Add support for spiffe.io/helper-jwt-audience and spiffe.io/helper-jwt-filename annotations #84
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| module github.com/cofide/spiffe-enable | ||
|
|
||
| go 1.25 | ||
|
|
||
| require ( | ||
| github.com/evanphx/json-patch v5.9.11+incompatible | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| package helper | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "strconv" | ||
| "strings" | ||
|
|
||
| constants "github.com/cofide/spiffe-enable/internal/const" | ||
| corev1 "k8s.io/api/core/v1" | ||
| ) | ||
|
|
||
| const defaultJWTSVIDFileMode = 600 | ||
|
|
||
| // ParseJWTConfigFromAnnotations extracts JWT SVID configuration from pod annotations | ||
| func ParseJWTConfigFromAnnotations(annotations map[string]string) []SPIFFEHelperJWTConfig { | ||
| var jwtConfigs []SPIFFEHelperJWTConfig | ||
|
|
||
| audience, hasAudience := annotations[constants.HelperJWTAudienceAnnotation] | ||
| filename, hasFilename := annotations[constants.HelperJWTFilenameAnnotation] | ||
|
|
||
| // Only create JWT config if audience is specified | ||
| if !hasAudience || audience == "" { | ||
| return jwtConfigs | ||
| } | ||
|
|
||
| // Default filename if not specified | ||
| if !hasFilename || filename == "" { | ||
| filename = "tokens/token" | ||
| } | ||
|
|
||
| jwtConfig := SPIFFEHelperJWTConfig{ | ||
| JWTAudience: audience, | ||
| JWTSVIDFilename: filename, | ||
| // Keep this non-nil so empty values are consistently treated as an empty list | ||
| // (and so future encoding paths don't accidentally emit `null`). | ||
| JWTExtraAudiences: []string{}, | ||
| } | ||
|
|
||
| // Parse extra audiences if present (comma-separated) | ||
| if extraAudiences, hasExtra := annotations[constants.HelperJWTExtraAudiencesAnnotation]; hasExtra && extraAudiences != "" { | ||
| rawAudiences := strings.Split(extraAudiences, ",") | ||
| audiences := make([]string, 0, len(rawAudiences)) | ||
| for _, a := range rawAudiences { | ||
| a = strings.TrimSpace(a) | ||
| if a == "" { | ||
| continue | ||
| } | ||
| audiences = append(audiences, a) | ||
| } | ||
| jwtConfig.JWTExtraAudiences = audiences | ||
| } | ||
|
|
||
| jwtConfigs = append(jwtConfigs, jwtConfig) | ||
| return jwtConfigs | ||
| } | ||
|
|
||
| // ParseJWTSVIDFileModeFromAnnotations extracts a numeric file mode for JWT SVID output. | ||
| // | ||
| // If not set, returns 600 (owner read/write). | ||
| func ParseJWTSVIDFileModeFromAnnotations(annotations map[string]string) (int, error) { | ||
| raw, ok := annotations[constants.HelperJWTSVIDFileModeAnnotation] | ||
| if !ok || strings.TrimSpace(raw) == "" { | ||
| return defaultJWTSVIDFileMode, nil | ||
| } | ||
|
|
||
| mode, err := strconv.Atoi(strings.TrimSpace(raw)) | ||
| if err != nil { | ||
| return 0, fmt.Errorf("invalid %s %q: must be an integer (e.g. 600)", constants.HelperJWTSVIDFileModeAnnotation, raw) | ||
| } | ||
| if mode <= 0 { | ||
| return 0, fmt.Errorf("invalid %s %q: must be a positive integer (e.g. 600)", constants.HelperJWTSVIDFileModeAnnotation, raw) | ||
| } | ||
| return mode, nil | ||
| } | ||
|
|
||
| // EnsureCertVolumeMount adds the cert directory volume mount to the container | ||
| // if it doesn't already exist | ||
| func EnsureCertVolumeMount(container *corev1.Container, certPath string) bool { | ||
| volumeMount := corev1.VolumeMount{ | ||
| Name: constants.SPIFFEEnableCertVolumeName, | ||
| MountPath: certPath, | ||
| ReadOnly: true, | ||
| } | ||
|
|
||
| // Check if this volume mount already exists | ||
| for _, vm := range container.VolumeMounts { | ||
| if vm.Name == constants.SPIFFEEnableCertVolumeName && vm.MountPath == certPath { | ||
| return false // Already exists | ||
| } | ||
| } | ||
|
|
||
| container.VolumeMounts = append(container.VolumeMounts, volumeMount) | ||
| return true | ||
| } |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The manual construction of HCL objects using
cty.Valueandcty.ObjectValforjwt_svidsis effective but verbose and tightly coupled to theSPIFFEHelperJWTConfigstruct's fields. If theSPIFFEHelperJWTConfigstruct changes (e.g., field names, types), this manual construction logic would need to be updated carefully, increasing maintenance burden. While necessary for the specific HCL output format and avoidingnullvalues, it's a pattern that can become brittle.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good callout. We intentionally build jwt_svids via cty because spiffe-helper expects jwt_svids as a list attribute (not blocks) and gohcl was producing either block syntax or null values in some cases.
To reduce brittleness, I refactored the mapping into a single helper (jwtSVIDConfigToCtyValue) so future changes only need updating in one place. We also keep coverage that asserts the generated config contains no null.