Draft: feat(translation): expand sources of JWKS required to validate JWTs

[sgargan]

Currently only HTTPS endpoints are supported via remoteJWKS field of the JWTProvider. This is deprecated in favour of a jwksSource field that expands the available locations JWKS content can be retrieved from. Sources include an inline string in the source resource, a local file in the Gateway Container or from a Configmap/Secret.

This is a draft of the proposed JWKSource structure for discussion ahead of implentation.

Fixes #2419

[arkodg]

I like the jwks.Type idea !
we have been meaning to also add a backendRefs field to remoteJwks so upstream connection/traffic parameters can be controlled, relates to #3536

so the 2 options here are

1. Represent backendRefs as a Type
2. Keep the remoteJwks field, and add a new one localJwks to support the inline and valueRef cases

cc @envoyproxy/gateway-maintainers

[zhaohuabing]

+1 for 2 as the structure is more straightfoward and less levels. It's a bit messy to add BackendCluster, URL, inline, and valueRef in a single structure.

      remoteJWKS:
        backendRefs:
        - group: gateway.envoyproxy.io
          kind: Backend
          name: backend-fqdn
          port: 443
        backendSettings:
          retry:
            numRetries: 3
            perRetry:
              backOff:
                baseInterval: 1s
                maxInterval: 5s
            retryOn:
              triggers: ["5xx", "gateway-error", "reset"]
      localJWKS:
        type: inline
        vaule: xxxxxxx

    jwksSource:
      type: BackendCluster
      backendCluster:
        backendRefs:
        - group: gateway.envoyproxy.io
          kind: Backend
          name: backend-fqdn
          port: 443
        backendSettings:
          retry:
            numRetries: 3
            perRetry:
              backOff:
                baseInterval: 1s
                maxInterval: 5s
            retryOn:
              triggers: ["5xx", "gateway-error", "reset"]

[guydc]

+1 for 2

[arkodg]

thanks for sharing your thoughts folks, lets go with 2.

[zhaohuabing]

@sgargan link error:

Error: ./api/v1alpha1/jwt_types.go:28: specfied ==> specified

[zhaohuabing]

Hi @sgargan, I wanted to check in and see if you’re planning to continue working on this?

[sgargan]

I am, I've just been caught up with other deadlines, hoping to get back to it next week.

…

On Wed, Dec 11, 2024 at 4:52 AM Huabing Zhao ***@***.***> wrote: Hi @sgargan <https://github.com/sgargan>, I wanted to check in and see if you’re planning to continue working on this? — Reply to this email directly, view it on GitHub <#4684 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAA7RYPNKRQTIVQVR5B2XUT2E7AHNAVCNFSM6AAAAABRNXKM3GVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKMZTGYZDQMBVHE> . You are receiving this because you were mentioned.Message ID: ***@***.***>