Use audience-scoped access token

[EronWright]

The operator transmits its own service account token to the workspace pod for authentication purposes. There is a risk of privilege elevation if the workspace pod were to capture the token and use it to impersonate the operator for arbitrary API Server interactions.

Kubernetes has a feature to prevent this: audience-scoped tokens. Rather than using the default token, the operator should call the TokenRequest API to get a token with a workspace-specific audience (e.g. the service endpoint). The token then has a specific workspace as its audience, and is useless for any other purpose. The TokenReview API validates such tokens as normal. On the agent side, one attaches the expected audience to the context when calling AuthenticateToken:

import "k8s.io/apiserver/pkg/authentication/authenticator"
...
ctx = authenticator.WithAudiences(ctx, []string{"http://my-audience"})
res, ok, err := a.authn.AuthenticateToken(ctx, token)

See also: https://adil.medium.com/how-to-use-tokenrequest-api-and-tokenvolume-projection-in-kubernetes-f007135b9994

[cleverguy25]

Added to epic #586

[EronWright]

A positive side-effect of this would be that, in a dev environment, there'll be no need to provision a long-lived service account token for the operator.

[EronWright]

An example token:

{
  "aud": [
    "random-yaml-workspace.default:50051"
  ],
  "exp": 1739306657,
  "iat": 1739303057,
  "iss": "https://kubernetes.default.svc.cluster.local",
  "jti": "190a47cf-8963-44b4-b77c-18ece58bc4af",
  "kubernetes.io": {
    "namespace": "pulumi-kubernetes-operator",
    "serviceaccount": {
      "name": "controller-manager",
      "uid": "f48ad504-695a-4775-ba52-d66cd7ffdbb8"
    }
  },
  "nbf": 1739303057,
  "sub": "system:serviceaccount:pulumi-kubernetes-operator:controller-manager"
}

The behavior when the audience is rejected by the agent:

random-yaml-workspace-0 pulumi 2025-02-11T19:47:42.125Z WARN    cmd.serve.grpc  authentication failed with an error{error 26 0  [invalid bearer token, token audiences ["random-yaml-workspace.default:50051"] is invalid for the target audiences ["https://kubernetes.default.svc.cluster.local"]]}
random-yaml-workspace-0 pulumi 2025-02-11T19:47:42.126Z INFO    cmd.serve.grpc  finished unary call with code Unauthenticated      {"grpc.start_time": "2025-02-11T19:47:42Z", "system": "grpc", "span.kind": "server", "grpc.service": "agent.AutomationService", "grpc.method": "SelectStack", "peer.address": "127.0.0.1:59352", "auth.mode": "kubernetes", "error": "rpc error: code = Unauthenticated desc = [invalid bearer token, token audiences [\"random-yaml-workspace.default:50051\"] is invalid for the target audiences [\"https://kubernetes.default.svc.cluster.local\"]]", "grpc.code": "Unauthenticated", "grpc.time_ms": 45.925}