Provision contract with OIDC information

[creydr]

Fixes #3572 (follow up on #3571)

Proposed Changes

• Update contract with OIDC information. This includes:
  • Audience of the Destination
  • Audience of the Reply
  • Audience of the Dead-Letter-Sink
  • OIDCServiceAccountName
  • Audience of the ingress

Release Note

none

[codecov]

Codecov Report

Attention: 50 lines in your changes are missing coverage. Please review.

Comparison is base (a3b83bc) 62.18% compared to head (d0f825b) 61.96%.
Report is 1 commits behind head on main.

Files	Patch %	Lines
control-plane/pkg/reconciler/channel/channel.go	0.00%	8 Missing and 4 partials ⚠️
control-plane/pkg/reconciler/consumer/consumer.go	7.69%	9 Missing and 3 partials ⚠️
...lane/pkg/reconciler/consumergroup/consumergroup.go	0.00%	5 Missing and 2 partials ⚠️
control-plane/pkg/core/config/utils.go	0.00%	2 Missing and 1 partial ⚠️
control-plane/pkg/reconciler/broker/broker.go	0.00%	2 Missing and 1 partial ⚠️
...ntrol-plane/pkg/reconciler/channel/v2/channelv2.go	0.00%	2 Missing and 1 partial ⚠️
control-plane/pkg/reconciler/sink/kafka_sink.go	0.00%	2 Missing and 1 partial ⚠️
control-plane/pkg/reconciler/trigger/trigger.go	50.00%	2 Missing and 1 partial ⚠️
...ntrol-plane/pkg/reconciler/trigger/v2/triggerv2.go	0.00%	2 Missing and 1 partial ⚠️
...-plane/pkg/apis/sources/v1beta1/kafka_lifecycle.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #3646      +/-   ##
============================================
- Coverage     62.18%   61.96%   -0.22%     
+ Complexity      847      845       -2     
============================================
  Files           188      188              
  Lines         12727    12785      +58     
  Branches        273      273              
============================================
+ Hits           7914     7922       +8     
- Misses         4199     4233      +34     
- Partials        614      630      +16     

Flag	Coverage Δ
java-unittests	74.46% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[creydr]

/test reconciler-tests

[creydr]

/retest-required

[creydr]

Can be tested in the following way (currently not for Broker & Triggers, as this is still WIP (#3600)):

1. Create services (subscriber, reply, DLS):

$ kn service create event-display --image gcr.io/knative-releases/knative.dev/eventing/cmd/event_display
$ kn service create my-reply --image gcr.io/knative-releases/knative.dev/eventing/cmd/event_display
$ kn service create my-dls --image gcr.io/knative-releases/knative.dev/eventing/cmd/event_display

2. Create a KafkaChannel (having configured to be a KafkaChannel the default):

apiVersion: messaging.knative.dev/v1
kind: Channel            
metadata:  
  name: my-kafka-channel

3. Create a Subscription:

apiVersion: messaging.knative.dev/v1
kind: Subscription
metadata:
  name: my-sub
spec:
  channel:
    apiVersion: messaging.knative.dev/v1beta1
    kind: KafkaChannel
    name: my-kafka-channel
  subscriber:
    ref:
      apiVersion: serving.knative.dev/v1
      kind: Service
      name: event-display
    audience: ed-audience
  delivery:
    deadLetterSink:
      ref:
        apiVersion: serving.knative.dev/v1
        kind: Service
        name: my-dls
      audience: dls-audience
  reply:
    ref:
      apiVersion: serving.knative.dev/v1
      kind: Service
      name: my-reply
    audience: reply-audience

Then we see in the kafka-channel-channels-subscriptions the following:

k -n knative-eventing get cm kafka-channel-channels-subscriptions -ojsonpath='{.binaryData.data}' | base64 -d | jq .resources
[
  {
    "uid": "bc395fb8-6812-4429-8127-10c7a77e7bc6",
    "topics": [
      "knative-messaging-kafka.default.my-kafka-channel"
    ],
    "bootstrapServers": "my-cluster-kafka-bootstrap.kafka:9092",
    "ingress": {
      "path": "/default/my-kafka-channel",
      "host": "my-kafka-channel-kn-channel.default.svc.cluster.local",
      "audience": "messaging.knative.dev/kafkachannel/default/my-kafka-channel"
    },
    "egresses": [
      {
        "consumerGroup": "kafka.default.my-kafka-channel.6c26bb94-5208-458d-90b4-a46e58dd8d42",
        "destination": "http://event-display.default.svc.cluster.local",
        "destinationAudience": "ed-audience",
        "replyUrl": "http://my-reply.default.svc.cluster.local",
        "replyUrlAudience": "reply-audience",
        "uid": "6c26bb94-5208-458d-90b4-a46e58dd8d42",
        "egressConfig": {
          "deadLetter": "http://my-dls.default.svc.cluster.local",
          "deadLetterAudience": "dls-audience"
        },
        "deliveryOrder": "ORDERED",
        "reference": {
          "uuid": "6c26bb94-5208-458d-90b4-a46e58dd8d42",
          "namespace": "default",
          "name": "my-sub"
        },
        "oidcServiceAccountName": "my-sub-oidc-messaging.knative.dev-subscription"
      }
    ],
    "reference": {
      "uuid": "bc395fb8-6812-4429-8127-10c7a77e7bc6",
      "namespace": "default",
      "name": "my-kafka-channel",
      "kind": "KafkaChannel",
      "groupVersion": "messaging.knative.dev/v1beta1"
    }
  }
]

note the destinationAudience, replyAudience, deadLetterAudience and the oidcServiceAccount.

Same was tested for a KafkaSource:

1. Create Tropic and KafkaSource:

apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaTopic  
metadata:          
  name: knative-demo-topic
  namespace: kafka                           
  labels:                          
    strimzi.io/cluster: my-cluster           
spec:                 
  partitions: 3           
  replicas: 1
  config:   
    retention.ms: 7200000               
    segment.bytes: 1073741824
---
apiVersion: sources.knative.dev/v1beta1
kind: KafkaSource 
metadata:          
  name: kafka-source      
spec:                                        
  consumerGroup: knative-group     
  bootstrapServers:                          
  - my-cluster-kafka-bootstrap.kafka:9092
  topics:                 
  - knative-demo-topic
  sink:     
    ref:                                
      apiVersion: serving.knative.dev/v1                                                         
      kind: Service      
      name: event-display 
    audience: ed-audience

Resulted in the following contract:

$ k -n knative-eventing get cm kafka-source-dispatcher-0 -ojsonpath='{.binaryData.data}' | base64 -d | jq .resources
[
  {
    "uid": "bd71e8cc-e3ba-4d22-8542-307e2a1d37bd",
    "topics": [
      "knative-demo-topic"
    ],
    "bootstrapServers": "my-cluster-kafka-bootstrap.kafka:9092",
    "egresses": [
      {
        "consumerGroup": "knative-group",
        "destination": "http://event-display.default.svc.cluster.local",
        "destinationAudience": "ed-audience",
        "discardReply": {},
        "uid": "bd71e8cc-e3ba-4d22-8542-307e2a1d37bd",
        "egressConfig": {
          "retry": 10,
          "backoffDelay": "300",
          "timeout": "600000"
        },
        "deliveryOrder": "ORDERED",
        "reference": {
          "uuid": "b08d105d-9f36-4818-b86e-6401ec50ad00",
          "namespace": "default",
          "name": "kafka-source"
        },
        "vReplicas": 1,
        "featureFlags": {
          "enableRateLimiter": true,
          "enableOrderedExecutorMetrics": true
        },
        "oidcServiceAccountName": "my-source-oidc-sa"
      }
    ],
    "multiAuthSecret": {},
    "reference": {
      "uuid": "b08d105d-9f36-4818-b86e-6401ec50ad00",
      "namespace": "default",
      "name": "kafka-source"
    }
  }
]

[creydr]

/retest

[pierDipi]

/lgtm
/approve

[creydr]

/retest

[creydr]

/retest-required

[creydr]

/retest-required

[creydr]

/retest-required

[creydr]

/test reconciler-tests

[creydr]

/retest-required

[creydr]

/retest-required

[creydr]

/test reconciler-tests

[creydr]

/test unit-tests

[creydr]

@pierDipi I needed to rebase and then fix a unit test. Can you recheck?

[creydr]

/test unit-tests

🤔

[creydr]

/retest-required

[creydr]

/test upgrade-tests

[creydr]

/test upgrade-tests

[pierDipi]

/lgtm
/approve

[knative-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: creydr, pierDipi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [creydr,pierDipi]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment