Skip to content

feat: JWT auth for exotic stream #3795

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wwitzel3 wants to merge 2 commits into
base: master
Choose a base branch
from
Open

feat: JWT auth for exotic stream #3795

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9e5d0dd
feat: JWT auth for JetStreamExotic
wwitzel3 Nov 6, 2025
df1fc5b
Merge branch 'argoproj:master' into add-jwt-auth
wwitzel3 Nov 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions api/jsonschema/schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2408,6 +2408,10 @@
"$ref": "#/definitions/io.k8s.api.core.v1.SecretKeySelector",
"description": "Secret for auth"
},
"auth": {
"description": "Auth strategy, default to AuthStrategyNone",
"type": "string"
},
"streamConfig": {
"type": "string"
},
Expand Down
4 changes: 4 additions & 0 deletions api/openapi-spec/swagger.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

21 changes: 21 additions & 0 deletions docs/APIs.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1525,6 +1525,7 @@ AuthStrategy (<code>string</code> alias)
<p>

(<em>Appears on:</em>
<a href="#argoproj.io/v1alpha1.JetStreamConfig">JetStreamConfig</a>,
<a href="#argoproj.io/v1alpha1.NATSConfig">NATSConfig</a>,
<a href="#argoproj.io/v1alpha1.NativeStrategy">NativeStrategy</a>)
</p>
Expand Down Expand Up @@ -11605,6 +11606,26 @@ SSL/TLS settings for the NATS client

</tr>

<tr>

<td>

<code>auth</code></br> <em>
<a href="#argoproj.io/v1alpha1.AuthStrategy"> AuthStrategy </a> </em>
</td>

<td>

<em>(Optional)</em>
<p>

Auth strategy, default to AuthStrategyNone
</p>

</td>

</tr>

</tbody>

</table>
Expand Down
7 changes: 7 additions & 0 deletions pkg/apis/events/openapi/openapi_generated.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1,702 changes: 874 additions & 828 deletions pkg/apis/events/v1alpha1/generated.pb.go
View file
Open in desktop

Large diffs are not rendered by default.

4 changes: 4 additions & 0 deletions pkg/apis/events/v1alpha1/generated.proto
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions pkg/apis/events/v1alpha1/jetstream_eventbus.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,4 +105,7 @@ type JetStreamConfig struct {
// SSL/TLS settings for the NATS client
// +optional
TLS *TLSConfig `json:"tls,omitempty" protobuf:"bytes,4,opt,name=tls"`
// Auth strategy, default to AuthStrategyNone
// +optional
Auth *AuthStrategy `json:"auth,omitempty" protobuf:"bytes,5,opt,name=auth,casttype=AuthStrategy"`
Copy link
Member

@whynowy whynowy Nov 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we introduce a struct to abstract all the auth types, and deprecate the AccessSecret, something like below:

// NatsAuth defines how to authenticate the nats access
type NatsAuth struct {
	// Basic auth which contains a username and a password
	// +optional
	Basic *BasicAuth `json:"basic,omitempty" protobuf:"bytes,1,opt,name=basic"`
	// Token auth
	// +optional
	Token *corev1.SecretKeySelector `json:"token,omitempty" protobuf:"bytes,2,opt,name=token"`
	// NKey auth
	// +optional
	JWT *corev1.SecretKeySelector `json:"jwt,omitempty" protobuf:"bytes,3,opt,name=jwt"`
}

type JetStreamConfig struct {
	// JetStream (Nats) URL
	URL string `json:"url,omitempty" protobuf:"bytes,1,opt,name=url"`
	// Secret for auth
	// +optional
    // Deprecated: Use Auth instead
	AccessSecret *corev1.SecretKeySelector `json:"accessSecret,omitempty" protobuf:"bytes,2,opt,name=accessSecret"`
	// +optional
	StreamConfig string `json:"streamConfig,omitempty" protobuf:"bytes,3,opt,name=streamConfig"`
	// SSL/TLS settings for the NATS client
	// +optional
	TLS *TLSConfig `json:"tls,omitempty" protobuf:"bytes,4,opt,name=tls"`
    Auth *NatsAuth `json:"auth,omitempty" protobuf:"bytes,5,opt,name=auth"`
}

Copy link
Author

@wwitzel3 wwitzel3 Nov 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the review! I can look into that, it does have a downstream effective requiring a lot of changes since many of other packages currently have logic that checks for and works against the AuthStrategy.

}
1 change: 1 addition & 0 deletions pkg/apis/events/v1alpha1/nats_eventbus.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ var (
AuthStrategyNone AuthStrategy = "none"
AuthStrategyToken AuthStrategy = "token"
AuthStrategyBasic AuthStrategy = "basic"
AuthStrategyJWT AuthStrategy = "jwt"
)

// NativeStrategy indicates to install a native NATS service
Expand Down
5 changes: 5 additions & 0 deletions pkg/apis/events/v1alpha1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

7 changes: 4 additions & 3 deletions pkg/eventbus/common/structs.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,10 @@ type Auth struct {

// AuthCredential host the credential info
type AuthCredential struct {
Token string
Username string
Password string
Token string
Username string
Password string
CredentialFile string
}

type MsgHeader struct {
Expand Down
23 changes: 19 additions & 4 deletions pkg/eventbus/driver.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,9 +114,13 @@ func GetAuth(ctx context.Context, eventBusConfig v1alpha1.BusConfig) (*eventbusc
case eventBusConfig.NATS != nil:
eventBusAuth = eventBusConfig.NATS.Auth
case eventBusConfig.JetStream != nil:
if eventBusConfig.JetStream.AccessSecret != nil {
switch {
case eventBusConfig.JetStream.Auth != nil:
eventBusAuth = eventBusConfig.JetStream.Auth
case eventBusConfig.JetStream.AccessSecret != nil:
// For backward compatibility, default to Basic auth if AccessSecret is present but Auth is not specified
eventBusAuth = &v1alpha1.AuthStrategyBasic
} else {
default:
eventBusAuth = nil
}
case eventBusConfig.Kafka != nil:
Expand All @@ -126,11 +130,21 @@ func GetAuth(ctx context.Context, eventBusConfig v1alpha1.BusConfig) (*eventbusc
}
var auth *eventbuscommon.Auth
cred := &eventbuscommon.AuthCredential{}
if eventBusAuth == nil || *eventBusAuth == v1alpha1.AuthStrategyNone {

switch {
case eventBusAuth == nil || *eventBusAuth == v1alpha1.AuthStrategyNone:
auth = &eventbuscommon.Auth{
Strategy: v1alpha1.AuthStrategyNone,
}
} else {
case *eventBusAuth == v1alpha1.AuthStrategyJWT:
// For JWT auth, we don't parse auth.yaml - just set the credential file path
cred.CredentialFile = fmt.Sprintf("%s/credentials.creds", v1alpha1.EventBusAuthFileMountPath)
auth = &eventbuscommon.Auth{
Strategy: v1alpha1.AuthStrategyJWT,
Credential: cred,
}
default:
// For Basic and Token auth, parse auth.yaml
v := sharedutil.ViperWithLogging()
v.SetConfigName("auth")
v.SetConfigType("yaml")
Expand All @@ -144,6 +158,7 @@ func GetAuth(ctx context.Context, eventBusConfig v1alpha1.BusConfig) (*eventbusc
logger.Errorw("failed to unmarshal auth.yaml", zap.Error(err))
return nil, err
}

v.WatchConfig()
v.OnConfigChange(func(e fsnotify.Event) {
// Auth file changed, let it restart
Expand Down
3 changes: 3 additions & 0 deletions pkg/eventbus/jetstream/base/jetstream.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,9 @@ func (stream *Jetstream) MakeConnection() (*JetstreamConnection, error) {
case v1alpha1.AuthStrategyBasic:
log.Info("NATS auth strategy: Basic")
opts = append(opts, nats.UserInfo(stream.auth.Credential.Username, stream.auth.Credential.Password))
case v1alpha1.AuthStrategyJWT:
log.Info("NATS auth strategy: JWT")
opts = append(opts, nats.UserCredentials(stream.auth.Credential.CredentialFile))
case v1alpha1.AuthStrategyNone:
log.Info("NATS auth strategy: None")
default:
Expand Down
35 changes: 29 additions & 6 deletions pkg/reconciler/eventsource/resource.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -251,17 +251,40 @@ func buildDeployment(args *AdaptorArgs, eventBus *v1alpha1.EventBus) (*appv1.Dep
if accessSecret != nil {
// Mount the secret as volume instead of using envFrom to gain the ability
// for the sensor deployment to auto reload when the secret changes

// Determine auth strategy to decide how to mount the secret
var authStrategy *v1alpha1.AuthStrategy
if eventBus.Status.Config.JetStream != nil {
authStrategy = eventBus.Status.Config.JetStream.Auth
} else if eventBus.Status.Config.NATS != nil {
authStrategy = eventBus.Status.Config.NATS.Auth
}

var items []corev1.KeyToPath
if authStrategy != nil && *authStrategy == v1alpha1.AuthStrategyJWT {
// For JWT auth, mount only the credentials file
items = []corev1.KeyToPath{
{
Key: accessSecret.Key,
Path: "credentials.creds",
},
}
} else {
// For Basic/Token auth, mount as auth.yaml
items = []corev1.KeyToPath{
{
Key: accessSecret.Key,
Path: "auth.yaml",
},
}
}

volumes = append(volumes, corev1.Volume{
Name: "auth-volume",
VolumeSource: corev1.VolumeSource{
Secret: &corev1.SecretVolumeSource{
SecretName: accessSecret.Name,
Items: []corev1.KeyToPath{
{
Key: accessSecret.Key,
Path: "auth.yaml",
},
},
Items: items,
},
},
})
Expand Down
35 changes: 29 additions & 6 deletions pkg/reconciler/sensor/resource.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,17 +212,40 @@ func buildDeployment(args *AdaptorArgs, eventBus *v1alpha1.EventBus) (*appv1.Dep
if accessSecret != nil {
// Mount the secret as volume instead of using envFrom to gain the ability
// for the sensor deployment to auto reload when the secret changes

// Determine auth strategy to decide how to mount the secret
var authStrategy *v1alpha1.AuthStrategy
if eventBus.Status.Config.JetStream != nil {
authStrategy = eventBus.Status.Config.JetStream.Auth
} else if eventBus.Status.Config.NATS != nil {
authStrategy = eventBus.Status.Config.NATS.Auth
}

var items []corev1.KeyToPath
if authStrategy != nil && *authStrategy == v1alpha1.AuthStrategyJWT {
// For JWT auth, mount only the credentials file
items = []corev1.KeyToPath{
{
Key: accessSecret.Key,
Path: "credentials.creds",
},
}
} else {
// For Basic/Token auth, mount as auth.yaml
items = []corev1.KeyToPath{
{
Key: accessSecret.Key,
Path: "auth.yaml",
},
}
}

volumes = append(volumes, corev1.Volume{
Name: "auth-volume",
VolumeSource: corev1.VolumeSource{
Secret: &corev1.SecretVolumeSource{
SecretName: accessSecret.Name,
Items: []corev1.KeyToPath{
{
Key: accessSecret.Key,
Path: "auth.yaml",
},
},
Items: items,
},
},
})
Expand Down
15 changes: 13 additions & 2 deletions pkg/shared/leaderelection/leaderelection.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,11 +74,22 @@ func getEventBusAuth(ctx context.Context, authStrategy *aev1.AuthStrategy) (*eve

var auth *eventbuscommon.Auth

if authStrategy == nil || *authStrategy == aev1.AuthStrategyNone {
switch {
case authStrategy == nil || *authStrategy == aev1.AuthStrategyNone:
auth = &eventbuscommon.Auth{
Strategy: aev1.AuthStrategyNone,
}
} else {
case *authStrategy == aev1.AuthStrategyJWT:
// For JWT auth, we don't parse auth.yaml - just set the credential file path
cred := &eventbuscommon.AuthCredential{
CredentialFile: fmt.Sprintf("%s/credentials.creds", eventBusAuthFileMountPath),
}
auth = &eventbuscommon.Auth{
Strategy: aev1.AuthStrategyJWT,
Credential: cred,
}
default:
// For Basic and Token auth, parse auth.yaml
v := sharedutil.ViperWithLogging()
v.SetConfigName("auth")
v.SetConfigType("yaml")
Expand Down