Change:
Semantics are going to vary. We need to cross off these authenticators: [x] if ctx has an audience limitation, verify the token audience and echo in the response [x] take implicit audiences at WebhookTokenAuthenticator construction time if ctx is audience-limited, add into the tokenreview object if the tokenreview returns with an audience set that matches the ctx, copy into the response and return success if the tokenreview returns without an audience set, ensure the ctx audiences intersect with the implicit audiences taken at WebhookTokenAuthenticator construction time, and pick one to add into the response [x] echo audience in response if present in ctx [x] echo audience in response if present in ctx [x] check that the the order of (audience in the context) ∩ ( (implicit api audiences) ∪ (clientids) ) 0 Take implicit audiences at Authenticator construction time, and if ctx is audience-limited, ensure it intersects with the implicit audiences, and echo an audience in the response. [x] [x] [x] [x] [x] [x] Do nothing? [x] [x] [x] [x] [x] [x] [x] note: we already keyed the cache with the audience. [x]
There are no sig labels on this issue. Please add a sig label by either: a sig: e.g., to notify the contributor experience sig, OR the label manually: e.g., to apply the label Note: Method 1 will trigger an email to the group. See the . The in method 1 has to be replaced with one of these: bugs, feature-requests, pr-reviews, test-failures, proposals. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/close
Closing this issue. <detailsIn response to : /close Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details

Discussion:
deps = [ "//staging/src/k8s.io/apiserver/pkg/authentication/authenticator:go_default_library", "//staging/src/k8s.io/apiserver/pkg/authentication/user:go_default_library", <ins> "//staging/src/k8s.io/apiserver/pkg/endpoints/request:go_default_library", </ins> ], )

"k8s.io/apiserver/pkg/authentication/authenticator" "k8s.io/apiserver/pkg/authentication/user" <ins> "k8s.io/apiserver/pkg/endpoints/request" </ins> ) const (

func NewAuthenticator() authenticator.Request { return authenticator.RequestFunc(func(req *http.Request) (*authenticator.Response, bool, error) { <ins> auds, _ := request.AudiencesFrom(req.Context()) </ins> return &authenticator.Response{ User: &user.DefaultInfo{ Name:   anonymousUser, Groups: []string{unauthenticatedGroup}, }, <ins> Audiences: auds, </ins> }, true, nil }) }

package anonymous import ( <ins> "net/http" </ins> "testing" "k8s.io/apimachinery/pkg/util/sets"

func TestAnonymous(t *testing.T) { var a authenticator.Request = NewAuthenticator() <del> r, ok, err := a.AuthenticateRequest(nil) </del> <ins> r, ok, err := a.AuthenticateRequest(&http.Request{}) </ins> if err != nil { t.Fatalf("Unexpected error %v", err) }

"k8s.io/apiserver/pkg/authentication/authenticator" "k8s.io/apiserver/pkg/authentication/user" <ins> "k8s.io/apiserver/pkg/endpoints/request" </ins> "k8s.io/client-go/rest" )

type InsecureSuperuser struct{} func (InsecureSuperuser) AuthenticateRequest(req *http.Request) (*authenticator.Response, bool, error) { <ins> auds, _ := request.AudiencesFrom(req.Context()) </ins> return &authenticator.Response{ User: &user.DefaultInfo{ Name:   "system:unsecured", Groups: []string{user.SystemPrivilegedGroup, user.AllAuthenticated}, }, <ins> Audiences: auds, </ins> }, true, nil }