Repository navigation
fix: request the audience of projected service account tokens - #603
Open
NopeCharon wants to merge 1 commit into
Open
NopeCharon wants to merge 1 commit into
NopeCharon wants to merge 1 commit into
Conversation
✅ Deploy Preview for interlink-dev canceled.
|
remoteExecutionHandleProjectedSource built the TokenRequest for a serviceAccountToken projected source without its audience, so the offloaded container always got a token for the API server's default audiences. Pods that authenticate to an external service with their service account (Vault's Kubernetes auth, cloud workload identity, any OIDC relying party checking aud) had their token rejected on a virtual node. Like the kubelet, set Spec.Audiences to the source's audience when it is not empty. A source without an audience still gets a token for the API server's default audiences, as before. The new test captures the TokenRequest sent to the API server for a source with and without an audience, and checks the token returned for it is written at the source's path. Fixes interlink-hq#602 Signed-off-by: NopeCharon <115794254+NopeCharon@users.noreply.github.com>
NopeCharon
force-pushed
the
fix/projected-token-audience
branch
from
November 5, 2026 16:27
7c805a8 to
e9c941a
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A
serviceAccountTokenprojected volume source can ask for a token with a specificaudience. Pods use this to authenticate to services outside the Kubernetes API with their service account: Vault's Kubernetes auth, cloud workload identity, or any OIDC relying party that checksaud.remoteExecutionHandleProjectedSourcebuilt the TokenRequest without the audience, so the offloaded container always got a token for the API server's default audiences and the external service rejected it. This PR setsSpec.Audiencesto the source'saudiencewhen it is not empty, as the kubelet does. A source without an audience still gets a token for the default audiences, so the usual service account volume is unchanged.Tests:
TestRemoteExecutionHandleProjectedSourceServiceAccountTokencaptures the TokenRequest sent to the API server, for a source with and without an audience. It checks the requested audiences, that the token stays bound to the pod, and that the returned token is written at the source'spath.The test fails without the change.
go test -race ./pkg/...andgolangci-lint run(v2.14.0, as in CI) pass.Related issue : #602