[braghettos]

Closes #42. Stacked on #41. I'll retarget it to main once #41 merges.

Why

Tenant onboarding (a Kyverno GeneratingPolicy in saas) fires on every <user>-clientconfig Secret, but nothing on them identified the credential. The decision is that authn stamps the identity facts it already knows, and the policy decides from them.

What

Every clientconfig authn writes now carries two annotations, alongside #40's certificate-not-{before,after}:

Annotation	Value
authn.krateo.io/strategy	basic / ldap / oauth / oidc / serviceaccount; self for authn-clientconfig; unknown only from the backfill
authn.krateo.io/groups	the certificate's O=, newline-separated

• Why newlines: group names can contain commas, e.g. Azure groups passed through verbatim by OIDC.
• Newline in a group name: the login is refused before any certificate is minted (storage.ValidateGroups).
• Strategy source: Generator.Generate now takes the issuing strategy, and every route passes its own. authn's own identity gets self from the certificate renewer's annotation sync.
• Startup backfill (internal/identitybackfill): stamps Secrets that predate these annotations, and never overwrites existing ones.
  • Groups are read from the stored certificate.
  • Strategy is self, serviceaccount (a mapping with that username exists) or basic (a basic User exists); otherwise unknown. "Both a mapping and a basic User exist" is also unknown.
  • An unreadable certificate or a failed lookup means the Secret is skipped and logged, never stamped with a guess.
• No new RBAC. authn already has list/update on Secrets in its namespace.

Consumer

acmp's onboarding selects positively: it creates a tenant only when the groups contain tenants, and a missing annotation means no onboarding. So the backfill must run (authn 0.28.0) before the demo cutover.

Tests

• storage: comma-containing groups round-trip; no-groups gives an empty value; an empty strategy, an unreadable certificate or a newline group are refused.
• identitybackfill: a fake apiserver plus a fake lookup cover:
  • self, serviceaccount, basic, unknown, and both-exist (unknown);
  • already stamped (untouched) and half stamped (only the missing key added);
  • an unreadable certificate and a lookup error (skipped);
  • a non-clientconfig Secret (ignored);
  • unrelated annotations (preserved).
• serviceaccount handler: issued as StrategyServiceAccount.
• Pre-release kind e2e of fix: renew authn's own client certificate and clamp the login JWT to it (#28) #40 + fix(serviceaccount): stop returning the kubeconfig from /serviceaccount/login (#36) #41 + Stamp identity facts (strategy, groups) on every <user>-clientconfig Secret #42 (capped signer; backfill against Secrets written by the previous image), running now.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TLFnUe4HXFphxQNAfqFawZ

[braghettos]

Pre-release e2e of #40 + #41 + #42: pass (18/18)

Setup: kind v1.36 with the signer capped at 20m. The cluster first ran the #40 image and was then upgraded to this branch's tip, so the backfill ran against Secrets the previous image wrote. A legacy fixture (legacy-tenant-clientconfig, a real CSR-signed cert CN=legacy-tenant, O=tenants, no annotations) stood in for an old OIDC login.

Area	Result
Backfill (log: scanned=3 stamped=2 skipped=0)	authn-clientconfig → self / authn; e2e-identity-clientconfig → serviceaccount / krateo:e2e; legacy-tenant-clientconfig → unknown / tenants
#41 serviceaccount login	Response keys ["accessToken","groups","user"], no client-key-data in the body; the Secret still holds the key and is re-stamped serviceaccount
#42 basic login	200, still returns data; Secret stamped basic, groups tenants\nSales, EMEA with the comma intact
#40 still holds	serviceaccount JWT lifetime 19m (clamped to the capped cert); renewer running

(authn-clientconfig was already stamped by the certificate renewer's sync before the backfill ran, which is why 2 of the 3 were stamped by the backfill.)

[braghettos]

Superseded by #44, the same branch rebased onto main. GitHub closed this one when its stacked base was deleted.