Bump go-oidc to 3.6.0 #114772

skitt · 2023-01-03T10:07:33Z

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

This updates go-oidc to v3.5.0, which is now a proper semantically-versioned Go module. Most importantly for Kubernetes, it pulls in newer versions of various Go dependencies, which help with the cloud.google.com/go / genproto untangling (#113366).

The transitive upgrade of cloud.google.com/go/compute/metadata requires a bump of cloud.google.com/go/compute to a version where metadata is split out; this patch upgrades to the version matching metadata v0.2.1, compute v1.12.1. (Later versions pull in newer genproto versions which re-introduce a firestore module dependency.)

go-jose is bumped too; this involves handling the change in jwt.NewNumericDate(), which now returns a pointer.

Which issue(s) this PR fixes:

None.

Special notes for your reviewer:

Does this PR introduce a user-facing change?

NONE

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

k8s-ci-robot · 2023-01-03T10:07:42Z

Hi @skitt. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

skitt · 2023-01-03T12:12:57Z

/kind cleanup

liggitt · 2023-07-05T17:37:32Z

vendor/github.com/coreos/go-oidc/v3/oidc/jose.go

@@ -17,4 +13,5 @@ const (
 	PS256 = "PS256" // RSASSA-PSS using SHA256 and MGF1-SHA256
 	PS384 = "PS384" // RSASSA-PSS using SHA384 and MGF1-SHA384
 	PS512 = "PS512" // RSASSA-PSS using SHA512 and MGF1-SHA512
+	EdDSA = "EdDSA" // Ed25519 using SHA-512


hmm... not a great sign that the one addition here isn't defined in the linked RFC

liggitt · 2023-07-05T17:46:31Z

test/integration/auth/svcaccttoken_test.go

@@ -205,7 +205,7 @@ func TestServiceAccountTokenCreate(t *testing.T) {
 		}

 		checkPayload(t, treq.Status.Token, `"system:serviceaccount:myns:test-svcacct"`, "sub")
-		checkPayload(t, treq.Status.Token, `["api"]`, "aud")
+		checkPayload(t, treq.Status.Token, `"api"`, "aud")


this change is surprising... does the serialization actually modify the shape of the service account tokens we emit? (string aud field instead of array of strings)?

This was introduced by square/go-jose#247 — tokens with a single audience are emitted with a string field rather than an array of strings.

liggitt

I don't have time to review the square → go-jose changes in depth in the short-term, but they need an in-depth review, given the importance of the authn layer using this

aramase · 2023-07-24T16:14:38Z

/uncc liggitt
/unassign liggitt
as per #114772 (review)

/assign aramase

aramase

@skitt Are you still working on this?

rexagod · 2023-08-04T21:58:54Z

/remove-sig instrumentation

skitt · 2023-08-04T22:00:21Z

@skitt Are you still working on this?

Yes, but I won’t have time to revisit it for another two weeks or so.

aramase · 2023-09-21T18:19:08Z

@skitt Are you still working on this?

Yes, but I won’t have time to revisit it for another two weeks or so.

bump on this! The PR requires rebase.

This replaces gopkg.in/square/go-jose.v2 with github.com/go-jose/go-jose/v3 which is the currently-maintained stable version of go-jose. This adds to vendor, but once go-oidc is bumped to a version including its go-jose bump, go-jose.v2 will be removed entirely. Signed-off-by: Stephen Kitt <skitt@redhat.com>

k8s-ci-robot · 2023-09-25T06:18:10Z

@skitt: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-kubernetes-e2e-kind-kms	1d85e425bd98ea8917ffa12d86c14c734c80dd09	link	false	`/test pull-kubernetes-e2e-kind-kms`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

This is now a proper semantically-versioned Go module. Notably for Kubernetes, it pulls in gopkg.in/go-jose/go-jose/v3, which means gopkg.in/square/go-jose.v2 is dropped from vendor. go-oidc re-introduces a dependency on appengine through oauth2, add it to the unwanted references. Signed-off-by: Stephen Kitt <skitt@redhat.com>

k8s-ci-robot · 2023-09-25T06:26:55Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: skitt
Once this PR has been reviewed and has the lgtm label, please assign liggitt for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS
LICENSES/OWNERS
hack/OWNERS
pkg/controller/serviceaccount/OWNERS
pkg/serviceaccount/OWNERS
staging/src/k8s.io/apiextensions-apiserver/OWNERS
staging/src/k8s.io/apiserver/OWNERS
staging/src/k8s.io/cloud-provider/OWNERS
staging/src/k8s.io/cluster-bootstrap/OWNERS
staging/src/k8s.io/controller-manager/OWNERS
staging/src/k8s.io/kube-aggregator/OWNERS
staging/src/k8s.io/kubelet/OWNERS
staging/src/k8s.io/pod-security-admission/OWNERS
staging/src/k8s.io/sample-apiserver/OWNERS
test/OWNERS
vendor/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot · 2023-10-14T01:14:22Z

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-triage-robot · 2024-02-04T06:16:25Z

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Reopen this PR with /reopen
Mark this PR as fresh with /remove-lifecycle rotten
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

k8s-ci-robot · 2024-02-04T06:16:31Z

@k8s-triage-robot: Closed this PR.

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied

After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied

After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Reopen this PR with /reopen

Mark this PR as fresh with /remove-lifecycle rotten

Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot requested review from andrewsykim and aojea January 3, 2023 10:08

k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Jan 3, 2023

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 20, 2023

skitt force-pushed the go-oidc-v3 branch from 3e13aee to 4b9dffa Compare June 20, 2023 15:02

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 20, 2023

liggitt reviewed Jul 5, 2023

View reviewed changes

k8s-ci-robot assigned aramase and unassigned liggitt Jul 24, 2023

aramase reviewed Aug 1, 2023

View reviewed changes

k8s-ci-robot removed the sig/instrumentation Categorizes an issue or PR as relevant to SIG Instrumentation. label Aug 4, 2023

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 27, 2023

skitt force-pushed the go-oidc-v3 branch from 4b9dffa to 546529f Compare September 25, 2023 06:11

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 25, 2023

skitt force-pushed the go-oidc-v3 branch from 546529f to 0862476 Compare September 25, 2023 06:26

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 14, 2023

dims added the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Oct 24, 2023

k8s-ci-robot closed this Feb 4, 2024

enj mentioned this pull request Feb 13, 2024

Update go-jose dependency in apiserver #123253

Closed

liggitt mentioned this pull request Mar 3, 2024

[WIP] Switch versions of go-jose and go-oidc #123649

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump go-oidc to 3.6.0 #114772

Bump go-oidc to 3.6.0 #114772

skitt commented Jan 3, 2023 •

edited

k8s-ci-robot commented Jan 3, 2023

skitt commented Jan 3, 2023

liggitt Jul 5, 2023

liggitt Jul 5, 2023

skitt Sep 25, 2023

liggitt left a comment •

edited

aramase commented Jul 24, 2023

aramase left a comment

rexagod commented Aug 4, 2023

skitt commented Aug 4, 2023

aramase commented Sep 21, 2023

k8s-ci-robot commented Sep 25, 2023 •

edited

k8s-ci-robot commented Sep 25, 2023

k8s-ci-robot commented Oct 14, 2023

k8s-triage-robot commented Feb 4, 2024

k8s-ci-robot commented Feb 4, 2024

Bump go-oidc to 3.6.0 #114772

Bump go-oidc to 3.6.0 #114772

Conversation

skitt commented Jan 3, 2023 • edited

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

k8s-ci-robot commented Jan 3, 2023

skitt commented Jan 3, 2023

liggitt Jul 5, 2023

Choose a reason for hiding this comment

liggitt Jul 5, 2023

Choose a reason for hiding this comment

skitt Sep 25, 2023

Choose a reason for hiding this comment

liggitt left a comment • edited

Choose a reason for hiding this comment

aramase commented Jul 24, 2023

aramase left a comment

Choose a reason for hiding this comment

rexagod commented Aug 4, 2023

skitt commented Aug 4, 2023

aramase commented Sep 21, 2023

k8s-ci-robot commented Sep 25, 2023 • edited

k8s-ci-robot commented Sep 25, 2023

k8s-ci-robot commented Oct 14, 2023

k8s-triage-robot commented Feb 4, 2024

k8s-ci-robot commented Feb 4, 2024

skitt commented Jan 3, 2023 •

edited

liggitt left a comment •

edited

k8s-ci-robot commented Sep 25, 2023 •

edited