Repository: knative/eventing (Go)

Issue:
Add fields for subscribers & replies audience to `SubscriberSpec` and `SubscriptionStatusPhysicalSubscription`
In the Subscription, we need to provide the Audiences of the Subscriber and Reply. 

In particular we should:
* Add `SubscriberAudience` and `ReplyAudience` to `SubscriberSpec` and `SubscriptionStatusPhysicalSubscription`
* Update Subscription reconciler to set these fields

Hint: In #6959 we did something similar for the `SubscriberCACerts` and `ReplyCACerts` fields in the TLS context.



Fix (patch):
diff --git a/config/channels/in-memory-channel/resources/in-memory-channel.yaml b/config/channels/in-memory-channel/resources/in-memory-channel.yaml
index 501ec36f55e..ec2f1db05b0 100644
--- a/config/channels/in-memory-channel/resources/in-memory-channel.yaml
+++ b/config/channels/in-memory-channel/resources/in-memory-channel.yaml
@@ -142,12 +142,18 @@ spec:
                     replyCACerts:
                       description: Certification Authority (CA) certificates in PEM format according to https://www.rfc-editor.org/rfc/rfc7468.
                       type: string
+                    replyAudience:
+                      description: ReplyAudience is the OIDC audience for the replyUri.
+                      type: string
                     subscriberUri:
                       description: SubscriberURI is the endpoint for the subscriber
                       type: string
                     subscriberCACerts:
                       description: Certification Authority (CA) certificates in PEM format according to https://www.rfc-editor.org/rfc/rfc7468.
                       type: string
+                    subscriberAudience:
+                      description: SubscriberAudience is the OIDC audience for the subscriberUri.
+                      type: string
                     uid:
                       description: UID is used to understand the origin of the subscriber.
                       type: string
diff --git a/config/core/resources/channel.yaml b/config/core/resources/channel.yaml
index 1d24e077802..1b8b4fc2c50 100644
--- a/config/core/resources/channel.yaml
+++ b/config/core/resources/channel.yaml
@@ -164,12 +164,18 @@ spec:
                     replyCACerts:
                       description: Certification Authority (CA) certificates in PEM format according to https://www.rfc-editor.org/rfc/rfc7468.
                       type: string
+                    replyAudience:
+                      description: ReplyAudience is the OIDC audience for the replyUri.
+                      type: string
                     subscriberUri:
                       description: SubscriberURI is the endpoint for the subscriber
                       type: string
                     subscriberCACerts:
                       description: Certification Authority (CA) certificates in PEM format according to https://www.rfc-editor.org/rfc/rfc7468.
                       type: string
+                    subscriberAudience:
+                      description: SubscriberAudience is the OIDC audience for the subscriberUri.
+                      type: string
                     uid:
                       description: UID is used to understand the origin of the subscriber.
                       type: string
diff --git a/config/core/resources/subscription.yaml b/config/core/resources/subscription.yaml
index e3ab66007ca..cdcb5c80eb9 100644
--- a/config/core/resources/subscription.yaml
+++ b/config/core/resources/subscription.yaml
@@ -197,12 +197,18 @@ spec:
                   replyCACerts:
                     description: Certification Authority (CA) certificates in PEM format according to https://www.rfc-editor.org/rfc/rfc7468.
                     type: string
+                  replyAudience:
+                    description: ReplyAudience is the OIDC audience for the replyUri.
+                    type: string
                   subscriberUri:
                     description: SubscriberURI is the fully resolved URI for spec.subscriber.
                     type: string
                   subscriberCACerts:
                     description: Certification Authority (CA) certificates in PEM format according to https://www.rfc-editor.org/rfc/rfc7468.
                     type: string
+                  subscriberAudience:
+                    description: SubscriberAudience is the OIDC audience for the subscriberUri.
+                    type: string
     additionalPrinterColumns:
     - name: Age
       type: date
diff --git a/docs/eventing-api.md b/docs/eventing-api.md
index 3fce2371620..60277e09ada 100644
--- a/docs/eventing-api.md
+++ b/docs/eventing-api.md
@@ -664,6 +664,18 @@ subscriberUri</p>
 </tr>
 <tr>
 <td>
+<code>subscriberAudience</code><br/>
+<em>
+string
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>SubscriberAudience is the OIDC audience for the subscriberUri.</p>
+</td>
+</tr>
+<tr>
+<td>
 <code>replyUri</code><br/>
 <em>
 <a href="https://pkg.go.dev/knative.dev/pkg/apis#URL">
@@ -692,6 +704,18 @@ replyUri.</p>
 </tr>
 <tr>
 <td>
+<code>replyAudience</code><br/>
+<em>
+string
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>ReplyAudience is the OIDC audience for the replyUri.</p>
+</td>
+</tr>
+<tr>
+<td>
 <code>delivery</code><br/>
 <em>
 <a href="#duck.knative.dev/v1.DeliverySpec">
@@ -4639,6 +4663,19 @@ resolved URI for spec.subscriber.</p>
 </tr>
 <tr>
 <td>
+<code>subscriberAudience</code><br/>
+<em>
+string
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>SubscriberAudience is the OIDC audience for the the resolved URI for
+spec.subscriber.</p>
+</td>
+</tr>
+<tr>
+<td>
 <code>replyUri</code><br/>
 <em>
 <a href="https://pkg.go.dev/knative.dev/pkg/apis#URL">
@@ -4667,6 +4704,19 @@ resolved URI for the spec.reply.</p>
 </tr>
 <tr>
 <td>
+<code>replyAudience</code><br/>
+<em>
+string
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>ReplyAudience is the OIDC audience for the the resolved URI for
+spec.reply.</p>
+</td>
+</tr>
+<tr>
+<td>
 <code>DeliveryStatus</code><br/>
 <em>
 <a href="#duck.knative.dev/v1.DeliveryStatus">
diff --git a/pkg/apis/duck/v1/subscribable_types.go b/pkg/apis/duck/v1/subscribable_types.go
index 4d95248ff3f..9464c857fb3 100644
--- a/pkg/apis/duck/v1/subscribable_types.go
+++ b/pkg/apis/duck/v1/subscribable_types.go
@@ -47,6 +47,9 @@ type SubscriberSpec struct {
 	// subscriberUri
 	// +optional
 	SubscriberCACerts *string `json:"subscriberCACerts,omitempty"`
+	// SubscriberAudience is the OIDC audience for the subscriberUri.
+	// +optional
+	SubscriberAudience *string `json:"subscriberAudience,omitempty"`
 	// ReplyURI is the endpoint for the reply
 	// +optional
 	ReplyURI *apis.URL `json:"replyUri,omitempty"`
@@ -55,6 +58,9 @@ type SubscriberSpec struct {
 	// replyUri.
 	// +optional
 	ReplyCACerts *string `json:"replyCACerts,omitempty"`
+	// ReplyAudience is the OIDC audience for the replyUri.
+	// +optional
+	ReplyAudience *string `json:"replyAudience,omitempty"`
 	// +optional
 	// DeliverySpec contains options controlling the event delivery
 	// +optional
diff --git a/pkg/apis/duck/v1/zz_generated.deepcopy.go b/pkg/apis/duck/v1/zz_generated.deepcopy.go
index 5dd4986c749..8448a41de3e 100644
--- a/pkg/apis/duck/v1/zz_generated.deepcopy.go
+++ b/pkg/apis/duck/v1/zz_generated.deepcopy.go
@@ -320,6 +320,11 @@ func (in *SubscriberSpec) DeepCopyInto(out *SubscriberSpec) {
 		*out = new(string)
 		**out = **in
 	}
+	if in.SubscriberAudience != nil {
+		in, out := &in.SubscriberAudience, &out.SubscriberAudience
+		*out = new(string)
+		**out = **in
+	}
 	if in.ReplyURI != nil {
 		in, out := &in.ReplyURI, &out.ReplyURI
 		*out = new(apis.URL)
@@ -330,6 +335,11 @@ func (in *SubscriberSpec) DeepCopyInto(out *SubscriberSpec) {
 		*out = new(string)
 		**out = **in
 	}
+	if in.ReplyAudience != nil {
+		in, out := &in.ReplyAudience, &out.ReplyAudience
+		*out = new(string)
+		**out = **in
+	}
 	if in.Delivery != nil {
 		in, out := &in.Delivery, &out.Delivery
 		*out = new(DeliverySpec)
diff --git a/pkg/apis/messaging/v1/subscription_types.go b/pkg/apis/messaging/v1/subscription_types.go
index 8f1c8e10831..affea2b2dd7 100644
--- a/pkg/apis/messaging/v1/subscription_types.go
+++ b/pkg/apis/messaging/v1/subscription_types.go
@@ -129,6 +129,11 @@ type SubscriptionStatusPhysicalSubscription struct {
 	// +optional
 	SubscriberCACerts *string `json:"subscriberCACerts,omitempty"`
 
+	// SubscriberAudience is the OIDC audience for the the resolved URI for
+	// spec.subscriber.
+	// +optional
+	SubscriberAudience *string `json:"subscriberAudience,omitempty"`
+
 	// ReplyURI is the fully resolved URI for the spec.reply.
 	// +optional
 	ReplyURI *apis.URL `json:"replyUri,omitempty"`
@@ -139,6 +144,11 @@ type SubscriptionStatusPhysicalSubscription struct {
 	// +optional
 	ReplyCACerts *string `json:"replyCACerts,omitempty"`
 
+	// ReplyAudience is the OIDC audience for the the resolved URI for
+	// spec.reply.
+	// +optional
+	ReplyAudience *string `json:"replyAudience,omitempty"`
+
 	// DeliveryStatus contains a resolved URL to the dead letter sink address, and any other
 	// resolved delivery options.
 	eventingduckv1.DeliveryStatus `json:",inline"`
diff --git a/pkg/apis/messaging/v1/zz_generated.deepcopy.go b/pkg/apis/messaging/v1/zz_generated.deepcopy.go
index a400fd2e3c8..e3a52d1b8c9 100644
--- a/pkg/apis/messaging/v1/zz_generated.deepcopy.go
+++ b/pkg/apis/messaging/v1/zz_generated.deepcopy.go
@@ -382,6 +382,11 @@ func (in *SubscriptionStatusPhysicalSubscription) DeepCopyInto(out *Subscription
 		*out = new(string)
 		**out = **in
 	}
+	if in.SubscriberAudience != nil {
+		in, out := &in.SubscriberAudience, &out.SubscriberAudience
+		*out = new(string)
+		**out = **in
+	}
 	if in.ReplyURI != nil {
 		in, out := &in.ReplyURI, &out.ReplyURI
 		*out = new(apis.URL)
@@ -392,6 +397,11 @@ func (in *SubscriptionStatusPhysicalSubscription) DeepCopyInto(out *Subscription
 		*out = new(string)
 		**out = **in
 	}
+	if in.ReplyAudience != nil {
+		in, out := &in.ReplyAudience, &out.ReplyAudience
+		*out = new(string)
+		**out = **in
+	}
 	in.DeliveryStatus.DeepCopyInto(&out.DeliveryStatus)
 	return
 }
diff --git a/pkg/reconciler/subscription/subscription.go b/pkg/reconciler/subscription/subscription.go
index 84d1ec51a82..017b472ad12 100644
--- a/pkg/reconciler/subscription/subscription.go
+++ b/pkg/reconciler/subscription/subscription.go
@@ -230,9 +230,11 @@ func (r *Reconciler) resolveSubscriber(ctx context.Context, subscription *v1.Sub
 		logging.FromContext(ctx).Debugw("Resolved Subscriber", zap.Any("subscriber", subscriberAddr))
 		subscription.Status.PhysicalSubscription.SubscriberURI = subscriberAddr.URL
 		subscription.Status.PhysicalSubscription.SubscriberCACerts = subscriberAddr.CACerts
+		subscription.Status.PhysicalSubscription.SubscriberAudience = subscriberAddr.Audience
 	} else {
 		subscription.Status.PhysicalSubscription.SubscriberURI = nil
 		subscription.Status.PhysicalSubscription.SubscriberCACerts = nil
+		subscription.Status.PhysicalSubscription.SubscriberAudience = nil
 	}
 	return nil
 }
@@ -259,9 +261,11 @@ func (r *Reconciler) resolveReply(ctx context.Context, subscription *v1.Subscrip
 		logging.FromContext(ctx).Debugw("Resolved reply", zap.Any("reply", replyAddr))
 		subscription.Status.PhysicalSubscription.ReplyURI = replyAddr.URL
 		subscription.Status.PhysicalSubscription.ReplyCACerts = replyAddr.CACerts
+		subscription.Status.PhysicalSubscription.ReplyAudience = replyAddr.Audience
 	} else {
 		subscription.Status.PhysicalSubscription.ReplyURI = nil
 		subscription.Status.PhysicalSubscription.ReplyCACerts = nil
+		subscription.Status.PhysicalSubscription.ReplyAudience = nil
 	}
 	return nil
 }
@@ -492,21 +496,25 @@ func (r *Reconciler) updateChannelAddSubscription(channel *eventingduckv1.Channe
 			channel.Spec.Subscribers[i].Generation = sub.Generation
 			channel.Spec.Subscribers[i].SubscriberURI = sub.Status.PhysicalSubscription.SubscriberURI
 			channel.Spec.Subscribers[i].SubscriberCACerts = sub.Status.PhysicalSubscription.SubscriberCACerts
+			channel.Spec.Subscribers[i].SubscriberAudience = sub.Status.PhysicalSubscription.SubscriberAudience
 			channel.Spec.Subscribers[i].ReplyURI = sub.Status.PhysicalSubscription.ReplyURI
 			channel.Spec.Subscribers[i].ReplyCACerts = sub.Status.PhysicalSubscription.ReplyCACerts
+			channel.Spec.Subscribers[i].ReplyAudience = sub.Status.PhysicalSubscription.ReplyAudience
 			channel.Spec.Subscribers[i].Delivery = deliverySpec(sub, channel)
 			return
 		}
 	}
 
 	toAdd := eventingduckv1.SubscriberSpec{
-		UID:               sub.UID,
-		Generation:        sub.Generation,
-		SubscriberURI:     sub.Status.PhysicalSubscription.SubscriberURI,
-		SubscriberCACerts: sub.Status.PhysicalSubscription.SubscriberCACerts,
-		ReplyURI:          sub.Status.PhysicalSubscription.ReplyURI,
-		ReplyCACerts:      sub.Status.PhysicalSubscription.ReplyCACerts,
-		Delivery:          deliverySpec(sub, channel),
+		UID:                sub.UID,
+		Generation:         sub.Generation,
+		SubscriberURI:      sub.Status.PhysicalSubscription.SubscriberURI,
+		SubscriberCACerts:  sub.Status.PhysicalSubscription.SubscriberCACerts,
+		SubscriberAudience: sub.Status.PhysicalSubscription.SubscriberAudience,
+		ReplyURI:           sub.Status.PhysicalSubscription.ReplyURI,
+		ReplyCACerts:       sub.Status.PhysicalSubscription.ReplyCACerts,
+		ReplyAudience:      sub.Status.PhysicalSubscription.ReplyAudience,
+		Delivery:           deliverySpec(sub, channel),
 	}
 
 	// Must not have been found. Add it.