Add helpers to work with service accounts for OIDC (#7278)

* Add helpers to work with service accounts for OIDC * Rename functions to be clearer
knative · Sep 26, 2023 · f10a44d · f10a44d
1 parent b898cf4
commit f10a44d
Show file tree

Hide file tree

Showing 2 changed files with 161 additions and 0 deletions.
diff --git a/pkg/auth/serviceaccount.go b/pkg/auth/serviceaccount.go
@@ -0,0 +1,59 @@
+/*
+Copyright 2023 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+import (
+	"fmt"
+	"strings"
+
+	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"knative.dev/pkg/ptr"
+)
+
+// GetOIDCServiceAccountNameForResource returns the service account name to use
+// for OIDC authentication for the given resource.
+func GetOIDCServiceAccountNameForResource(gvk schema.GroupVersionKind, objectMeta metav1.ObjectMeta) string {
+	sa := fmt.Sprintf("oidc-%s-%s-%s", gvk.GroupKind().Group, gvk.GroupKind().Kind, objectMeta.GetName())
+
+	return strings.ToLower(sa)
+}
+
+// GetOIDCServiceAccountForResource returns the service account to use for OIDC
+// authentication for the given resource.
+func GetOIDCServiceAccountForResource(gvk schema.GroupVersionKind, objectMeta metav1.ObjectMeta) *v1.ServiceAccount {
+	return &v1.ServiceAccount{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      GetOIDCServiceAccountNameForResource(gvk, objectMeta),
+			Namespace: objectMeta.GetNamespace(),
+			OwnerReferences: []metav1.OwnerReference{
+				{
+					APIVersion:         gvk.GroupKind().Group + "/" + gvk.GroupVersion().Version,
+					Kind:               gvk.GroupKind().Kind,
+					Name:               objectMeta.GetName(),
+					UID:                objectMeta.GetUID(),
+					Controller:         ptr.Bool(false),
+					BlockOwnerDeletion: ptr.Bool(false),
+				},
+			},
+			Annotations: map[string]string{
+				"description": fmt.Sprintf("Service Account for OIDC Authentication for %s %q", gvk.GroupKind().Kind, objectMeta.Name),
+			},
+		},
+	}
+}
diff --git a/pkg/auth/serviceaccount_test.go b/pkg/auth/serviceaccount_test.go
@@ -0,0 +1,102 @@
+/*
+Copyright 2023 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	eventingv1 "knative.dev/eventing/pkg/apis/eventing/v1"
+	"knative.dev/pkg/ptr"
+)
+
+func TestGetOIDCServiceAccountNameForResource(t *testing.T) {
+	tests := []struct {
+		name       string
+		gvk        schema.GroupVersionKind
+		objectMeta metav1.ObjectMeta
+		want       string
+	}{
+		{
+			name: "should return SA name in correct format",
+			gvk: schema.GroupVersionKind{
+				Group:   "group",
+				Version: "version",
+				Kind:    "kind",
+			},
+			objectMeta: metav1.ObjectMeta{
+				Name:      "name",
+				Namespace: "namespace",
+			},
+			want: "oidc-group-kind-name",
+		},
+		{
+			name: "should return SA name in lower case",
+			gvk:  eventingv1.SchemeGroupVersion.WithKind("Broker"),
+			objectMeta: metav1.ObjectMeta{
+				Name:      "my-Broker",
+				Namespace: "my-Namespace",
+			},
+			want: "oidc-eventing.knative.dev-broker-my-broker",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := GetOIDCServiceAccountNameForResource(tt.gvk, tt.objectMeta); got != tt.want {
+				t.Errorf("GetServiceAccountName() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestGetOIDCServiceAccountForResource(t *testing.T) {
+	gvk := eventingv1.SchemeGroupVersion.WithKind("Broker")
+	objectMeta := metav1.ObjectMeta{
+		Name:      "my-broker",
+		Namespace: "my-namespace",
+		UID:       "my-uuid",
+	}
+
+	want := v1.ServiceAccount{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      GetOIDCServiceAccountNameForResource(gvk, objectMeta),
+			Namespace: "my-namespace",
+			OwnerReferences: []metav1.OwnerReference{
+				{
+					APIVersion:         "eventing.knative.dev/v1",
+					Kind:               "Broker",
+					Name:               "my-broker",
+					UID:                "my-uuid",
+					Controller:         ptr.Bool(false),
+					BlockOwnerDeletion: ptr.Bool(false),
+				},
+			},
+			Annotations: map[string]string{
+				"description": "Service Account for OIDC Authentication for Broker \"my-broker\"",
+			},
+		},
+	}
+
+	got := GetOIDCServiceAccountForResource(gvk, objectMeta)
+
+	if diff := cmp.Diff(*got, want); diff != "" {
+		t.Errorf("GetServiceAccount() = %+v, want %+v - diff %s", got, want, diff)
+	}
+}