[WIP] Add mTLS and OAuth authentication to event REST API #588

jzding · 2025-09-10T16:27:48Z

Assisted by Cursor AI

This PR introduces enterprise-grade authentication support for the cloud-event-proxy, enabling secure communication for both event consumers and producers in production OpenShift environments.

🚀 Key Features

Authentication Methods

✅ mTLS (Mutual TLS) - Client certificate authentication with CA validation
✅ OAuth JWT - Token-based authentication with OpenShift OAuth server integration
✅ ServiceAccount Tokens - Native Kubernetes pod-to-pod authentication
✅ Flexible Configuration - JSON-based configuration with multiple authentication options

Client-Side Implementation

🔧 Authentication Package - Complete pkg/auth/ implementation for client authentication
🔧 Enhanced REST Client - Authenticated HTTP client with mTLS and OAuth support
🔧 Configuration Management - Comprehensive config loading and validation
🔧 Seamless Integration - Authentication flows integrated into existing codebase

🏗️ Architecture Overview

Core Components

pkg/auth/client.go - HTTP client with authentication capabilities (172 lines)
pkg/auth/config.go - Configuration management and validation (195 lines)
Enhanced pkg/restclient/client.go - Authenticated REST client integration
Updated pkg/common/common.go - Authentication flow integration

Consumer Implementation

examples/consumer/main.go - Complete authenticated consumer example (91+ lines added)
examples/auth-examples/auth-examples.go - Comprehensive authentication examples (316 lines)
Authentication Configuration - Example configs and templates

📦 OpenShift Integration

Automated Deployment

examples/manifests/auth/setup-secrets.sh - Automated authentication setup (111 lines)
Service CA Integration - Automatic certificate generation and management
Dynamic Configuration - Environment-based cluster name configuration
RBAC Setup - Complete permissions configuration

Deployment Manifests

examples/manifests/consumer.yaml - Enhanced consumer deployment with authentication
examples/manifests/auth/configmap.yaml - Dynamic authentication configuration
examples/manifests/auth/client-cert-service.yaml - Service CA certificate generation
Complete RBAC - ServiceAccount, Role, and RoleBinding configurations

📚 Comprehensive Documentation

Implementation Guides

AUTHENTICATION_IMPLEMENTATION.md - Complete implementation guide (337 lines)
examples/consumer/README.md - Consumer authentication guide (383 lines)
examples/manifests/README.md - Deployment guide with authentication (307 lines)
examples/manifests/auth/README.md - Authentication setup instructions (196 lines)

Updated Main Documentation

Enhanced README.md - Authentication overview and integration guide (140+ lines added)
Certificate Examples - Manual certificate setup guide
Configuration Examples - Multiple authentication scenarios

🔧 Build and Development

Enhanced Makefile

deploy-consumer: kustomize ## Deploy consumer with authentication
undeploy-consumer: kustomize ## Undeploy consumer

Development Support

Updated .gitignore - Binary exclusions for clean development
Enhanced Testing - Updated unit tests for authentication integration
Ginkgo Compatibility - Fixed functional tests for Ginkgo v1

🛡️ Security Features

Comprehensive Validation

JWT Token Validation - Signature, expiration, and audience verification
Certificate Validation - Full TLS certificate chain validation
Multi-Issuer Support - OpenShift OAuth and ServiceAccount tokens
Secure Configuration - Encrypted communication with proper TLS setup

OpenShift Service CA Integration

Automatic Certificates - Service CA annotation-based certificate generation
CA Bundle Injection - Automatic CA bundle injection via ConfigMaps
Zero Configuration - No manual certificate management required
Automatic Rotation - Built-in certificate rotation support

🚀 Usage Examples

Basic Authentication Configuration

{
  "enableMTLS": true,
  "useServiceCA": true,
  "clientCertPath": "/etc/cloud-event-consumer/client-certs/tls.crt",
  "clientKeyPath": "/etc/cloud-event-consumer/client-certs/tls.key",
  "caCertPath": "/etc/cloud-event-consumer/ca-bundle/service-ca.crt",
  "enableOAuth": true,
  "useOpenShiftOAuth": true,
  "oauthIssuer": "https://oauth-openshift.apps.cluster.example.com",
  "serviceAccountName": "consumer-sa"
}

Automated Deployment

# Deploy with default cluster name
make deploy-consumer

# Deploy with custom cluster name
export CLUSTER_NAME=your-cluster.example.com
make deploy-consumer

🔄 Backward Compatibility

✅ Optional Authentication - Existing deployments continue to work unchanged
✅ Graceful Fallback - Clear error messages for configuration issues
✅ Zero Breaking Changes - All existing APIs maintain compatibility
✅ Progressive Enhancement - Authentication can be enabled incrementally

📊 Impact

Lines Added: 5,841 (including vendor dependencies)
New Dependencies: github.com/golang-jwt/jwt/v5 for secure JWT validation
Documentation: 1,423+ lines of comprehensive guides and examples
Examples: Complete consumer implementation with authentication
Deployment: Automated OpenShift deployment with Service CA integration

🎯 Use Cases

This authentication system enables:

Secure PTP Event Consumption in production OpenShift clusters
Multi-tenant Cloud Event Processing with proper access control
Enterprise Integration with existing OpenShift authentication infrastructure
Compliance Requirements for secure inter-service communication

🧪 Testing

The implementation includes:

✅ Updated unit tests for authentication integration
✅ Functional test compatibility with Ginkgo v1
✅ Example applications for testing authentication flows
✅ Comprehensive error handling and logging

openshift-ci · 2025-09-10T16:27:56Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jzding

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [jzding]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

jzding · 2025-09-23T01:37:52Z

/ok-to-test

jzding · 2025-09-23T02:47:26Z

/ok-to-test

jzding · 2025-09-23T13:21:58Z

/test e2e-aws

jzding · 2025-09-23T16:28:13Z

/ok-to-test

jzding · 2025-09-23T17:01:00Z

/ok-to-test

jzding · 2025-09-23T19:10:29Z

/ok-to-test

This commit introduces comprehensive authentication support for the cloud-event-proxy, enabling secure communication for both event consumers and producers in production OpenShift environments. **Authentication Infrastructure:** - mTLS (Mutual TLS) authentication with client certificate validation - OAuth JWT token authentication with OpenShift OAuth server integration - Support for Kubernetes ServiceAccount tokens for pod-to-pod communication - Flexible authentication configuration via JSON config files **Client-Side Authentication (pkg/auth/):** - `pkg/auth/client.go`: HTTP client with mTLS and OAuth token support - `pkg/auth/config.go`: Authentication configuration management and validation - Enhanced `pkg/restclient/client.go`: Authenticated REST client with TLS support - Integration with `pkg/common/common.go` for seamless authentication flow **Consumer Examples and Templates:** - `examples/consumer/main.go`: Complete consumer implementation with authentication - `examples/auth-examples/auth-examples.go`: Comprehensive authentication examples (316 lines) - `examples/consumer/auth-config-example.json`: Example authentication configuration - `examples/consumer/README.md`: Detailed consumer authentication guide (383 lines) **OpenShift Integration and Deployment:** - `examples/manifests/auth/setup-secrets.sh`: Automated authentication setup script - `examples/manifests/auth/configmap.yaml`: Dynamic authentication configuration - `examples/manifests/auth/client-cert-service.yaml`: Service CA certificate generation - `examples/manifests/auth/rbac.yaml`: Required RBAC permissions for authentication - `examples/manifests/consumer.yaml`: Enhanced consumer deployment with authentication - `examples/manifests/README.md`: Complete deployment guide (307 lines) **Documentation and Guides:** - `AUTHENTICATION_IMPLEMENTATION.md`: Comprehensive implementation guide (337 lines) - Enhanced `README.md`: Authentication overview and integration guide - `examples/manifests/auth/README.md`: Authentication setup instructions (196 lines) - `examples/manifests/auth/certificate-example.md`: Manual certificate setup guide **Main Application:** - `cmd/main.go`: Added `--auth-config` flag and authentication initialization - `cmd/main_test.go`: Updated tests to support authentication parameter - Enhanced test coverage in `pkg/plugins/handler_test.go` and `plugins/ptp_operator/ptp_operator_plugin_test.go` **Build and Development:** - `Makefile`: Added `deploy-consumer` and `undeploy-consumer` targets - `hack/run-functests.sh`: Updated for Ginkgo v1 compatibility - `.gitignore`: Added binary exclusions - `go.mod`/`go.sum`: Added JWT authentication dependencies **Automated Certificate Management:** - Service CA annotation-based certificate generation - Automatic CA bundle injection via ConfigMaps - Dynamic secret creation and management - Zero-configuration certificate rotation **OAuth Server Integration:** - Native OpenShift OAuth server support - ServiceAccount token authentication - Dynamic cluster name configuration via environment variables - JWKS endpoint integration for token validation **Comprehensive Token Validation:** - JWT signature verification against JWKS endpoints - Token expiration and audience validation - Support for both OpenShift OAuth and ServiceAccount tokens - Secure token storage and transmission **Certificate-Based Authentication:** - Client certificate validation with configurable CA trust - Server certificate verification with hostname validation - Support for both Service CA and cert-manager certificates - Secure TLS configuration with proper cipher suites 1. **Configuration Loading**: JSON-based authentication configuration 2. **Certificate Setup**: Automatic certificate retrieval from Kubernetes secrets 3. **Token Acquisition**: ServiceAccount token or OAuth token retrieval 4. **Authenticated Requests**: mTLS and OAuth-enabled HTTP client 5. **Dynamic Reconnection**: Automatic token refresh and certificate rotation **Automated Setup:** ```bash export CLUSTER_NAME=your-cluster.example.com make deploy-consumer ``` **Manual Configuration:** - Complete OpenShift manifests for production deployment - Service CA integration for automatic certificate management - RBAC configuration for proper permissions - ConfigMap-based dynamic configuration - Authentication is optional and configurable - Existing deployments continue to work without authentication - Graceful fallback for non-authenticated scenarios - Clear error messages for configuration issues - Updated unit tests for authentication integration - Functional test compatibility with Ginkgo v1 - Example applications for testing authentication flows - Comprehensive error handling and logging - `github.com/golang-jwt/jwt/v5`: Secure JWT token validation - Updated `rest-api` integration with authentication support - Enhanced vendor dependencies for security libraries This implementation provides enterprise-grade authentication for cloud event communication while maintaining full backward compatibility and supporting flexible deployment scenarios across different OpenShift environments. The authentication system integrates seamlessly with OpenShift's native security features and provides a complete solution for secure cloud event processing in production environments. Signed-off-by: Jack Ding <jackding@gmail.com>

Signed-off-by: Jack Ding <jackding@gmail.com>

openshift-ci · 2025-10-02T01:32:16Z

@jzding: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws	`66c5ea4`	link	true	`/test e2e-aws`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci bot added the do-not-merge/work-in-progress label Sep 10, 2025

openshift-ci bot requested review from atyronesmith and josephdrichard September 10, 2025 16:27

openshift-ci bot added the approved label Sep 10, 2025

jzding force-pushed the secure-event-api branch 2 times, most recently from 250d7be to dc9e1a9 Compare September 19, 2025 15:11

jzding force-pushed the secure-event-api branch 8 times, most recently from 74c2da8 to c853d2d Compare September 23, 2025 01:36