feat(nvct): accept delegated projected ServiceAccount tokens for task worker auth - #849
Draft
estroz wants to merge 1 commit into
Draft
feat(nvct): accept delegated projected ServiceAccount tokens for task worker auth#849estroz wants to merge 1 commit into
estroz wants to merge 1 commit into
Conversation
… worker auth Adds a fallback token validation path for self-hosted NVCT clusters where workers present a projected Kubernetes ServiceAccount Token (PSAT) instead of the Notary-issued assertion JWT. When Notary JWT decoding fails and nvct.worker.delegated-token-enabled=true, WorkerAssertionValidator calls ICMS POST /v1/workers/tokens/introspect (RFC 7662) to verify the PSAT via cluster OIDC. Active results are cached in-process for up to 14 minutes. Changes: - IcmsStubService: add WorkerTokenIntrospectRequest/Result DTOs and introspectWorkerToken exchange method - IcmsClient: delegate introspectWorkerToken to the stub - WorkerTokenIntrospectionService (new): Caffeine cache + introspection wrapper gated on nvct.worker.delegated-token-enabled - WorkerAssertionValidator: inject WorkerTokenIntrospectionService and catch ForbiddenException from Notary JWT validation, falling through to ICMS introspection when enabled - application.yaml: add nvct.worker.delegated-token-enabled: false (overridden to true in self-hosted Helmfile overlay) Relates to #840 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthroughThe change adds ICMS worker-token introspection models and client support. It adds cached introspection service logic. Worker assertion validation can accept active delegated tokens when enabled. Delegated-token support is disabled by default. ChangesDelegated worker-token introspection
Estimated code review effort: 3 (Moderate) | ~25 minutes Mergeability Score: ⚪ Minimal · up to This change adds an opt-in delegated-token authentication path while preserving the existing behavior by default; no actionable merge-blocking risk remains. Sequence Diagram(s)sequenceDiagram
participant WorkerAssertionValidator
participant WorkerTokenIntrospectionService
participant IcmsClient
participant IcmsStubService
WorkerAssertionValidator->>WorkerAssertionValidator: Fail Notary JWT validation
WorkerAssertionValidator->>WorkerTokenIntrospectionService: introspect(rawToken)
WorkerTokenIntrospectionService->>IcmsClient: introspectWorkerToken(request)
IcmsClient->>IcmsStubService: POST /v1/workers/tokens/introspect
IcmsStubService-->>IcmsClient: WorkerTokenIntrospectResult
IcmsClient-->>WorkerTokenIntrospectionService: Introspection result
WorkerTokenIntrospectionService-->>WorkerAssertionValidator: Active or inactive result
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
🛡️ CodeQL Analysis🚨 Found 11 issue(s) Severity Breakdown:
📋 Top Issues🔗 View full details in Security tab 🕐 Last updated: 2026-08-14 00:44:01 UTC | Commit: b938ecf |
estroz
marked this pull request as draft
August 14, 2026 17:40
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Part of the delegated worker token feature (issue #840). On self-hosted NVCT clusters, task workers receive a projected Kubernetes ServiceAccount Token (PSAT) mounted into their pods. The existing path decodes a Notary-issued assertion JWT, which the PSAT is not. This PR adds a fallback so
WorkerAssertionValidatorcalls ICMS token introspection when Notary decode fails, enabling task workers to authenticate via cluster OIDC.What changed
IcmsStubService: AddedWorkerTokenIntrospectRequest/WorkerTokenIntrospectResultDTOs and theintrospectWorkerTokenHTTP exchange method targetingPOST /v1/workers/tokens/introspect.IcmsClient: Delegating wrapper forintrospectWorkerToken.WorkerTokenIntrospectionService(new): Caffeine-backed cache keyed on SHA-256(token), evicted after 14 minutes. Inactive results are never cached. Gated onnvct.worker.delegated-token-enabled.WorkerAssertionValidator.validate: WrapsvalidateNotaryJwtin try/catch. WhenForbiddenExceptionis thrown and the flag is on, falls through to ICMS introspection.active=true→ authorized.active=false→ re-throw forbidden.application.yaml: Addednvct.worker.delegated-token-enabled: false(default). Self-hosted Helmfile overlay sets it totrue.Customer Release Notes
Not customer visible — self-hosted infrastructure change.
Plan Summary
Not applicable.
Usage
Enable on self-hosted clusters by setting
nvct.worker.delegated-token-enabled: truein the Helmfile values overlay. No changes needed for managed NVCT.Testing
WorkerTokenIntrospectionServiceTest: cache-hit, cache-miss, no-cache-on-inactive, distinct-tokens, token-forwarded-to-ICMS.Notes
NVCT task workers use
WorkerAssertionValidator.validatedirectly (no gRPC issued-token flow). The Notary JWT path remains unchanged when the flag is off.References
Relates to #840
Related Pull Requests
Dependencies
No new third-party dependencies. Caffeine is already used in
IcmsClient.Summary by CodeRabbit
New Features
Configuration
Tests