Update jose v4 #248
Merged
Update jose v4 #248
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
vinay-gopalan
approved these changes
May 21, 2024
|
Sorry @benashz , i didn't see the review tag - if you want some more changes I can put them in before the release tag |
|
@vinay-gopalan @kpcraig - yes, I am fairly certain these changes will break depending on the K8s API server config. |
benashz
reviewed
May 21, 2024
| @@ -43,6 +43,12 @@ var supportedJwtAlgs = []capjwt.Alg{ | |||
| capjwt.ES256, capjwt.ES384, capjwt.ES512, | |||
| } | |||
|
|
|||
| var allowedSignatureAlgs = []jose.SignatureAlgorithm{ | |||
There was a problem hiding this comment.
It feels like we should support setting these from configuration.
| var allowedSignatureAlgs = []jose.SignatureAlgorithm{ | ||
| jose.RS256, | ||
| jose.ES256, | ||
| jose.HS256, |
There was a problem hiding this comment.
These don't seem to match what K8s supports, per: https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/#options:
--oidc-signing-algs strings Default: "RS256"
Comma-separated list of allowed JOSE asymmetric signing algorithms. JWTs with a supported 'alg' header values are: RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512. Values are defined by RFC 7518 https://tools.ietf.org/html/rfc7518#section-3.1.
Merged
kpcraig
added a commit
that referenced
this pull request
May 21, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a short PR to update the go-jose library to v4 to avoid possible issues with v2 support, copying hashicorp/vault-plugin-auth-gcp#203
It's possible v2.6.3 also fixes this issue (see https://github.com/go-jose/go-jose/releases/tag/v2.6.3), but this feels more future-proof (and the solution was readily available).