add a namespaced field

kubernetes-sigs · Aug 20, 2024 · 1ecf00d · 1ecf00d
1 parent 163e035
commit 1ecf00d
Show file tree

Hide file tree

Showing 2 changed files with 51 additions and 51 deletions.
diff --git a/pkg/server/server.go b/pkg/server/server.go
@@ -379,7 +379,7 @@ func (h *handler) authenticateEndpoint(w http.ResponseWriter, req *http.Request)
 		userExtra["canonicalArn"] = authenticationv1beta1.ExtraValue{identity.CanonicalARN}
 		userExtra["sessionName"] = authenticationv1beta1.ExtraValue{identity.SessionName}
 		userExtra["accessKeyId"] = authenticationv1beta1.ExtraValue{identity.AccessKeyID}
-		userExtra["principalId"] = authenticationv1beta1.ExtraValue{identity.UserID}
+		userExtra["eks.amazonaws.com/principalId"] = authenticationv1beta1.ExtraValue{identity.UserID}
 	}
 
 	json.NewEncoder(w).Encode(authenticationv1beta1.TokenReview{

diff --git a/pkg/server/server_test.go b/pkg/server/server_test.go
@@ -500,11 +500,11 @@ func TestAuthenticateVerifierRoleMapping(t *testing.T) {
 		"aws-iam-authenticator:0123456789012:Test",
 		[]string{"sys:admin", "listers"},
 		map[string]authenticationv1beta1.ExtraValue{
-			"arn":          authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:role/Test"},
-			"canonicalArn": authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:role/Test"},
-			"sessionName":  authenticationv1beta1.ExtraValue{"TestSession"},
-			"accessKeyId":  authenticationv1beta1.ExtraValue{"ABCDEF"},
-			"principalId":  authenticationv1beta1.ExtraValue{"Test"},
+			"arn":                           authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:role/Test"},
+			"canonicalArn":                  authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:role/Test"},
+			"sessionName":                   authenticationv1beta1.ExtraValue{"TestSession"},
+			"accessKeyId":                   authenticationv1beta1.ExtraValue{"ABCDEF"},
+			"eks.amazonaws.com/principalId": authenticationv1beta1.ExtraValue{"Test"},
 		}))
 	validateMetrics(t, validateOpts{success: 1})
 }
@@ -543,11 +543,11 @@ func TestAuthenticateVerifierRoleMappingCRD(t *testing.T) {
 		"aws-iam-authenticator:0123456789012:Test",
 		[]string{"sys:admin", "listers"},
 		map[string]authenticationv1beta1.ExtraValue{
-			"arn":          authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:role/Test"},
-			"canonicalArn": authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:role/Test"},
-			"sessionName":  authenticationv1beta1.ExtraValue{"TestSession"},
-			"accessKeyId":  authenticationv1beta1.ExtraValue{""},
-			"principalId":  authenticationv1beta1.ExtraValue{"Test"},
+			"arn":                           authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:role/Test"},
+			"canonicalArn":                  authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:role/Test"},
+			"sessionName":                   authenticationv1beta1.ExtraValue{"TestSession"},
+			"accessKeyId":                   authenticationv1beta1.ExtraValue{""},
+			"eks.amazonaws.com/principalId": authenticationv1beta1.ExtraValue{"Test"},
 		}))
 	validateMetrics(t, validateOpts{success: 1})
 }
@@ -590,11 +590,11 @@ func TestAuthenticateVerifierUserMapping(t *testing.T) {
 		"aws-iam-authenticator:0123456789012:Test",
 		[]string{"sys:admin", "listers"},
 		map[string]authenticationv1beta1.ExtraValue{
-			"arn":          authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:user/Test"},
-			"canonicalArn": authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:user/Test"},
-			"sessionName":  authenticationv1beta1.ExtraValue{"TestSession"},
-			"accessKeyId":  authenticationv1beta1.ExtraValue{""},
-			"principalId":  authenticationv1beta1.ExtraValue{"Test"},
+			"arn":                           authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:user/Test"},
+			"canonicalArn":                  authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:user/Test"},
+			"sessionName":                   authenticationv1beta1.ExtraValue{"TestSession"},
+			"accessKeyId":                   authenticationv1beta1.ExtraValue{""},
+			"eks.amazonaws.com/principalId": authenticationv1beta1.ExtraValue{"Test"},
 		}))
 	validateMetrics(t, validateOpts{success: 1})
 }
@@ -633,11 +633,11 @@ func TestAuthenticateVerifierUserMappingCRD(t *testing.T) {
 		"aws-iam-authenticator:0123456789012:Test",
 		[]string{"sys:admin", "listers"},
 		map[string]authenticationv1beta1.ExtraValue{
-			"arn":          authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:user/Test"},
-			"canonicalArn": authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:user/Test"},
-			"sessionName":  authenticationv1beta1.ExtraValue{"TestSession"},
-			"accessKeyId":  authenticationv1beta1.ExtraValue{""},
-			"principalId":  authenticationv1beta1.ExtraValue{"Test"},
+			"arn":                           authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:user/Test"},
+			"canonicalArn":                  authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:user/Test"},
+			"sessionName":                   authenticationv1beta1.ExtraValue{"TestSession"},
+			"accessKeyId":                   authenticationv1beta1.ExtraValue{""},
+			"eks.amazonaws.com/principalId": authenticationv1beta1.ExtraValue{"Test"},
 		}))
 	validateMetrics(t, validateOpts{success: 1})
 }
@@ -676,11 +676,11 @@ func TestAuthenticateVerifierAccountMappingForUser(t *testing.T) {
 		"aws-iam-authenticator:0123456789012:Test",
 		nil,
 		map[string]authenticationv1beta1.ExtraValue{
-			"arn":          authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:user/Test"},
-			"canonicalArn": authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:user/Test"},
-			"sessionName":  authenticationv1beta1.ExtraValue{"TestSession"},
-			"accessKeyId":  authenticationv1beta1.ExtraValue{""},
-			"principalId":  authenticationv1beta1.ExtraValue{"Test"},
+			"arn":                           authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:user/Test"},
+			"canonicalArn":                  authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:user/Test"},
+			"sessionName":                   authenticationv1beta1.ExtraValue{"TestSession"},
+			"accessKeyId":                   authenticationv1beta1.ExtraValue{""},
+			"eks.amazonaws.com/principalId": authenticationv1beta1.ExtraValue{"Test"},
 		}))
 	validateMetrics(t, validateOpts{success: 1})
 }
@@ -719,11 +719,11 @@ func TestAuthenticateVerifierAccountMappingForUserCRD(t *testing.T) {
 		"aws-iam-authenticator:0123456789012:Test",
 		nil,
 		map[string]authenticationv1beta1.ExtraValue{
-			"arn":          authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:user/Test"},
-			"canonicalArn": authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:user/Test"},
-			"sessionName":  authenticationv1beta1.ExtraValue{"TestSession"},
-			"accessKeyId":  authenticationv1beta1.ExtraValue{""},
-			"principalId":  authenticationv1beta1.ExtraValue{"Test"},
+			"arn":                           authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:user/Test"},
+			"canonicalArn":                  authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:user/Test"},
+			"sessionName":                   authenticationv1beta1.ExtraValue{"TestSession"},
+			"accessKeyId":                   authenticationv1beta1.ExtraValue{""},
+			"eks.amazonaws.com/principalId": authenticationv1beta1.ExtraValue{"Test"},
 		}))
 	validateMetrics(t, validateOpts{success: 1})
 }
@@ -762,11 +762,11 @@ func TestAuthenticateVerifierAccountMappingForRole(t *testing.T) {
 		"aws-iam-authenticator:0123456789012:Test",
 		nil,
 		map[string]authenticationv1beta1.ExtraValue{
-			"arn":          authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:assumed-role/Test/extra"},
-			"canonicalArn": authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:role/Test"},
-			"sessionName":  authenticationv1beta1.ExtraValue{"TestSession"},
-			"accessKeyId":  authenticationv1beta1.ExtraValue{""},
-			"principalId":  authenticationv1beta1.ExtraValue{"Test"},
+			"arn":                           authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:assumed-role/Test/extra"},
+			"canonicalArn":                  authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:role/Test"},
+			"sessionName":                   authenticationv1beta1.ExtraValue{"TestSession"},
+			"accessKeyId":                   authenticationv1beta1.ExtraValue{""},
+			"eks.amazonaws.com/principalId": authenticationv1beta1.ExtraValue{"Test"},
 		}))
 	validateMetrics(t, validateOpts{success: 1})
 }
@@ -805,11 +805,11 @@ func TestAuthenticateVerifierAccountMappingForRoleCRD(t *testing.T) {
 		"aws-iam-authenticator:0123456789012:Test",
 		nil,
 		map[string]authenticationv1beta1.ExtraValue{
-			"arn":          authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:assumed-role/Test/extra"},
-			"canonicalArn": authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:role/Test"},
-			"sessionName":  authenticationv1beta1.ExtraValue{"TestSession"},
-			"accessKeyId":  authenticationv1beta1.ExtraValue{""},
-			"principalId":  authenticationv1beta1.ExtraValue{"Test"},
+			"arn":                           authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:assumed-role/Test/extra"},
+			"canonicalArn":                  authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:role/Test"},
+			"sessionName":                   authenticationv1beta1.ExtraValue{"TestSession"},
+			"accessKeyId":                   authenticationv1beta1.ExtraValue{""},
+			"eks.amazonaws.com/principalId": authenticationv1beta1.ExtraValue{"Test"},
 		}))
 	validateMetrics(t, validateOpts{success: 1})
 }
@@ -853,11 +853,11 @@ func TestAuthenticateVerifierNodeMapping(t *testing.T) {
 		"aws-iam-authenticator:0123456789012:TestNodeRole",
 		[]string{"system:nodes", "system:bootstrappers"},
 		map[string]authenticationv1beta1.ExtraValue{
-			"arn":          authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:role/TestNodeRole"},
-			"canonicalArn": authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:role/TestNodeRole"},
-			"sessionName":  authenticationv1beta1.ExtraValue{"i-0c6f21bf1f24f9708"},
-			"accessKeyId":  authenticationv1beta1.ExtraValue{""},
-			"principalId":  authenticationv1beta1.ExtraValue{"TestNodeRole"},
+			"arn":                           authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:role/TestNodeRole"},
+			"canonicalArn":                  authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:role/TestNodeRole"},
+			"sessionName":                   authenticationv1beta1.ExtraValue{"i-0c6f21bf1f24f9708"},
+			"accessKeyId":                   authenticationv1beta1.ExtraValue{""},
+			"eks.amazonaws.com/principalId": authenticationv1beta1.ExtraValue{"TestNodeRole"},
 		}))
 	validateMetrics(t, validateOpts{success: 1})
 
@@ -898,11 +898,11 @@ func TestAuthenticateVerifierNodeMappingCRD(t *testing.T) {
 		"aws-iam-authenticator:0123456789012:TestNodeRole",
 		[]string{"system:nodes", "system:bootstrappers"},
 		map[string]authenticationv1beta1.ExtraValue{
-			"arn":          authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:role/TestNodeRole"},
-			"canonicalArn": authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:role/TestNodeRole"},
-			"sessionName":  authenticationv1beta1.ExtraValue{"i-0c6f21bf1f24f9708"},
-			"accessKeyId":  authenticationv1beta1.ExtraValue{""},
-			"principalId":  authenticationv1beta1.ExtraValue{"TestNodeRole"},
+			"arn":                           authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:role/TestNodeRole"},
+			"canonicalArn":                  authenticationv1beta1.ExtraValue{"arn:aws:iam::0123456789012:role/TestNodeRole"},
+			"sessionName":                   authenticationv1beta1.ExtraValue{"i-0c6f21bf1f24f9708"},
+			"accessKeyId":                   authenticationv1beta1.ExtraValue{""},
+			"eks.amazonaws.com/principalId": authenticationv1beta1.ExtraValue{"TestNodeRole"},
 		}))
 	validateMetrics(t, validateOpts{success: 1})