[RFC-0010] Implement managed identity support for Azure Event Hub provider #1106
Conversation
matheuscscp
changed the title
dipti-pai
force-pushed
the
azeventhub-mi-support
branch
from
2bbc7be to
dc2fd41
Compare
dipti-pai
force-pushed
the
azeventhub-mi-support
branch
2 times, most recently
from
d30e98a to
54ceab7
Compare
There was a problem hiding this comment.
Almost there 👌
I'd like to ask you to please investigate something: Here we are introducing a new operation performed by notification-controller in the Kubernetes API, we are now calling the TokenRequest API to issue a Kubernetes ServiceAccount token for the cloud provider STS exchange. This requires the create verb for the (sub)resource serviceaccounts/token in a ClusterRoleBinding (i.e. for all namespaces). Please check what RBAC permissions notification-controller has in order to be able to perform this operation. I suspect the obvious, it has cluster-admin like kustomize-controller
| @@ -108,6 +108,11 @@ type ProviderSpec struct { | |||
| // +optional | |||
| SecretRef *meta.LocalObjectReference `json:"secretRef,omitempty"` | |||
|
|
|||
| // ServiceAccountName is the name of the service account used to | |||
| // authenticate with services from cloud providers. | |||
There was a problem hiding this comment.
Let's add the behavior we discussed here, I like to write good docs for the API struct fields because they show up in the command kubectl explain provider.spec.serviceAccountName 🙏
I meant to include a comment for this. In my install, I had to add a new rule to notification-controller's clusterrole for this permission. I used ARC extension for Flux to test this end-to-end and had to extend permissions there. To work with Flux bootstrap, do we need to extend the RBAC permissions somewhere, perhaps here ? Thanks. |
- If authentication token is not specified in provider, attempt to get the token using workload identity. = Add new field .spec.serviceAccountName to support multi-tenant workload identity as defined in RFC-0010 to use an identity with a service account other than the notification-controller. - Use proxy to get the token if specified in provider spec. - Cache the tokens if enabled in the notification controller options. - If address has SAS connection string, use that for authentication, this takes priority over token-authentication - If static JWT token is specified in the secret reference, use it for authentication, this takes priority over workload identity-acquired token. - Add unit tests for the 3 authentication mechanisms (SAS, JWT, managed identity). - Add documentation for using single-tenant and multi-tenant approaches of workload identity with azureeventhub provider. - Add operation post to github helpers and provider controller for cache event metrics Signed-off-by: Dipti Pai <[email protected]>
dipti-pai
force-pushed
the
azeventhub-mi-support
branch
from
54ceab7 to
6d514d6
Compare
Yes, that looks like the right place, but I don't see how it binds to the Edit: I believe diff --git a/internal/controller/provider_controller.go b/internal/controller/provider_controller.go
index 1f7d0f9..5bca247 100644
--- a/internal/controller/provider_controller.go
+++ b/internal/controller/provider_controller.go
@@ -35,6 +35,7 @@ import (
// +kubebuilder:rbac:groups=notification.toolkit.fluxcd.io,resources=providers,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch
// +kubebuilder:rbac:groups="",resources=events,verbs=create;patch
+// +kubebuilder:rbac:groups="",resources=serviceaccounts/token,verbs=create
// ProviderReconciler reconciles a Provider object to migrate it to static
// Provider.Edit 2: Actually I don't see the rules from Edit 3: Looking at the output of |
| @@ -88,6 +94,13 @@ type Factory struct { | |||
| // Option represents a functional option for configuring a notifier. | |||
| type Option func(*notifierOptions) | |||
|
|
|||
| // WithContext sets the context for the notifier. | |||
| func WithContext(ctx context.Context) Option { | |||
There was a problem hiding this comment.
Let's remove this function and pass the ctx in the NewFactory constructor
|
Hi Dipti 👋 We have finally released Please update this PR accordingly 🙏 Please also enable the token cache by default, see this comment from Stefan: |
Depends on: fluxcd/pkg#917
Part of: fluxcd/flux2#5022
Fixes: #1047
Changes include :
provider, attempt to get the token using workload identity..spec.serviceAccountNameto support multi-tenant workload identity as defined in RFC-0010 to use an identity with a service account other than the notification-controller.providerspec.azureeventhubprovider.Tested the feature with notification-controller service account (single tenant) and standalone service account with proxy and token cache. Also tested with existing auth mechanisms (JWT token in secret/SAS string).
Sharing test results below:
Notification controller logs sending the events to event hub
Cache metrics:
Proxy logs getting tokens once per hour since that's how long the token is valid: