Support built-in function authentication with OpenFaaS IAM.

[welteki]

Description

Add support for built-in function authentication with OpenFaaS IAM to the go-sdk.

To prevent a breaking change by changing the client constructor function signature a new constructor function NewClientWithOpts was added.

gatewayURL, _ := url.Parse("http://127.0.0.1:8080")
auth := &sdk.BasicAuth{
    Username: username,
    Password: password,
}

client := sdk.NewClientWithOpts(gatewayURL, http.DefaultClient, sdk.WithAuthentication(auth))

The client has a new method InvokeFunction that can be used to invoke OpenFaaS functions.

When the auth argument is true the function invocation will be authenticated with an OpenFaaS function access token. The InvokeFunction method handles exchanging an ID token obtained from the FunctionTokenSource for an OpenFaaS function access token with a single function as audience.

Function access tokens are cached to prevent going through the token exchange each time a function is called.

By default the authentication provider set in ClientAuth is used as the function token source if it implements the TokenSource interface. Alternatively a function token source can be explicitly set with the WithFunctionTokenSource option during client construction.

The ExchangeIDToken token function accepts an extra list of exchange options to configure the token exchange. Supported options are WithAudience and WithScope.

Motivation and Context

• I have raised an issue to propose this change (required)
• My issue has received approval from the maintainers or lead with the design/approved label

Support built-in function authentication with OpenFaaS IAM.

How Has This Been Tested?

These changes have been used and tested E2E in the OpenFaaS CLI, pro connector sdk and dashboard.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I've read the CONTRIBUTION guide
• I have signed-off my commits with git commit -s
• I have added tests to cover my changes.
• All new and existing tests passed.

[derek]

Thank you for your contribution. unfortunately, one or more of your commits are missing the required "Signed-off-by:" statement. Signing off is part of the Developer Certificate of Origin (DCO) which is used by this project.

Read the DCO and project contributing guide carefully, and amend your commits using the git CLI. Note that this does not require any cryptography, keys or special steps to be taken.

💡 Shall we fix this?

This will only take a few moments.

First, clone your fork and checkout this branch using the git CLI.

Next, set up your real name and email address:

git config --global user.name "Your Full Name"
git config --global user.email "[email protected]"

Finally, run one of these commands to add the "Signed-off-by" line to your commits.

If you only have one commit so far then run: git commit --amend --signoff and then git push --force.
If you have multiple commits, watch this video.

Check that the message has been added properly by running "git log".

[alexellis]

How would a user access this when they've constructed a Client and have started using it?

[alexellis]

Likewise, how do you stop this?

[welteki]

You would have to start it when instantiating the cache. The context can be used to stop it.

The cache can be passed in as an option when the client is constructed.

fnTokenCache := sdk.NewMemoryTokenCache()
go fnTokenCache.StartGC(context.Background(), time.Second*10)

client := sdk.NewClientWithOpts(
    gatewayUrl,
    httpClient,
    sdk.WithAuthentication(auth),
    sdk.WithFunctionTokenCache(fnTokenCache),
)

[alexellis]

Is that example in the examples in the README?

How would you change the example so someone could stop the StartGC?

[welteki]

Yes this example is also in the README.

Instead of passing the background context in the example it can be changed to use a context that can be cancelled.

[derek]

Thank you for your contribution. unfortunately, one or more of your commits are missing the required "Signed-off-by:" statement. Signing off is part of the Developer Certificate of Origin (DCO) which is used by this project.

Read the DCO and project contributing guide carefully, and amend your commits using the git CLI. Note that this does not require any cryptography, keys or special steps to be taken.

💡 Shall we fix this?

This will only take a few moments.

First, clone your fork and checkout this branch using the git CLI.

Next, set up your real name and email address:

git config --global user.name "Your Full Name"
git config --global user.email "[email protected]"

Finally, run one of these commands to add the "Signed-off-by" line to your commits.

If you only have one commit so far then run: git commit --amend --signoff and then git push --force.
If you have multiple commits, watch this video.

Check that the message has been added properly by running "git log".

[alexellis]

Apprved