Channel dispatcher authenticates the requests with OIDC

[Cali0707]

Fixes #7364

Proposed Changes

• Use audience from subscriber specs for requests
• Use service account from subscriber statuses for requests

Pre-review Checklist

• At least 80% unit test coverage
• E2E tests for any new behavior
• Docs PR for any user-facing impact
• Spec PR for any new API feature
• Conformance test for any change to the spec

Release Note

The channel dispatcher authenticates requests with OIDC

Docs

[knative-prow]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[Cali0707]

@creydr I think my changes work, but not sure how to set up a good rekt test for them. Any ideas?

[codecov]

Codecov Report

Attention: 31 lines in your changes are missing coverage. Please review.

Comparison is base (311ee01) 76.81% compared to head (2a83906) 76.71%.
Report is 1 commits behind head on main.

Files	Patch %	Lines
.../apis/messaging/v1/in_memory_channel_validation.go	60.52%	11 Missing and 4 partials ⚠️
...econciler/inmemorychannel/dispatcher/controller.go	50.00%	5 Missing and 2 partials ⚠️
...iler/inmemorychannel/dispatcher/inmemorychannel.go	40.00%	5 Missing and 1 partial ⚠️
pkg/channel/fanout/fanout_event_handler.go	82.35%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7445      +/-   ##
==========================================
- Coverage   76.81%   76.71%   -0.10%     
==========================================
  Files         253      253              
  Lines       14136    14200      +64     
==========================================
+ Hits        10858    10894      +36     
- Misses       2736     2757      +21     
- Partials      542      549       +7     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[creydr]

@creydr I think my changes work, but not sure how to set up a good rekt test for them. Any ideas?

Hey @Cali0707,
thanks for working on this. I would do the following for an e2e test:

1. Create an InMemoryChannel
2. Create an eventshub receiver with the OIDCReceiverAudience(aud) option, so that the receiver expects and verifies the JWT
3. Create a Subscription with the InMemoryChannel as channel and the eventshub receiver as subscriber
4. Create a eventshub sender and send events to the InMemoryChannel
5. Verify that the receiver got all requests from the sender

[Cali0707]

/test all

[creydr]

Left just some comments from going very quickly over it.
BTW: you can also run the e2e tests locally via something like the following:

SYSTEM_NAMESPACE=knative-eventing KO_DOCKER_REPO=localhost:5001 go test -race -count=1 -timeout=1h -parallel=12 -v -run TestChannelDispatcherAuthenticatesWithOID -tags=e2e ./test/auth

[creydr]

Looks good so far @Cali0707. Thanks for your work so far.
Only left a comment.
Can you only give a bit context on the conformance test changes?

[Cali0707]

@creydr the context on the conformance test changes is that we updated the webhook to reject changes to .Spec.Subscribers, so the conformance tests which were trying to validate that the channel CRD supports that field by directly patching it started to fail.

I tried to emulate those checks that the CRD supports the .Spec.Subscribers indirectly by creating a subscription and verifying that the CRD gets correctly populated in the .Spec.Subscribers and .Status.Subscribers

[Cali0707]

/test conformance-tests

[creydr]

@creydr the context on the conformance test changes is that we updated the webhook to reject changes to .Spec.Subscribers, so the conformance tests which were trying to validate that the channel CRD supports that field by directly patching it started to fail.

I tried to emulate those checks that the CRD supports the .Spec.Subscribers indirectly by creating a subscription and verifying that the CRD gets correctly populated in the .Spec.Subscribers and .Status.Subscribers

Thanks for clarifying this @Cali0707.
The PR looks good from my side 👍

As the conformance tests might affect other implementations too: @pierDipi are you OK with updates too, or do you see any issues?

[Cali0707]

/cc @pierDipi

[creydr]

/retest

[creydr]

Thanks a lot @Cali0707 for working on this!

/lgtm

[knative-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Cali0707, creydr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Cali0707,creydr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment