
245192
s.PropagateReceiveAdapterStatus(availableDeployment)
246193
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
247-
s.MarkOIDCIdentityCreatedSucceeded()
248194
return s
249195
}(),
250196
wantConditionStatus: corev1.ConditionTrue,
@@ -258,7 +204,6 @@ func TestContainerSourceStatusIsReady(t *testing.T) {
258204
if gotConditionStatus != test.wantConditionStatus {
259205
t.Errorf("unexpected condition status: want %v, got %v", test.wantConditionStatus, gotConditionStatus)
260206
}
261-
262207
}
263208
got := test.s.IsReady()
264209
if got != test.want {
@@ -317,27 +262,13 @@ func TestContainerSourceStatusGetCondition(t *testing.T) {
317262
Type: ContainerSourceConditionReady,
318263
Status: corev1.ConditionUnknown,
319264
},
320-
}, {
321-
name: "mark ready sa",
322-
s: func() *ContainerSourceStatus {
323-
s := &ContainerSourceStatus{}
324-
s.InitializeConditions()
325-
s.MarkOIDCIdentityCreatedSucceeded()
326-
return s
327-
}(),
328-
condQuery: ContainerSourceConditionReady,
329-
want: &apis.Condition{
330-
Type: ContainerSourceConditionReady,
331-
Status: corev1.ConditionUnknown,
332-
},
333265
}, {
334266
name: "mark ready sb and ra",
335267
s: func() *ContainerSourceStatus {
336268
s := &ContainerSourceStatus{}
337269
s.InitializeConditions()
338270
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
339271
s.PropagateReceiveAdapterStatus(availableDeployment)
340-
s.MarkOIDCIdentityCreatedSucceeded()
341272
return s
342273
}(),
343274
condQuery: ContainerSourceConditionReady,
@@ -353,7 +284,6 @@ func TestContainerSourceStatusGetCondition(t *testing.T) {
353284
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
354285
s.PropagateReceiveAdapterStatus(availableDeployment)
355286
s.PropagateSinkBindingStatus(&notReadySinkBinding.Status)
356-
s.MarkOIDCIdentityCreatedSucceeded()
357287
return s
358288
}(),
359289
condQuery: ContainerSourceConditionReady,
@@ -363,22 +293,6 @@ func TestContainerSourceStatusGetCondition(t *testing.T) {
363293
Reason: "Testing",
364294
Message: "hi",
365295
},
366-
}, {
367-
name: "mark ready sb, ra and sa unknown",
368-
s: func() *ContainerSourceStatus {
369-
s := &ContainerSourceStatus{}
370-
s.InitializeConditions()
371-
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
372-
s.PropagateReceiveAdapterStatus(availableDeployment)
373-
s.MarkOIDCIdentityCreatedUnknown("Unknown", "")
374-
return s
375-
}(),
376-
condQuery: ContainerSourceConditionReady,
377-
want: &apis.Condition{
378-
Type: ContainerSourceConditionReady,
379-
Status: corev1.ConditionUnknown,
380-
Reason: "Unknown",
381-
},
382296
}, {
383297
name: "mark ready sb and ra then no ra",
384298
s: func() *ContainerSourceStatus {
@@ -387,45 +301,13 @@ func TestContainerSourceStatusGetCondition(t *testing.T) {
387301
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
388302
s.PropagateReceiveAdapterStatus(availableDeployment)
389303
s.PropagateReceiveAdapterStatus(unavailableDeployment)
390-
s.MarkOIDCIdentityCreatedSucceeded()
391-
return s
392-
}(),
393-
condQuery: ContainerSourceConditionReady,
394-
want: &apis.Condition{
395-
Type: ContainerSourceConditionReady,
396-
Status: corev1.ConditionFalse,
397-
},
398-
}, {
399-
name: "mark ready sb, sa and ra then no sa",
400-
s: func() *ContainerSourceStatus {
401-
s := &ContainerSourceStatus{}
402-
s.InitializeConditions()
403-
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
404-
s.PropagateReceiveAdapterStatus(availableDeployment)
405-
s.MarkOIDCIdentityCreatedSucceeded()
406-
s.MarkOIDCIdentityCreatedFailed("", "")
407304
return s
408305
}(),
409306
condQuery: ContainerSourceConditionReady,
410307
want: &apis.Condition{
411308
Type: ContainerSourceConditionReady,
412309
Status: corev1.ConditionFalse,
413310
},
414-
}, {
415-
name: "mark ready sb, ra and sa with reason",
416-
s: func() *ContainerSourceStatus {
417-
s := &ContainerSourceStatus{}
418-
s.InitializeConditions()
419-
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
420-
s.PropagateReceiveAdapterStatus(availableDeployment)
421-
s.MarkOIDCIdentityCreatedSucceededWithReason("Created", "")
422-
return s
423-
}(),
424-
condQuery: ContainerSourceConditionReady,
425-
want: &apis.Condition{
426-
Type: ContainerSourceConditionReady,
427-
Status: corev1.ConditionTrue,
428-
},
429311
}, {
430312
name: "mark not ready sb and ready ra then ready sb",
431313
s: func() *ContainerSourceStatus {
@@ -434,7 +316,6 @@ func TestContainerSourceStatusGetCondition(t *testing.T) {
434316
s.PropagateSinkBindingStatus(&notReadySinkBinding.Status)
435317
s.PropagateReceiveAdapterStatus(availableDeployment)
436318
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
437-
s.MarkOIDCIdentityCreatedSucceeded()
438319
return s
439320
}(),
440321
condQuery: ContainerSourceConditionReady,

‎pkg/reconciler/containersource/containersource.go‎

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -29,14 +29,11 @@ import (
2929
"k8s.io/client-go/kubernetes"
3030
appsv1listers "k8s.io/client-go/listers/apps/v1"
3131
corev1listers "k8s.io/client-go/listers/core/v1"
32-
duckv1 "knative.dev/pkg/apis/duck/v1"
3332
"knative.dev/pkg/controller"
3433
"knative.dev/pkg/logging"
3534
pkgreconciler "knative.dev/pkg/reconciler"
3635

37-
"knative.dev/eventing/pkg/apis/feature"
3836
v1 "knative.dev/eventing/pkg/apis/sources/v1"
39-
"knative.dev/eventing/pkg/auth"
4037
clientset "knative.dev/eventing/pkg/client/clientset/versioned"
4138
"knative.dev/eventing/pkg/client/injection/reconciler/sources/v1/containersource"
4239
listers "knative.dev/eventing/pkg/client/listers/sources/v1"
@@ -68,7 +65,6 @@ type Reconciler struct {
6865
containerSourceLister listers.ContainerSourceLister
6966
sinkBindingLister listers.SinkBindingLister
7067
deploymentLister appsv1listers.DeploymentLister
71-
serviceAccountLister corev1listers.ServiceAccountLister
7268
trustBundleConfigMapLister corev1listers.ConfigMapLister
7369
}
7470

@@ -83,23 +79,6 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, source *v1.ContainerSour
8379
return err
8480
}
8581

86-
featureFlags := feature.FromContext(ctx)
87-
if featureFlags.IsOIDCAuthentication() {
88-
saName := auth.GetOIDCServiceAccountNameForResource(v1.SchemeGroupVersion.WithKind("ContainerSource"), source.ObjectMeta)
89-
source.Status.Auth = &duckv1.AuthStatus{
90-
ServiceAccountName: &saName,
91-
}
92-
93-
if err := auth.EnsureOIDCServiceAccountExistsForResource(ctx, r.serviceAccountLister, r.kubeClientSet, v1.SchemeGroupVersion.WithKind("ContainerSource"), source.ObjectMeta); err != nil {
94-
source.Status.MarkOIDCIdentityCreatedFailed("Unable to resolve service account for OIDC authentication", "%v", err)
95-
return err
96-
}
97-
source.Status.MarkOIDCIdentityCreatedSucceeded()
98-
} else {
99-
source.Status.Auth = nil
100-
source.Status.MarkOIDCIdentityCreatedSucceededWithReason(fmt.Sprintf("%s feature disabled", feature.OIDCAuthentication), "")
101-
}
102-
10382
_, err = r.reconcileReceiveAdapter(ctx, source)
10483
if err != nil {
10584
logging.FromContext(ctx).Errorw("Error reconciling ReceiveAdapter", zap.Error(err))

0 commit comments

Comments
 (0)