Skip to content

Commit 3c03a23

Browse files
Cali0707pierDipi
Cali0707
and
pierDipi
authored
[release-1.13]: Watch only our own OIDC-related secrets (#8070) (#8072)
* Watch only our own OIDC-related secrets (#8070) Filter OIDC secrets Signed-off-by: Pierangelo Di Pilato <[email protected]> * ./hack/update-deps.sh Signed-off-by: Calum Murray <[email protected]> * fix: serviceaccountInformer -> oidcServiceaccountInformer Signed-off-by: Calum Murray <[email protected]> * fix: add oidc label selector to main contexts (partial cherry pick of #7527) Signed-off-by: Calum Murray <[email protected]> * fix: don't use filtered sa informer when sa is not labelled Signed-off-by: Calum Murray <[email protected]> --------- Signed-off-by: Pierangelo Di Pilato <[email protected]> Signed-off-by: Calum Murray <[email protected]> Co-authored-by: Pierangelo Di Pilato <[email protected]>
1 parent cc4e0be commit 3c03a23

File tree

12 files changed

+79
-26
lines changed

12 files changed

+79
-26
lines changed

‎cmd/apiserver_receive_adapter/main.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222

2323
"knative.dev/eventing/pkg/adapter/apiserver"
2424
"knative.dev/eventing/pkg/adapter/v2"
25+
"knative.dev/eventing/pkg/auth"
2526
"knative.dev/eventing/pkg/eventingtls"
2627
)
2728

@@ -34,6 +35,7 @@ func main() {
3435
ctx = adapter.WithInjectorEnabled(ctx)
3536

3637
ctx = filteredFactory.WithSelectors(ctx,
38+
auth.OIDCLabelSelector,
3739
eventingtls.TrustBundleLabelSelector,
3840
)
3941

‎cmd/broker/filter/main.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,7 @@ func main() {
8181
log.Printf("Registering %d informers", len(injection.Default.GetInformers()))
8282

8383
ctx = filteredFactory.WithSelectors(ctx,
84+
auth.OIDCLabelSelector,
8485
eventingtls.TrustBundleLabelSelector,
8586
)
8687

‎cmd/broker/ingress/main.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,7 @@ func main() {
103103
log.Printf("Registering %d informers", len(injection.Default.GetInformers()))
104104

105105
ctx = filteredFactory.WithSelectors(ctx,
106+
auth.OIDCLabelSelector,
106107
eventingtls.TrustBundleLabelSelector,
107108
)
108109

‎cmd/in_memory/channel_dispatcher/main.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ import (
2727
"knative.dev/pkg/injection/sharedmain"
2828
"knative.dev/pkg/signals"
2929

30+
"knative.dev/eventing/pkg/auth"
3031
"knative.dev/eventing/pkg/eventingtls"
3132
inmemorychannel "knative.dev/eventing/pkg/reconciler/inmemorychannel/dispatcher"
3233
)
@@ -39,6 +40,7 @@ func main() {
3940
}
4041

4142
ctx = filteredFactory.WithSelectors(ctx,
43+
auth.OIDCLabelSelector,
4244
eventingtls.TrustBundleLabelSelector,
4345
)
4446

‎cmd/mtchannel_broker/main.go‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,11 @@ import (
2222

2323
"context"
2424

25+
filteredfactory "knative.dev/pkg/client/injection/kube/informers/factory/filtered"
2526
"knative.dev/pkg/injection/sharedmain"
27+
"knative.dev/pkg/signals"
2628

29+
"knative.dev/eventing/pkg/auth"
2730
"knative.dev/eventing/pkg/reconciler/broker"
2831
mttrigger "knative.dev/eventing/pkg/reconciler/broker/trigger"
2932
)
@@ -33,7 +36,11 @@ const (
3336
)
3437

3538
func main() {
36-
sharedmain.Main(
39+
ctx := signals.NewContext()
40+
41+
ctx = filteredfactory.WithSelectors(ctx, auth.OIDCLabelSelector)
42+
43+
sharedmain.MainWithContext(ctx,
3744
component,
3845

3946
broker.NewController,

‎cmd/mtping/main.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222

2323
"knative.dev/eventing/pkg/adapter/mtping"
2424
"knative.dev/eventing/pkg/adapter/v2"
25+
"knative.dev/eventing/pkg/auth"
2526
"knative.dev/eventing/pkg/eventingtls"
2627
)
2728

@@ -57,6 +58,7 @@ func main() {
5758
})
5859

5960
ctx = filteredFactory.WithSelectors(ctx,
61+
auth.OIDCLabelSelector,
6062
eventingtls.TrustBundleLabelSelector,
6163
)
6264

‎cmd/webhook/main.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ import (
2626
configmapinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/configmap/filtered"
2727

2828
"knative.dev/eventing/pkg/apis/feature"
29+
"knative.dev/eventing/pkg/auth"
2930
"knative.dev/eventing/pkg/eventingtls"
3031

3132
filteredFactory "knative.dev/pkg/client/injection/kube/informers/factory/filtered"
@@ -287,6 +288,7 @@ func main() {
287288
})
288289

289290
ctx = filteredFactory.WithSelectors(ctx,
291+
auth.OIDCLabelSelector,
290292
eventingtls.TrustBundleLabelSelector,
291293
)
292294

‎pkg/auth/serviceaccount.go‎

Lines changed: 27 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,13 @@ import (
2121
"fmt"
2222
"strings"
2323

24-
"knative.dev/eventing/pkg/apis/feature"
24+
"k8s.io/apimachinery/pkg/api/equality"
2525
duckv1 "knative.dev/pkg/apis/duck/v1"
2626
"knative.dev/pkg/kmeta"
2727
pkgreconciler "knative.dev/pkg/reconciler"
2828

29+
"knative.dev/eventing/pkg/apis/feature"
30+
2931
"go.uber.org/zap"
3032
v1 "k8s.io/api/core/v1"
3133
apierrs "k8s.io/apimachinery/pkg/api/errors"
@@ -37,6 +39,14 @@ import (
3739
"knative.dev/pkg/ptr"
3840
)
3941

42+
const (
43+
// OIDCLabelKey is used to filter out all the informers that related to OIDC work
44+
OIDCLabelKey = "eventing.knative.dev/oidc"
45+
46+
// OIDCLabelSelector is the label selector for the OIDC resources
47+
OIDCLabelSelector = OIDCLabelKey
48+
)
49+
4050
// GetOIDCServiceAccountNameForResource returns the service account name to use
4151
// for OIDC authentication for the given resource.
4252
func GetOIDCServiceAccountNameForResource(gvk schema.GroupVersionKind, objectMeta metav1.ObjectMeta) string {
@@ -76,28 +86,38 @@ func EnsureOIDCServiceAccountExistsForResource(ctx context.Context, serviceAccou
7686
saName := GetOIDCServiceAccountNameForResource(gvk, objectMeta)
7787
sa, err := serviceAccountLister.ServiceAccounts(objectMeta.Namespace).Get(saName)
7888

89+
expected := GetOIDCServiceAccountForResource(gvk, objectMeta)
90+
7991
// If the resource doesn't exist, we'll create it.
8092
if apierrs.IsNotFound(err) {
8193
logging.FromContext(ctx).Debugw("Creating OIDC service account", zap.Error(err))
8294

83-
expected := GetOIDCServiceAccountForResource(gvk, objectMeta)
84-
8595
_, err = kubeclient.CoreV1().ServiceAccounts(objectMeta.Namespace).Create(ctx, expected, metav1.CreateOptions{})
8696
if err != nil {
87-
return fmt.Errorf("could not create OIDC service account %s/%s for %s: %w", objectMeta.Name, objectMeta.Namespace, gvk.Kind, err)
97+
return fmt.Errorf("could not create OIDC service account %s/%s for %s: %w", objectMeta.Namespace, objectMeta.Name, gvk.Kind, err)
8898
}
8999

90100
return nil
91101
}
92-
93102
if err != nil {
94-
return fmt.Errorf("could not get OIDC service account %s/%s for %s: %w", objectMeta.Name, objectMeta.Namespace, gvk.Kind, err)
103+
return fmt.Errorf("could not get OIDC service account %s/%s for %s: %w", objectMeta.Namespace, objectMeta.Name, gvk.Kind, err)
95104
}
96-
97105
if !metav1.IsControlledBy(&sa.ObjectMeta, &objectMeta) {
98106
return fmt.Errorf("service account %s not owned by %s %s", sa.Name, gvk.Kind, objectMeta.Name)
99107
}
100108

109+
if !equality.Semantic.DeepDerivative(expected, sa) {
110+
expected.ResourceVersion = sa.ResourceVersion
111+
112+
_, err = kubeclient.CoreV1().ServiceAccounts(objectMeta.Namespace).Update(ctx, expected, metav1.UpdateOptions{})
113+
if err != nil {
114+
return fmt.Errorf("could not update OIDC service account %s/%s for %s: %w", objectMeta.Namespace, objectMeta.Name, gvk.Kind, err)
115+
}
116+
117+
return nil
118+
119+
}
120+
101121
return nil
102122
}
103123

‎pkg/reconciler/sinkbinding/controller.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ import (
4343
"knative.dev/pkg/apis/duck"
4444
kubeclient "knative.dev/pkg/client/injection/kube/client"
4545
configmapinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/configmap/filtered"
46-
secretinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/secret"
46+
secretinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/secret/filtered"
4747
serviceaccountinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/serviceaccount"
4848
"knative.dev/pkg/configmap"
4949
"knative.dev/pkg/controller"
@@ -80,8 +80,8 @@ func NewController(
8080
dc := dynamicclient.Get(ctx)
8181
psInformerFactory := podspecable.Get(ctx)
8282
namespaceInformer := namespace.Get(ctx)
83-
serviceaccountInformer := serviceaccountinformer.Get(ctx)
84-
secretInformer := secretinformer.Get(ctx)
83+
oidcServiceaccountInformer := serviceaccountinformer.Get(ctx)
84+
secretInformer := secretinformer.Get(ctx, auth.OIDCLabelSelector)
8585
trustBundleConfigMapInformer := configmapinformer.Get(ctx, eventingtls.TrustBundleLabelSelector)
8686
trustBundleConfigMapLister := configmapinformer.Get(ctx, eventingtls.TrustBundleLabelSelector).Lister()
8787

@@ -136,7 +136,7 @@ func NewController(
136136
res: sbResolver,
137137
tracker: impl.Tracker,
138138
kubeclient: kubeclient.Get(ctx),
139-
serviceAccountLister: serviceaccountInformer.Lister(),
139+
serviceAccountLister: oidcServiceaccountInformer.Lister(),
140140
secretLister: secretInformer.Lister(),
141141
featureStore: featureStore,
142142
tokenProvider: auth.NewOIDCTokenProvider(ctx),
@@ -155,7 +155,7 @@ func NewController(
155155
}
156156

157157
// Reconcile SinkBinding when the OIDC service account changes
158-
serviceaccountInformer.Informer().AddEventHandler(cache.FilteringResourceEventHandler{
158+
oidcServiceaccountInformer.Informer().AddEventHandler(cache.FilteringResourceEventHandler{
159159
FilterFunc: controller.FilterController(&v1.SinkBinding{}),
160160
Handler: controller.HandleAll(impl.EnqueueControllerOf),
161161
})

‎pkg/reconciler/sinkbinding/sinkbinding.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -193,6 +193,9 @@ func (s *SinkBindingSubResourcesReconciler) renewOIDCTokenSecret(ctx context.Con
193193

194194
apiVersion := fmt.Sprintf("%s/%s", v1.SchemeGroupVersion.Group, v1.SchemeGroupVersion.Version)
195195
applyConfig := new(applyconfigurationcorev1.SecretApplyConfiguration).
196+
WithLabels(map[string]string{
197+
auth.OIDCLabelKey: "enabled",
198+
}).
196199
WithName(secretName).
197200
WithNamespace(sb.Namespace).
198201
WithType(corev1.SecretTypeOpaque).

0 commit comments

Comments
 (0)