hsheinblatt opened a new pull request, #1476:
URL: https://github.com/apache/knox/pull/1476
KNOX-3534 - Add ingress source routing to the k8s destination audience
validator
## What changes were proposed in this pull request?
K8sDestinationAudienceValidator can now route a request that arrives from a
configured ingress gateway to a different audience check than validation
against the request destination. It is off by default. It is controlled by
four new request.audience.k8s.* parameters:
ingress.source.spiffe-id.routing.enabled (default false)
ingress.source.spiffe-ids (no default)
ingress.source.spiffe-ids.routing.skip.trust.domain.match (default false)
ingress.source.spiffe-ids.routing.skip.validation (default false)
A request is from an ingress source when the SPIFFE id in the configured
source header matches an entry of ingress.source.spiffe-ids. Namespace,
service account and trust domain are compared ignoring case; the trust domain
is left out of the comparison only when skip.trust.domain.match is true. A
missing or unparseable header is never an ingress source. With routing
enabled, such a request is routed by its token:
- a token with an act claim is rejected (400, with a logged message naming
the header and its value), regardless of skip.validation, before any
other
check;
- a token with no act claim is not destination-validated: it is checked
against the fixed knox.token.audiences list, or, with skip.validation
true,
not audience-checked at all. The destination, server-name and path
headers
are not required for it.
Every other request is handled as before. Startup fails if routing is enabled
without the source SPIFFE id header or without ingress.source.spiffe-ids, or
if any ingress id entry is not a full parseable SPIFFE id (checked even when
routing is disabled).
The change also has a test-only part: regression coverage that pins the
existing routing of tokens with no act claim and the order of early
rejections before the new behavior was added (first commit of the series).
The parameters were later renamed and the javadoc, class and test names
updated (follow-up commits).
knox-site/docs/config_request_audience_validator.md
documents the parameters, the outcome table, trust and security notes, and
corrects existing statements the feature made inaccurate.
## How was this patch tested?
- K8sIngressSourceRoutingTest (new, 44 tests): startup validation, every
row of the outcome table in the class javadoc, trust-domain skip, case
insensitivity, multiple ingress ids, missing/unparseable headers, fixed
list semantics (null list, NONE entry), skip.validation, and ordering
(rejection before actor-subject binding, skip before path header check).
- K8sNonDelegationTokenRoutingTest (new, 13 tests): behavior for tokens
with no act claim with routing off, including fallback to the fixed list
and the ordering of the destination and source header rejections.
- MatchesConfiguredAudiencesTest (+3 tests): fixed-list edge cases.
- Existing K8s validator tests pass unchanged.
- mvn -pl gateway-provider-security-jwt -am verify -Drat.skip=true
(checkstyle, PMD, SpotBugs, forbiddenapis and unit tests): 769 tests in
the module, 0 failures, BUILD SUCCESS.
## Integration Tests
None
## UI changes
N/A
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
