Authenticate requests from mt-broker-ingress to underlying channel#7473
Conversation
knative-prow
Bot
added
size/L
Codecov ReportAttention:
Additional details and impacted files@@ Coverage Diff @@
## main #7473 +/- ##
==========================================
- Coverage 76.81% 76.71% -0.10%
==========================================
Files 253 253
Lines 14136 14212 +76
==========================================
+ Hits 10858 10903 +45
- Misses 2736 2759 +23
- Partials 542 550 +8 ☔ View full report in Codecov by Sentry. |
Cali0707
left a comment
Cali0707
left a comment
There was a problem hiding this comment.
One nit, otherwise looks good! (sorry I missed the nit earlier)
…oidc.yaml Co-authored-by: Calum Murray <cmurray@redhat.com>
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Cali0707, creydr The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
| dispatchInfo, err := h.eventDispatcher.SendEvent(ctx, *event, *channelAddress, kncloudevents.WithHeader(headers)) | ||
| opts := []kncloudevents.SendOption{ | ||
| kncloudevents.WithHeader(headers), | ||
| kncloudevents.WithOIDCAuthentication(&types.NamespacedName{ |
There was a problem hiding this comment.
JWT token will be added when cloudEvent dispatcher is going to send the event, which is what I am implementing here https://github.com/knative/eventing/pull/7452/files right, just to confirm @creydr
There was a problem hiding this comment.
Not sure if I understood you correctly, but this PR here is for broker-ingress. In the ApiServerSource, we need something similar. The difference is, that the ApiServerSource does not use the kncloudevents.Dispatcher, which does all this for you. The ApiServerSource uses the CloudEvents SDK client, which requires you to add the JWT "manually" as part of the Authorization header (what you're doing here).
3 participants
Fixes #7472
Proposed Changes
mt-broker-ingress-oidcservice account and audience of channel)