Skip to content

Commit 2b53ec9

Browse files
benashzbenashz
authored
Updates for the v0.20.0 release (#262)
- migrate from gopkg.in/go-jose/go-jose.v2 to github.com/go-jose/go-jose/v4 - apply other security related dependency updates - build with go 1.22.6
1 parent 1642172 commit 2b53ec9

File tree

7 files changed

+60
-38
lines changed

7 files changed

+60
-38
lines changed

‎.go-version‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.22.4
1+
1.22.6

‎CHANGELOG.md‎

Lines changed: 17 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,23 @@
11
## Unreleased
22

3-
### Changes
43

5-
* Building with go 1.22.4
6-
* Testing with k8s 1.26-1.30
7-
* Updated dependencies
8-
* `github.com/go-test/deep` v1.1.0 -> v1.1.1
9-
* `github.com/hashicorp/go-hclog` v1.6.2 -> v1.6.3
10-
* `github.com/hashicorp/vault/api` v1.12.2 -> v1.14.0
11-
* `github.com/hashicorp/vault/sdk` v0.11.1 -> v0.13.0
12-
* `k8s.io/api` v0.29.3 -> v0.30.3
13-
* `k8s.io/apimachinery` v0.29.3 -> v0.30.3
4+
## 0.19.0 (Sept 4, 2024)
5+
6+
### Build:
7+
* Build with go 1.22.6
8+
* Test with k8s versions 1.26-1.30
9+
* Migrate from gopkg.in/go-jose/go-jose.v2 to github.com/go-jose/go-jose/v4
10+
11+
12+
### Dependency updates:
13+
* `github.com/go-test/deep` v1.1.0 -> v1.1.1
14+
* `github.com/hashicorp/cap` v0.6.0 -> v0.7.0
15+
* `github.com/hashicorp/go-hclog` v1.6.2 -> v1.6.3
16+
* `github.com/hashicorp/vault/api` v1.12.2 -> v1.14.0
17+
* `github.com/hashicorp/vault/sdk` v0.11.1 -> v0.13.0
18+
* `k8s.io/api` v0.29.3 -> v0.31.0
19+
* `k8s.io/apimachinery` v0.29.3 -> v0.31.0
20+
1421

1522
## 0.19.0 (May 20, 2024)
1623

‎go.mod‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ go 1.22.0
55
toolchain go1.22.4
66

77
require (
8+
github.com/go-jose/go-jose/v4 v4.0.4
89
github.com/go-test/deep v1.1.1
910
github.com/hashicorp/cap v0.7.0
1011
github.com/hashicorp/go-cleanhttp v0.5.2
@@ -15,7 +16,6 @@ require (
1516
github.com/hashicorp/vault/api v1.14.0
1617
github.com/hashicorp/vault/sdk v0.13.0
1718
github.com/mitchellh/mapstructure v1.5.0
18-
gopkg.in/go-jose/go-jose.v2 v2.6.3
1919
k8s.io/api v0.31.0
2020
k8s.io/apimachinery v0.31.0
2121
)
@@ -36,7 +36,6 @@ require (
3636
github.com/felixge/httpsnoop v1.0.3 // indirect
3737
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
3838
github.com/go-jose/go-jose/v3 v3.0.3 // indirect
39-
github.com/go-jose/go-jose/v4 v4.0.4 // indirect
4039
github.com/go-logr/logr v1.4.2 // indirect
4140
github.com/go-logr/stdr v1.2.2 // indirect
4241
github.com/gogo/protobuf v1.3.2 // indirect
@@ -86,13 +85,13 @@ require (
8685
go.opentelemetry.io/otel/sdk v1.19.0 // indirect
8786
go.opentelemetry.io/otel/trace v1.19.0 // indirect
8887
go.uber.org/atomic v1.9.0 // indirect
89-
golang.org/x/crypto v0.25.0 // indirect
88+
golang.org/x/crypto v0.26.0 // indirect
9089
golang.org/x/mod v0.17.0 // indirect
9190
golang.org/x/net v0.27.0 // indirect
9291
golang.org/x/oauth2 v0.21.0 // indirect
93-
golang.org/x/sync v0.7.0 // indirect
94-
golang.org/x/sys v0.22.0 // indirect
95-
golang.org/x/text v0.16.0 // indirect
92+
golang.org/x/sync v0.8.0 // indirect
93+
golang.org/x/sys v0.23.0 // indirect
94+
golang.org/x/text v0.17.0 // indirect
9695
golang.org/x/time v0.3.0 // indirect
9796
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
9897
google.golang.org/genproto/googleapis/rpc v0.0.0-20231030173426-d783a09b4405 // indirect

‎go.sum‎

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -278,8 +278,8 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
278278
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
279279
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
280280
golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
281-
golang.org/x/crypto v0.25.0 h1:ypSNr+bnYL2YhwoMt2zPxHFmbAN1KZs/njMG3hxUp30=
282-
golang.org/x/crypto v0.25.0/go.mod h1:T+wALwcMOSE0kXgUAnPAHqTLW+XHgcELELW8VaDgm/M=
281+
golang.org/x/crypto v0.26.0 h1:RrRspgV4mU+YwB4FYnuBoKsUapNIL5cohGAmSH3azsw=
282+
golang.org/x/crypto v0.26.0/go.mod h1:GY7jblb9wI+FOo5y8/S2oY4zWP07AkOJ4+jxCqdqn54=
283283
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
284284
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
285285
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
@@ -307,8 +307,8 @@ golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJ
307307
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
308308
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
309309
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
310-
golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
311-
golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
310+
golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
311+
golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
312312
golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
313313
golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
314314
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -330,8 +330,8 @@ golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
330330
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
331331
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
332332
golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
333-
golang.org/x/sys v0.22.0 h1:RI27ohtqKCnwULzJLqkv897zojh5/DwS/ENaMzUOaWI=
334-
golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
333+
golang.org/x/sys v0.23.0 h1:YfKFowiIMvtgl1UERQoTPPToxltDeZfbj4H7dVUCwmM=
334+
golang.org/x/sys v0.23.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
335335
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
336336
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
337337
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
@@ -343,8 +343,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
343343
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
344344
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
345345
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
346-
golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
347-
golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
346+
golang.org/x/text v0.17.0 h1:XtiM5bkSOt+ewxlOE/aE/AKEHibwj/6gvWMl9Rsh0Qc=
347+
golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
348348
golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
349349
golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
350350
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -373,8 +373,6 @@ gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8
373373
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
374374
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
375375
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
376-
gopkg.in/go-jose/go-jose.v2 v2.6.3 h1:nt80fvSDlhKWQgSWyHyy5CfmlQr+asih51R8PTWNKKs=
377-
gopkg.in/go-jose/go-jose.v2 v2.6.3/go.mod h1:zzZDPkNNw/c9IE7Z9jr11mBZQhKQTMzoEEIoEdZlFBI=
378376
gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
379377
gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
380378
gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

‎integrationtest/vault/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# Copyright (c) HashiCorp, Inc.
22
# SPDX-License-Identifier: MPL-2.0
33

4-
FROM docker.mirror.hashicorp.services/hashicorp/vault:1.15.0
4+
FROM docker.mirror.hashicorp.services/hashicorp/vault:1.17.5
55

66
# Don't use `kubernetes` as plugin name to ensure we don't silently fall back to
77
# the built-in kubernetes auth plugin if something goes wrong.

‎path_login.go‎

Lines changed: 26 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,14 @@ import (
1010
"net/http"
1111
"strings"
1212

13+
"github.com/go-jose/go-jose/v4"
14+
josejwt "github.com/go-jose/go-jose/v4/jwt"
1315
capjwt "github.com/hashicorp/cap/jwt"
1416
"github.com/hashicorp/go-secure-stdlib/strutil"
1517
"github.com/hashicorp/vault/sdk/framework"
1618
"github.com/hashicorp/vault/sdk/helper/cidrutil"
1719
"github.com/hashicorp/vault/sdk/logical"
1820
"github.com/mitchellh/mapstructure"
19-
"gopkg.in/go-jose/go-jose.v2"
20-
josejwt "gopkg.in/go-jose/go-jose.v2/jwt"
2121
)
2222

2323
const (
@@ -37,10 +37,28 @@ var reservedAliasMetadataKeys = map[string]struct{}{
3737
// defaultJWTIssuer is used to verify the iss header on the JWT if the config doesn't specify an issuer.
3838
var defaultJWTIssuer = "kubernetes/serviceaccount"
3939

40-
// See https://datatracker.ietf.org/doc/html/rfc7518#section-3.
41-
var supportedJwtAlgs = []capjwt.Alg{
42-
capjwt.RS256, capjwt.RS384, capjwt.RS512,
43-
capjwt.ES256, capjwt.ES384, capjwt.ES512,
40+
var (
41+
// signing algorithms supported by k8s OIDC
42+
// ref: https://github.com/kubernetes/kubernetes/blob/b4935d910dcf256288694391ef675acfbdb8e7a3/staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/oidc.go#L222-L233
43+
allowedSigningAlgs = []jose.SignatureAlgorithm{
44+
jose.RS256,
45+
jose.RS384,
46+
jose.RS512,
47+
jose.ES256,
48+
jose.ES384,
49+
jose.ES512,
50+
jose.PS256,
51+
jose.PS384,
52+
jose.PS512,
53+
}
54+
// allowedSigningAlgsCap is initialized with the values from allowedSigningAlgs
55+
allowedSigningAlgsCap = make([]capjwt.Alg, len(allowedSigningAlgs))
56+
)
57+
58+
func init() {
59+
for idx := 0; idx < len(allowedSigningAlgs); idx++ {
60+
allowedSigningAlgsCap[idx] = capjwt.Alg(allowedSigningAlgs[idx])
61+
}
4462
}
4563

4664
// pathLogin returns the path configurations for login endpoints
@@ -302,7 +320,7 @@ func (b *kubeAuthBackend) aliasLookahead(ctx context.Context, req *logical.Reque
302320
type DontVerifySignature struct{}
303321

304322
func (keySet DontVerifySignature) VerifySignature(_ context.Context, token string) (map[string]interface{}, error) {
305-
parsed, err := josejwt.ParseSigned(token)
323+
parsed, err := josejwt.ParseSigned(token, allowedSigningAlgs)
306324
if err != nil {
307325
return nil, err
308326
}
@@ -319,7 +337,7 @@ func (b *kubeAuthBackend) parseAndValidateJWT(ctx context.Context, client *http.
319337
role *roleStorageEntry, config *kubeConfig,
320338
) (*serviceAccount, error) {
321339
expected := capjwt.Expected{
322-
SigningAlgorithms: supportedJwtAlgs,
340+
SigningAlgorithms: allowedSigningAlgsCap,
323341
}
324342

325343
// perform ISS Claim validation if configured

‎path_login_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ import (
2121
"testing"
2222
"time"
2323

24+
josejwt "github.com/go-jose/go-jose/v4/jwt"
2425
"github.com/hashicorp/go-uuid"
2526
"github.com/hashicorp/vault/sdk/helper/tokenutil"
2627
"github.com/hashicorp/vault/sdk/logical"
2728
"github.com/mitchellh/mapstructure"
28-
josejwt "gopkg.in/go-jose/go-jose.v2/jwt"
2929
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
3030
"k8s.io/apimachinery/pkg/types"
3131
)
@@ -1477,7 +1477,7 @@ func Test_kubeAuthBackend_getAliasName(t *testing.T) {
14771477
t.Fatal(err)
14781478
}
14791479

1480-
tok, err := josejwt.ParseSigned(s)
1480+
tok, err := josejwt.ParseSigned(s, allowedSigningAlgs)
14811481
if err != nil {
14821482
t.Fatal(err)
14831483
}

0 commit comments

Comments
 (0)