[
https://issues.apache.org/jira/browse/KNOX-3534?focusedWorklogId=1051105&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1051105
]
ASF GitHub Bot logged work on KNOX-3534:
----------------------------------------
Author: ASF GitHub Bot
Created on: 29/Oct/26 04:47
Start Date: 29/Oct/26 04:47
Worklog Time Spent: 10m
Work Description: hsheinblatt opened a new pull request, #1476:
URL: https://github.com/apache/knox/pull/1476
KNOX-3534 - Add ingress source routing to the k8s destination audience
validator
## What changes were proposed in this pull request?
K8sDestinationAudienceValidator can now route a request that arrives from a
configured ingress gateway to a different audience check than validation
against the request destination. It is off by default. It is controlled by
four new request.audience.k8s.* parameters:
ingress.source.spiffe-id.routing.enabled (default false)
ingress.source.spiffe-ids (no default)
ingress.source.spiffe-ids.routing.skip.trust.domain.match (default false)
ingress.source.spiffe-ids.routing.skip.validation (default false)
A request is from an ingress source when the SPIFFE id in the configured
source header matches an entry of ingress.source.spiffe-ids. Namespace,
service account and trust domain are compared ignoring case; the trust domain
is left out of the comparison only when skip.trust.domain.match is true. A
missing or unparseable header is never an ingress source. With routing
enabled, such a request is routed by its token:
- a token with an act claim is rejected (400, with a logged message naming
the header and its value), regardless of skip.validation, before any
other
check;
- a token with no act claim is not destination-validated: it is checked
against the fixed knox.token.audiences list, or, with skip.validation
true,
not audience-checked at all. The destination, server-name and path
headers
are not required for it.
Every other request is handled as before. Startup fails if routing is enabled
without the source SPIFFE id header or without ingress.source.spiffe-ids, or
if any ingress id entry is not a full parseable SPIFFE id (checked even when
routing is disabled).
The change also has a test-only part: regression coverage that pins the
existing routing of tokens with no act claim and the order of early
rejections before the new behavior was added (first commit of the series).
The parameters were later renamed and the javadoc, class and test names
updated (follow-up commits).
knox-site/docs/config_request_audience_validator.md
documents the parameters, the outcome table, trust and security notes, and
corrects existing statements the feature made inaccurate.
## How was this patch tested?
- K8sIngressSourceRoutingTest (new, 44 tests): startup validation, every
row of the outcome table in the class javadoc, trust-domain skip, case
insensitivity, multiple ingress ids, missing/unparseable headers, fixed
list semantics (null list, NONE entry), skip.validation, and ordering
(rejection before actor-subject binding, skip before path header check).
- K8sNonDelegationTokenRoutingTest (new, 13 tests): behavior for tokens
with no act claim with routing off, including fallback to the fixed list
and the ordering of the destination and source header rejections.
- MatchesConfiguredAudiencesTest (+3 tests): fixed-list edge cases.
- Existing K8s validator tests pass unchanged.
- mvn -pl gateway-provider-security-jwt -am verify -Drat.skip=true
(checkstyle, PMD, SpotBugs, forbiddenapis and unit tests): 769 tests in
the module, 0 failures, BUILD SUCCESS.
## Integration Tests
None
## UI changes
N/A
Issue Time Tracking
-------------------
Worklog Id: (was: 1051105)
Remaining Estimate: 0h
Time Spent: 10m
> Add k8s request audience validator bypass for JWTs from an ingress
> ------------------------------------------------------------------
>
> Key: KNOX-3534
> URL: https://issues.apache.org/jira/browse/KNOX-3534
> Project: Apache Knox
> Issue Type: Sub-task
> Components: JWT
> Reporter: Harrison Sheinblatt
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> The existing K8sDestinationAudienceValidator feature focus on service to
> service audience validation. Enable using the validator for the use case
> where a single topology is to validate all jwts, both service to service and
> ingress traffic JWTs.
> Add flags to enable a feature to match JWTs coming from an ingress gateway
> and treat them differently: either validate the audience against the same
> static whitelist used for the rest of the traffic, or skip audience
> validation. This path would be split and evaluated first. Delegation tokens
> are not allowed on that path, so even if they come from an ingress, still
> treat them as they are now.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
