Add manual opt-in for legacy service account tokens

[kramaranya]

Fixes #336

[kramaranya]

@stlaz @ibihim could you please review this pr?

[ibihim]

The unit tests might not have been necessary, but fixing the e2e-tests would be crucial :)

You also need to regenerate the README.md with the make generate.

[ibihim]

/lgtm

[ibihim]

@kramaranya, I think we have an audience token test, right? we might be able to drop it, if we do not have any tests without audience set, right? Maybe we could have a negative test case then, that the server fails if it isn't set?

[stlaz]

Will legacy SA tokens be denied when the new flag is unset but audiences are set?
Will they be accepted if both are set?

Please add e2e tests for all possible scenarios, I don't think I've found legacy SA tokens creation in the e2e tests.

[kramaranya]

@kramaranya, I think we have an audience token test, right? we might be able to drop it, if we do not have any tests without audience set, right? Maybe we could have a negative test case then, that the server fails if it isn't set?

@ibihim If I understood you correctly, I've already added a negative test for this scenario (empty audiences when legacy tokens are not allowed) -- https://github.com/brancz/kube-rbac-proxy/pull/357/files#diff-770d985644314c26e2d1c0e8fb70e4714408a9888a4e2749a633144697201bacR191-R203

[stlaz]

We'll have to create the legacy SA token separately

[stlaz]

You're attempting to use a legacy token but the proxy does is not supposed to accept these in this case. This should fail.

[stlaz]

we don't need the options in this case, right?

[stlaz]

This is equal to it being nil, right?

[stlaz]

/var/run/secrets/tokens/requestedtoken does not actually house the legacy tokens. The below code appears to be creating such tokens:

kube-rbac-proxy/test/kubetest/kubernetes.go

Lines 524 to 544 in 670377f

	if opts != nil && opts.TokenAudience != "" {
	pod.Spec.Volumes = append(pod.Spec.Volumes, corev1.Volume{
	Name: "requestedtoken",
	VolumeSource: corev1.VolumeSource{
	Projected: &corev1.ProjectedVolumeSource{
	Sources: []corev1.VolumeProjection{{
	ServiceAccountToken: &corev1.ServiceAccountTokenProjection{
	Audience: opts.TokenAudience,
	Path: "requestedtoken",
	},
	}},
	},
	},
	})
	pod.Spec.Containers[0].VolumeMounts = append(pod.Spec.Containers[0].VolumeMounts,
	corev1.VolumeMount{
	Name: "requestedtoken",
	MountPath: "/var/run/secrets/tokens",
	},
	)
	}

We may actually want to rename the directory from /var/run/secrets/tokens to something else, like /var/run/projected/tokens, I personally find it a bit confusing.

You'll have to follow https://kubernetes.io/docs/concepts/configuration/secret/#serviceaccount-token-secrets to create a token secret along with your other manifests. Use a different directory than for the short-lived SA tokens so that we can distinguish these two in tests.

[stlaz]

I think this command should actually have /var/run/secrets/tokens/requestedtoken as an input for the token

[kramaranya]

The LegacyAllowedNoAudience test checks a scenario with no audience set. But /var/run/secrets/tokens/requestedtoken sets an audience, so it wouldn't match our no-audience case.

kube-rbac-proxy/test/kubetest/kubernetes.go

Lines 524 to 532 in 670377f

	if opts != nil && opts.TokenAudience != "" {
	pod.Spec.Volumes = append(pod.Spec.Volumes, corev1.Volume{
	Name: "requestedtoken",
	VolumeSource: corev1.VolumeSource{
	Projected: &corev1.ProjectedVolumeSource{
	Sources: []corev1.VolumeProjection{{
	ServiceAccountToken: &corev1.ServiceAccountTokenProjection{
	Audience: opts.TokenAudience,
	Path: "requestedtoken",

That's why I use the default token /var/run/secrets/kubernetes.io/serviceaccount/token instead.