Problem
Currently, event delivery within the cluster is unprotected, and every client can post events to any addressable. This limits the types of events which can be transmitted to those of low compliance value (or a relaxed compliance posture).
Knative Brokers and Channels should provide "OIDC protected" endpoints (with TLS) to receive events.
This means that each Broker/Channel would have a unique audience parameter, and the event sending client would need to get an OAuth token specific to that Broker to send events to the Broker. OAuth tokens specify an "audience" which should be unique based on the destination.
Persona:
This feature enables Developers to comply with Administrator policies (ideally, without additional work on the Developer's part).
Exit Criteria
A container with a SourceBinding can emit an event to a protected Broker.
Time Estimate (optional):
Large
Additional context (optional)
Feel free to coordinate with Security-WG on the design. (This will certainly need a Feature Track)
Problem
Currently, event delivery within the cluster is unprotected, and every client can post events to any addressable. This limits the types of events which can be transmitted to those of low compliance value (or a relaxed compliance posture).
Knative Brokers and Channels should provide "OIDC protected" endpoints (with TLS) to receive events.
This means that each Broker/Channel would have a unique audience parameter, and the event sending client would need to get an OAuth token specific to that Broker to send events to the Broker. OAuth tokens specify an "audience" which should be unique based on the destination.
Persona:
This feature enables Developers to comply with Administrator policies (ideally, without additional work on the Developer's part).
Exit Criteria
A container with a SourceBinding can emit an event to a protected Broker.
Time Estimate (optional):
Large
Additional context (optional)
Feel free to coordinate with Security-WG on the design. (This will certainly need a Feature Track)