Support validating first party JWT for platforms without third party JWT#20179
Support validating first party JWT for platforms without third party JWT#20179istio-testing merged 1 commit intoistio:masterfrom
Conversation
howardjohn
left a comment
There was a problem hiding this comment.
This only solves a small portion of the problem. We still mount the trustworthy jwt, which will fail on clusters without support, and we still send XDS config referencing it.
I would suggest looking at the PR that removed support and working backwards as a starting point possibly?
manifests/global.yaml
Outdated
There was a problem hiding this comment.
We used to have a setting useTrustworthyJwt, do you think it makes sense to go back to using the same setting?
If not, should we call this first and third party jwt?
There was a problem hiding this comment.
Changed to call it first and third party JWT.
Here jwtPolicy is used to express different JWT policies; the binary setting of useTrustworthyJwt makes it awkward to express different JWT policies while reducing the code readability.
There was a problem hiding this comment.
Line 391 is going to fail if your cluster doesn't have this enabled. If you want to test it just run kind create cluster, that will start a cluster without support. No pods will start
There was a problem hiding this comment.
Added {{- if eq .Values.global.jwtPolicy "third-party-jwt" }} before line 391.
37659ea to
e5a760e
Compare
e5a760e to
4a83080
Compare
4a83080 to
4f10d7e
Compare
|
@howardjohn To support first party JWT, there will be multiple PRs. To make the PR shorter and easier to review, this PR focuses on adding the support of validating first party JWT. |
There was a problem hiding this comment.
you need to remove the volume too, not just the volume mount
There was a problem hiding this comment.
Added the conditional flag to the volume too. The mounting part will be addressed in follow up PRs.
4f10d7e to
15bddae
Compare
howardjohn
left a comment
There was a problem hiding this comment.
lgtm other than my one comment. can be a followup pr
23319a3 to
19cc5c9
Compare
|
/test release-test_istio |
|
/test integ-security-k8s-tests_istio |
There was a problem hiding this comment.
There was a problem hiding this comment.
Please also set condition for the "projected volume"
19cc5c9 to
aaebc6a
Compare
|
/test gencheck_istio |
76bc815 to
d51fa72
Compare
7e771f9 to
9dfd20c
Compare
9dfd20c to
6db8299
Compare
1b7df8f to
cbf6945
Compare
b6e6132 to
dd22696
Compare
- Support validating first party JWT for platforms without third party JWT. - Add the JWT policy configuration to Operator. - Config grpc calling credentials.
dd22696 to
0c3578b
Compare
Please provide a description for what this PR is for: #20178
To make the PR shorter and easier to review, this PR focues on adding the support of validating first party JWT. More PRs will follow up on this topic.
[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[X ] Networking
[ ] Performance and Scalability
[ ] Policies and Telemetry
[X ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure