Repository navigation
fix: Require a signed token for intra-server communication - #7095
Open
patelchaitany wants to merge 1 commit into
Open
patelchaitany wants to merge 1 commit into
patelchaitany wants to merge 1 commit into
Conversation
Servers trusted any token whose preferred_username (OIDC) or sub (Kubernetes) claim matched INTRA_COMMUNICATION_BASE64, read from an unverified decode. The Helm chart hardcoded that value, so anyone could forge an unsigned token and skip every RBAC check. The client now signs the token with HS256 using the shared secret, and both token parsers verify that signature before trusting it. The Helm chart no longer ships a fixed value: it reads it from a Secret named by intraCommunicationSecret.name, and leaves server-to-server calls off when that is not set. Fixes feast-dev#6785 Signed-off-by: Chaitany Patel <[email protected]>
|
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #7095 +/- ##
==========================================
+ Coverage 50.97% 51.01% +0.03%
==========================================
Files 455 456 +1
Lines 56994 57011 +17
Branches 8321 8320 -1
==========================================
+ Hits 29055 29084 +29
+ Misses 25954 25942 -12
Partials 1985 1985
... and 1 file with indirect coverage changes Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
A Feast server trusted any token whose
preferred_username(OIDC) orsub(Kubernetes) claim matchedINTRA_COMMUNICATION_BASE64. The claim was read from an unverified decode, and thefeast-feature-serverHelm chart hardcoded the value tobase64("intra-server-communication"). So anyone who could reach the server could send an unsigned token with that value and skip every RBAC check, in every project.This PR fixes both halves:
HS256using the shared secret, instead ofalg=none. BothOidcTokenParserandKubernetesTokenParserverify that signature before trusting the token. An unsigned token, or one signed with another key, falls through to the normal auth path.INTRA_COMMUNICATION_BASE64now comes from an existing Secret named byintraCommunicationSecret.name. When that is empty (the default), the variable is not set and server-to-server calls are off.The shared sign/verify code lives in a small new module,
feast/permissions/auth/intra_comm.py, so the client and both parsers agree on the format.intraCommunicationSecret.name. Every Feast server that calls another must use the same Secret.INTRA_COMMUNICATION_BASE64, so operator deployments are not affected.Which issue(s) this PR fixes:
Fixes #6785
Checks
git commit -s)Testing Strategy
Unit test:
test_intra_comm_token_must_be_signed_with_shared_secret(OIDC and Kubernetes). A token from Feast's own client is trusted. The same claims unsigned, or signed with another key, are not. The test fails onmasterand passes here.pytest sdk/python/tests/unit/permissions: 331 passed.Manual: against
OidcTokenParserwithINTRA_COMMUNICATION_BASE64set to the old chart value, the forgedalg=nonetoken from the issue:AuthenticationErrorruff,mypyanddetect-secretspass on the changed files. Helm was not installed locally, so the chart change was not rendered withhelm template.