Description

This pull request enables Workload Identity for Azure provider.

Instead of client_secret, the token exchange request includes a certificate credential parameters. Certificate credential is a JWT token, which claims has to match a corresponding Federated Identity Credential added to the App Registration.

Azure Workload Identity Webhook Server running on the Kubernetes cluster, mutates the properly annotated pod and mounts the federated token in the default path stored in $AZURE_FEDERATED_TOKEN_FILE. Webhook server can be installed easily on AKS as well as elsewhere. See documentation of Azure Workload Identity.

New flag is added: - --azure-federated-token-auth-enabled. When set, oauth2-proxy does not require the client-secret setting anymore. Instead, it expects oauth2-proxy to run in a pod mutated by Azure Workload Identity Webhook Server. oauth2-proxy won't start if the flag is enabled but pod isn't properly configured.

This change allows user to not store plain secrets on Kubernetes / GitOps repositories.

This is a revisited version of #2070, however this PR does include only the certificate credential changes and does not include any changes regarding reading user groups.

Motivation and Context

Currently, oauth2-proxy needs to have hardcoded secret configured, which causes security issues and requires maintenance like secret rotation. This PR closes #1979 .

How Has This Been Tested?

This was tested on on-premises cluster with Azure's workload-identity-webhook helm chart installed. Cluster has OIDC endpoint publicly available. App registration used for testing:

resource "azuread_application" "auth" {
  display_name = "oauth2-proxy"

  web {
    redirect_uris = [
      "https://myapp.domain.com/oauth2/callback",
    ]
  }

  required_resource_access {
    resource_app_id = "00000003-0000-0000-c000-000000000000" # Microsoft Graph
    resource_access {
      id   = "e1fe6dd8-ba31-4d61-89e7-88639da4683d" # User.Read
      type = "Scope"
    }
  }
}
resource "azuread_application_federated_identity_credential" "oauth2-proxy" {
  application_id = azuread_application.auth.id
  display_name   = "oauth2-proxy"
  description    = "oauth2-proxy"
  audiences      = ["api://AzureADTokenExchange"]
  issuer         = "https://mycluster.oidc-endpoint.com"
  subject        = "system:serviceaccount:oauth2-proxy:oauth2-proxy"
}

Values for oauth2-proxy helm chart (installed in oauth2-proxy namespace):

serviceAccount:
  annotations:
    azure.workload.identity/client-id: 5b2583ce-9789-4fd2-970c-2cf711b648ed

podLabels:
  azure.workload.identity/use: "true"

extraArgs:
  - --provider=azure
  - --client-id=<my-client-id>
  - --azure-federated-token-auth-enabled
  - --oidc-issuer-url=<my-tenant-id>
  - --upstream=static://202
  - --reverse-proxy=true

Traefik middleware:

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: entra
  namespace: oauth2-proxy
spec:
  forwardAuth:
    address: http://oauth2-proxy.oauth2-proxy

And ingress annotation for protected service:

traefik.ingress.kubernetes.io/router.middlewares: oauth2-proxy-entra@kubernetescrd

TODO:

• My change requires a change to the documentation or CHANGELOG.
• I have updated the documentation/CHANGELOG accordingly.
• I have created a feature (non-master) branch for my PR.
• I have written tests for my code changes.
• Code climate