Authenticate requests from PingSources

config/core/roles/pingsource-mt-adapter-clusterrole.yaml

@@ -28,6 +28,12 @@ rules:
       - "get"
       - "list"
       - "watch"
+  - apiGroups:
+      - ""
+    resources:
+      - "serviceaccounts/token"
+    verbs:
+      - "create"
   - apiGroups:
       - sources.knative.dev
     resources:

pkg/adapter/mtping/runner.go

@@ -195,6 +195,11 @@ func (a *cronJobsRunner) newPingSourceClient(source *sourcesv1.PingSource) (adap
 			Namespace:      source.GetNamespace(),
 			Name:           a.clientConfig.Env.GetName(),
 			EnvSinkTimeout: fmt.Sprintf("%d", a.clientConfig.Env.GetSinktimeout()),
+			Audience:       source.Status.SinkAudience,
+		}
+
+		if source.Status.Auth != nil {
+			env.OIDCServiceAccountName = source.Status.Auth.ServiceAccountName
 		}
 	}
 
@@ -215,6 +220,7 @@ func (a *cronJobsRunner) newPingSourceClient(source *sourcesv1.PingSource) (adap
 		CrStatusEventClient:        a.clientConfig.CrStatusEventClient,
 		Options:                    a.clientConfig.Options,
 		TrustBundleConfigMapLister: a.clientConfig.TrustBundleConfigMapLister,
+		TokenProvider:              a.clientConfig.TokenProvider,
 	}
 
 	return adapter.NewClient(cfg)

pkg/reconciler/pingsource/pingsource_test.go

@@ -87,6 +87,20 @@ var (
 		Name: &sinkURL.Scheme,
 		URL:  sinkURL,
 	}
+	sinkAudience        = "sink-oidc-audience"
+	sinkOIDCAddressable = &duckv1.Addressable{
+		Name:     &sinkURL.Scheme,
+		URL:      sinkURL,
+		Audience: &sinkAudience,
+	}
+	sinkOIDCDest = duckv1.Destination{
+		Ref: &duckv1.KReference{
+			Name:       sinkName,
+			Kind:       "Channel",
+			APIVersion: "messaging.knative.dev/v1",
+		},
+		Audience: &sinkAudience,
+	}
 )
 
 const (
@@ -518,15 +532,15 @@ func TestAllCases(t *testing.T) {
 						ContentType: testContentType,
 						Data:        testData,
 						SourceSpec: duckv1.SourceSpec{
-							Sink: sinkDest,
+							Sink: sinkOIDCDest,
 						},
 					}),
 					rtv1.WithPingSource(sourceUID),
 					rtv1.WithPingSourceObjectMetaGeneration(generation),
 				),
 				rtv1.NewChannel(sinkName, testNS,
 					rtv1.WithInitChannelConditions,
-					rtv1.WithChannelAddress(sinkAddressable),
+					rtv1.WithChannelAddress(sinkOIDCAddressable),
 				),
 				makeAvailableMTAdapter(),
 			},
@@ -538,15 +552,15 @@ func TestAllCases(t *testing.T) {
 						ContentType: testContentType,
 						Data:        testData,
 						SourceSpec: duckv1.SourceSpec{
-							Sink: sinkDest,
+							Sink: sinkOIDCDest,
 						},
 					}),
 					rtv1.WithPingSource(sourceUID),
 					rtv1.WithPingSourceObjectMetaGeneration(generation),
 					// Status Update:
 					rtv1.WithInitPingSourceConditions,
 					rtv1.WithPingSourceDeployed,
-					rtv1.WithPingSourceSink(sinkAddressable),
+					rtv1.WithPingSourceSink(sinkOIDCAddressable),
 					rtv1.WithPingSourceCloudEventAttributes,
 					rtv1.WithPingSourceStatusObservedGeneration(generation),
 					rtv1.WithPingSourceOIDCIdentityCreatedSucceeded(),

test/auth/features/oidc/pingsource.go

@@ -0,0 +1,51 @@
+/*
+Copyright 2021 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package oidc
+
+import (
+	"github.com/cloudevents/sdk-go/v2/test"
+	"knative.dev/eventing/test/rekt/resources/pingsource"
+	duckv1 "knative.dev/pkg/apis/duck/v1"
+	"knative.dev/reconciler-test/pkg/eventshub"
+	"knative.dev/reconciler-test/pkg/eventshub/assert"
+	"knative.dev/reconciler-test/pkg/feature"
+	"knative.dev/reconciler-test/pkg/resources/service"
+)
+
+func PingSourceSendEventWithSinkRefOIDC() *feature.Feature {
+	source := feature.MakeRandomK8sName("pingsource")
+	sink := feature.MakeRandomK8sName("sink")
+	sinkAudience := "audience"
+	f := feature.NewFeature()
+
+	f.Setup("install sink", eventshub.Install(sink,
+		eventshub.OIDCReceiverAudience(sinkAudience),
+		eventshub.StartReceiver))
+
+	f.Requirement("install pingsource",
+		pingsource.Install(source, pingsource.WithSink(&duckv1.Destination{
+			Ref:      service.AsKReference(sink),
+			Audience: &sinkAudience,
+		})))
+	f.Requirement("pingsource goes ready", pingsource.IsReady(source))
+
+	f.Stable("pingsource as event source").
+		Must("delivers events",
+			assert.OnStore(sink).MatchEvent(test.HasType("dev.knative.sources.ping")).AtLeast(1))
+
+	return f
+}

test/auth/oidc_test.go

@@ -173,6 +173,19 @@ func TestContainerSourceSendsEventsWithOIDCSupport(t *testing.T) {
 	env.Test(ctx, t, oidc.SendsEventsWithSinkRefOIDC())
 }
 
+func TestPingSourceSendsEventsWithOIDC(t *testing.T) {
+	t.Parallel()
+
+	ctx, env := global.Environment(
+		knative.WithKnativeNamespace(system.Namespace()),
+		knative.WithLoggingConfig,
+		knative.WithTracingConfig,
+		k8s.WithEventListener,
+		environment.Managed(t),
+	)
+
+	env.Test(ctx, t, oidc.PingSourceSendEventWithSinkRefOIDC())
+}
 func TestSequenceSendsEventsWithOIDCSupport(t *testing.T) {
 	t.Parallel()
 

test/rekt/resources/pingsource/pingsource.go

@@ -73,7 +73,9 @@ func WithSink(dest *duckv1.Destination) manifest.CfgFn {
 			// Replace "new line" with "new line + spaces".
 			sink["CACerts"] = strings.ReplaceAll(*dest.CACerts, "\n", "\n      ")
 		}
-
+		if dest.Audience != nil {
+			sink["audience"] = *dest.Audience
+		}
 		if uri != nil {
 			sink["uri"] = uri.String()
 		}
@@ -89,6 +91,7 @@ func WithSink(dest *duckv1.Destination) manifest.CfgFn {
 			}
 			sref["name"] = ref.Name
 		}
+
 	}
 }
 

test/rekt/resources/pingsource/pingsource.yaml

@@ -50,4 +50,7 @@ spec:
     CACerts: |-
       {{ .sink.CACerts }}
     {{ end }}
+    {{if .sink.audience }}
+    audience: {{ .sink.audience}}
+    {{ end }}
   {{ end }}