Repository navigation
Restrict Kubernetes IdP pod-token forwarding by default - #54232
atiqur-rahman-pro wants to merge 2 commits into
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
Trusting the namespace-relative kubernetes hostname can forward the pod token to an unrelated service.
1 open issue
What changed in this PR
Restricts Kubernetes identity-provider token forwarding to trusted endpoints by default, addressing public JWKS failures while preserving save-time discovery behavior.
Changes:
- Adds destination checks for runtime JWKS and fallback discovery requests.
- Adds an opt-in configuration setting and Admin Console switch.
- Documents the policy and adds regression tests.
| File | Description |
|---|---|
| services/src/test/java/org/keycloak/broker/kubernetes/KubernetesUtilsTest.java | Tests trusted endpoint classification. |
| services/src/test/java/org/keycloak/broker/kubernetes/KubernetesJwksEndpointLoaderTest.java | Tests forwarding headers and discovery behavior. |
| services/src/test/java/org/keycloak/broker/kubernetes/KubernetesIdentityProviderConfigTest.java | Tests configuration defaults and values. |
| services/src/main/java/org/keycloak/broker/kubernetes/KubernetesUtils.java | Defines trusted endpoints. |
| services/src/main/java/org/keycloak/broker/kubernetes/KubernetesJwksEndpointLoader.java | Enforces runtime forwarding policy. |
| services/src/main/java/org/keycloak/broker/kubernetes/KubernetesIdentityProviderConfig.java | Adds the forwarding option. |
| services/src/main/java/org/keycloak/broker/kubernetes/KubernetesIdentityProvider.java | Passes configuration to the loader. |
| js/apps/admin-ui/src/identity-providers/add/KubernetesSettings.tsx | Adds the forwarding switch. |
| js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/messages/messages_en.properties | Adds switch labels and help. |
| docs/documentation/server_admin/topics/identity-broker/kubernetes.adoc | Documents forwarding defaults and opt-in. |
Review effort: Balanced
By default, Keycloak only forwards the pod service account token to trusted in-cluster Kubernetes API server endpoints (HTTPS with standard port on kubernetes.default.svc, kubernetes.default.svc.cluster.local, or kubernetes.default) when the issuer matches. Forwarding tokens to additional endpoints (such as external JWKS URLs) can be enabled with the forwardTokenToAdditionalEndpoints configuration option. Closes keycloak#54193 Signed-off-by: Atiqur Rahman <rahman.atiqur.pro@gmail.com>
ae0aac6 to
0e4fcd8
Compare
|
Squashed into a single commit with DCO sign-off. The PR includes regression tests, documentation, and Admin UI changes; 79 CI checks have passed. The remaining Operator CI failure is a Ready-status assertion in |
Signed-off-by: Atiqur Rahman <rahman.atiqur.pro@gmail.com>
| return true; | ||
| } | ||
| return !Strings.isEmpty(serviceHost) && !Strings.isEmpty(servicePort) | ||
| && host.equalsIgnoreCase(serviceHost) |
There was a problem hiding this comment.
In addition to the copilot comments, I'm wondering about using a boolean vs the list approach in the issue - is the boolean too coarse? cc @slaskawi
And isn't there a regression risk for some - that needs called out more in a migration note.
Also should KubernetesIdentityProviderConfig.resolveIssuer be using isTrustedKubernetesEndpoint rather than just looking for DEFAULT_KUBERNETES_API_SERVER_URL?
Closes #54193
The Kubernetes IdP forwards its mounted service account token to JWKS endpoints when the token issuer matches the configured issuer. Public endpoints may reject these authenticated requests, causing workload login failures.
This change restricts runtime token forwarding to trusted in-cluster Kubernetes API endpoints by default. It adds
forwardTokenToAdditionalEndpoints, defaulting to false, with an Admin Console switch for endpoints that require authentication. Issuer matching remains required.The policy applies to JWKS requests and fallback discovery. Save-time discovery retains the behavior established in #50224.
Includes documentation and regression coverage for request headers, trusted endpoints, fallback discovery, issuer mismatches, and configuration defaults.
Validation: 38 focused tests passed; Spotless and whitespace checks passed.
cc @slaskawi