OIDC datagatherer

examples/one-shot-oidc.yaml

@@ -0,0 +1,16 @@
+# one-shot-oidc.yaml
+#
+# An example configuration file which can be used for local testing.
+# For example:
+#
+#  go run . agent \
+#     --agent-config-file examples/one-shot-oidc.yaml \
+#     --one-shot \
+#     --output-path output.json
+#
+organization_id: "my-organization"
+cluster_id: "my_cluster"
+period: 1m
+data-gatherers:
+- kind: "oidc"
+  name: "k8s/oidc"

pkg/agent/config.go

@@ -19,8 +19,10 @@ import (
 	"github.com/jetstack/preflight/api"
 	"github.com/jetstack/preflight/pkg/client"
 	"github.com/jetstack/preflight/pkg/datagatherer"
-	"github.com/jetstack/preflight/pkg/datagatherer/k8s"
+	"github.com/jetstack/preflight/pkg/datagatherer/k8sdiscovery"
+	"github.com/jetstack/preflight/pkg/datagatherer/k8sdynamic"
 	"github.com/jetstack/preflight/pkg/datagatherer/local"
+	"github.com/jetstack/preflight/pkg/datagatherer/oidc"
 	"github.com/jetstack/preflight/pkg/kubeconfig"
 	"github.com/jetstack/preflight/pkg/logs"
 	"github.com/jetstack/preflight/pkg/version"
@@ -895,11 +897,13 @@ func (dg *DataGatherer) UnmarshalYAML(unmarshal func(any) error) error {
 
 	switch dg.Kind {
 	case "k8s":
-		cfg = &k8s.ConfigDynamic{}
+		cfg = &k8sdynamic.ConfigDynamic{}
 	case "k8s-dynamic":
-		cfg = &k8s.ConfigDynamic{}
+		cfg = &k8sdynamic.ConfigDynamic{}
 	case "k8s-discovery":
-		cfg = &k8s.ConfigDiscovery{}
+		cfg = &k8sdiscovery.ConfigDiscovery{}
+	case "oidc":
+		cfg = &oidc.OIDCDiscovery{}
 	case "local":
 		cfg = &local.Config{}
 	// dummy dataGatherer is just used for testing

pkg/agent/run.go

@@ -33,7 +33,7 @@ import (
 	"github.com/jetstack/preflight/api"
 	"github.com/jetstack/preflight/pkg/client"
 	"github.com/jetstack/preflight/pkg/datagatherer"
-	"github.com/jetstack/preflight/pkg/datagatherer/k8s"
+	"github.com/jetstack/preflight/pkg/datagatherer/k8sdynamic"
 	"github.com/jetstack/preflight/pkg/kubeconfig"
 	"github.com/jetstack/preflight/pkg/logs"
 	"github.com/jetstack/preflight/pkg/version"
@@ -176,7 +176,7 @@ func Run(cmd *cobra.Command, args []string) (returnErr error) {
 			return fmt.Errorf("failed to instantiate %q data gatherer  %q: %v", kind, dgConfig.Name, err)
 		}
 
-		dynDg, isDynamicGatherer := newDg.(*k8s.DataGathererDynamic)
+		dynDg, isDynamicGatherer := newDg.(*k8sdynamic.DataGathererDynamic)
 		if isDynamicGatherer {
 			dynDg.ExcludeAnnotKeys = config.ExcludeAnnotationKeysRegex
 			dynDg.ExcludeLabelKeys = config.ExcludeLabelKeysRegex
@@ -222,7 +222,7 @@ func Run(cmd *cobra.Command, args []string) (returnErr error) {
 		// the run.
 		if err := dg.WaitForCacheSync(bootCtx); err != nil {
 			// log sync failure, this might recover in future
-			if errors.Is(err, k8s.ErrCacheSyncTimeout) {
+			if errors.Is(err, k8sdynamic.ErrCacheSyncTimeout) {
 				timedoutDGs = append(timedoutDGs, dgConfig.Name)
 			} else {
 				log.V(logs.Info).Info("Failed to sync cache for datagatherer", "kind", dgConfig.Kind, "name", dgConfig.Name, "error", err)

pkg/datagatherer/k8s/discovery.go → pkg/datagatherer/k8sdiscovery/discovery.go

@@ -1,4 +1,4 @@
-package k8s
+package k8sdiscovery
 
 import (
 	"context"
@@ -9,6 +9,7 @@ import (
 
 	"github.com/jetstack/preflight/api"
 	"github.com/jetstack/preflight/pkg/datagatherer"
+	"github.com/jetstack/preflight/pkg/kubeconfig"
 )
 
 // ConfigDiscovery contains the configuration for the k8s-discovery data-gatherer
@@ -38,11 +39,11 @@ func (c *ConfigDiscovery) UnmarshalYAML(unmarshal func(any) error) error {
 // The UID is assumed to be stable for the lifetime of the cluster.
 // - https://github.com/kubernetes/kubernetes/issues/77487#issuecomment-489786023
 func (c *ConfigDiscovery) NewDataGatherer(ctx context.Context) (datagatherer.DataGatherer, error) {
-	cl, err := NewDiscoveryClient(c.KubeConfigPath)
+	cl, err := kubeconfig.NewDiscoveryClient(c.KubeConfigPath)
 	if err != nil {
 		return nil, err
 	}
-	cs, err := NewClientSet(c.KubeConfigPath)
+	cs, err := kubeconfig.NewClientSet(c.KubeConfigPath)
 	if err != nil {
 		return nil, fmt.Errorf("while creating new clientset: %s", err)
 	}

pkg/datagatherer/k8s/cache.go → pkg/datagatherer/k8sdynamic/cache.go

@@ -1,4 +1,4 @@
-package k8s
+package k8sdynamic
 
 import (
 	"fmt"

pkg/datagatherer/k8s/cache_test.go → pkg/datagatherer/k8sdynamic/cache_test.go

@@ -1,4 +1,4 @@
-package k8s
+package k8sdynamic
 
 import (
 	"testing"

pkg/datagatherer/k8s/dynamic.go → pkg/datagatherer/k8sdynamic/dynamic.go

@@ -1,4 +1,4 @@
-package k8s
+package k8sdynamic
 
 // The venafi-kubernetes-agent has a requirement that **all** resources should
 // be uploaded, even short-lived secrets, which are created and deleted
@@ -61,6 +61,7 @@ import (
 
 	"github.com/jetstack/preflight/api"
 	"github.com/jetstack/preflight/pkg/datagatherer"
+	"github.com/jetstack/preflight/pkg/kubeconfig"
 	"github.com/jetstack/preflight/pkg/logs"
 )
 
@@ -179,14 +180,14 @@ var kubernetesNativeResources = map[schema.GroupVersionResource]sharedInformerFu
 // NewDataGatherer constructs a new instance of the generic K8s data-gatherer for the provided
 func (c *ConfigDynamic) NewDataGatherer(ctx context.Context) (datagatherer.DataGatherer, error) {
 	if isNativeResource(c.GroupVersionResource) {
-		clientset, err := NewClientSet(c.KubeConfigPath)
+		clientset, err := kubeconfig.NewClientSet(c.KubeConfigPath)
 		if err != nil {
 			return nil, err
 		}
 
 		return c.newDataGathererWithClient(ctx, nil, clientset)
 	} else {
-		cl, err := NewDynamicClient(c.KubeConfigPath)
+		cl, err := kubeconfig.NewDynamicClient(c.KubeConfigPath)
 		if err != nil {
 			return nil, err
 		}

pkg/datagatherer/k8s/dynamic_test.go → pkg/datagatherer/k8sdynamic/dynamic_test.go

@@ -1,4 +1,4 @@
-package k8s
+package k8sdynamic
 
 import (
 	"encoding/json"

pkg/datagatherer/k8s/fieldfilter.go → pkg/datagatherer/k8sdynamic/fieldfilter.go

@@ -1,4 +1,4 @@
-package k8s
+package k8sdynamic
 
 import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"

pkg/datagatherer/k8s/fieldfilter_test.go → pkg/datagatherer/k8sdynamic/fieldfilter_test.go

@@ -1,4 +1,4 @@
-package k8s
+package k8sdynamic
 
 import (
 	"encoding/json"

pkg/datagatherer/oidc/oidc.go

@@ -0,0 +1,115 @@
+package oidc
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"k8s.io/client-go/rest"
+
+	"github.com/jetstack/preflight/pkg/datagatherer"
+	"github.com/jetstack/preflight/pkg/kubeconfig"
+)
+
+// OIDCDiscovery contains the configuration for the k8s-discovery data-gatherer
+type OIDCDiscovery struct {
+	// KubeConfigPath is the path to the kubeconfig file. If empty, will assume it runs in-cluster.
+	KubeConfigPath string `yaml:"kubeconfig"`
+}
+
+// UnmarshalYAML unmarshals the Config resolving GroupVersionResource.
+func (c *OIDCDiscovery) UnmarshalYAML(unmarshal func(any) error) error {
+	aux := struct {
+		KubeConfigPath string `yaml:"kubeconfig"`
+	}{}
+	err := unmarshal(&aux)
+	if err != nil {
+		return err
+	}
+
+	c.KubeConfigPath = aux.KubeConfigPath
+
+	return nil
+}
+
+func (c *OIDCDiscovery) NewDataGatherer(ctx context.Context) (datagatherer.DataGatherer, error) {
+	cl, err := kubeconfig.NewDiscoveryClient(c.KubeConfigPath)
+	if err != nil {
+		return nil, err
+	}
+
+	return &DataGathererOIDC{
+		cl: cl.RESTClient(),
+	}, nil
+}
+
+// DataGathererOIDC stores the config for a k8s-discovery datagatherer
+type DataGathererOIDC struct {
+	cl rest.Interface
+}
+
+func (g *DataGathererOIDC) Run(ctx context.Context) error {
+	return nil
+}
+
+func (g *DataGathererOIDC) WaitForCacheSync(ctx context.Context) error {
+	// no async functionality, see Fetch
+	return nil
+}
+
+// Fetch will fetch discovery data from the apiserver, or return an error
+func (g *DataGathererOIDC) Fetch() (any, int, error) {
+	ctx := context.Background()
+
+	oidcResponse, oidcErr := g.fetchOIDCConfig(ctx)
+	jwksResponse, jwksErr := g.fetchJWKS(ctx)
+
+	errToString := func(err error) string {
+		if err != nil {
+			return err.Error()
+		}
+		return ""
+	}
+
+	return OIDCDiscoveryData{
+		OIDCConfig:      oidcResponse,
+		OIDCConfigError: errToString(oidcErr),
+		JWKS:            jwksResponse,
+		JWKSError:       errToString(jwksErr),
+	}, 1, nil
+}
+
+type OIDCDiscoveryData struct {
+	OIDCConfig      map[string]any `json:"openid_configuration,omitempty"`
+	OIDCConfigError string         `json:"openid_configuration_error,omitempty"`
+	JWKS            map[string]any `json:"jwks,omitempty"`
+	JWKSError       string         `json:"jwks_error,omitempty"`
+}
+
+func (g *DataGathererOIDC) fetchOIDCConfig(ctx context.Context) (map[string]any, error) {
+	bytes, err := g.cl.Get().AbsPath("/.well-known/openid-configuration").Do(ctx).Raw()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get OIDC discovery document: %v", err)
+	}
+
+	var oidcResponse map[string]any
+	if err := json.Unmarshal(bytes, &oidcResponse); err != nil {
+		return nil, fmt.Errorf("failed to unmarshal OIDC discovery document: %v", err)
+	}
+
+	return oidcResponse, nil
+}
+
+func (g *DataGathererOIDC) fetchJWKS(ctx context.Context) (map[string]any, error) {
+	bytes, err := g.cl.Get().AbsPath("/openid/v1/jwks").Do(ctx).Raw()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get JWKS from jwks_uri: %v", err)
+	}
+
+	var jwksResponse map[string]any
+	if err := json.Unmarshal(bytes, &jwksResponse); err != nil {
+		return nil, fmt.Errorf("failed to unmarshal JWKS response: %v", err)
+	}
+
+	return jwksResponse, nil
+}

pkg/datagatherer/k8s/client.go → pkg/kubeconfig/client.go

@@ -1,19 +1,16 @@
-// Package k8s provides datagatherers for different parts of the Kubernetes API.
-package k8s
+package kubeconfig
 
 import (
 	"k8s.io/client-go/discovery"
 	"k8s.io/client-go/dynamic"
 	"k8s.io/client-go/kubernetes"
-
-	"github.com/jetstack/preflight/pkg/kubeconfig"
 )
 
 // NewDynamicClient creates a new 'dynamic' clientset using the provided kubeconfig.
 // If kubeconfigPath is not set/empty, it will attempt to load configuration using
 // the default loading rules.
 func NewDynamicClient(kubeconfigPath string) (dynamic.Interface, error) {
-	cfg, err := kubeconfig.LoadRESTConfig(kubeconfigPath)
+	cfg, err := LoadRESTConfig(kubeconfigPath)
 	if err != nil {
 		return nil, err
 	}
@@ -30,7 +27,7 @@ func NewDynamicClient(kubeconfigPath string) (dynamic.Interface, error) {
 // kubeconfig.  If kubeconfigPath is not set/empty, it will attempt to load
 // configuration using the default loading rules.
 func NewDiscoveryClient(kubeconfigPath string) (*discovery.DiscoveryClient, error) {
-	cfg, err := kubeconfig.LoadRESTConfig(kubeconfigPath)
+	cfg, err := LoadRESTConfig(kubeconfigPath)
 	if err != nil {
 		return nil, err
 	}
@@ -47,7 +44,7 @@ func NewDiscoveryClient(kubeconfigPath string) (*discovery.DiscoveryClient, erro
 // If kubeconfigPath is not set/empty, it will attempt to load configuration using
 // the default loading rules.
 func NewClientSet(kubeconfigPath string) (kubernetes.Interface, error) {
-	cfg, err := kubeconfig.LoadRESTConfig(kubeconfigPath)
+	cfg, err := LoadRESTConfig(kubeconfigPath)
 	if err != nil {
 		return nil, err
 	}

pkg/datagatherer/k8s/client_test.go → pkg/kubeconfig/client_test.go

@@ -1,4 +1,4 @@
-package k8s
+package kubeconfig
 
 import (
 	"os"

pkg/permissions/generate.go

@@ -9,7 +9,7 @@ import (
 	"sigs.k8s.io/yaml"
 
 	"github.com/jetstack/preflight/pkg/agent"
-	"github.com/jetstack/preflight/pkg/datagatherer/k8s"
+	"github.com/jetstack/preflight/pkg/datagatherer/k8sdynamic"
 )
 
 // AgentRBACManifests is a wrapper around the various RBAC structs needed to grant the agent fine-grained permissions as per its dg configs
@@ -34,7 +34,7 @@ func GenerateAgentRBACManifests(dataGatherers []agent.DataGatherer) AgentRBACMan
 			continue
 		}
 
-		dyConfig := dg.Config.(*k8s.ConfigDynamic)
+		dyConfig := dg.Config.(*k8sdynamic.ConfigDynamic)
 		metadataName := fmt.Sprintf("%s-agent-%s-reader", agentNamespace, dyConfig.GroupVersionResource.Resource)
 
 		AgentRBACManifests.ClusterRoles = append(AgentRBACManifests.ClusterRoles, rbac.ClusterRole{