[braghettos]

Closes #42. This replaces #43, which GitHub closed when its stacked base (#41's branch) was deleted on merge. The branch, now rebased onto main, is unchanged, and its tree is byte-identical to the commit the e2e below tested.

Why

Tenant onboarding (a Kyverno GeneratingPolicy in saas) fires on every <user>-clientconfig Secret, but nothing on them identified the credential. The decision is that authn stamps the identity facts it already knows, and the policy decides from them.

What

Every clientconfig authn writes now carries two annotations, alongside #40's certificate-not-{before,after}:

Annotation	Value
authn.krateo.io/strategy	basic / ldap / oauth / oidc / serviceaccount; self for authn-clientconfig; unknown only from the backfill
authn.krateo.io/groups	the certificate's O=, newline-separated

• Why newlines: group names can contain commas, e.g. Azure groups passed through verbatim by OIDC.
• Newline in a group name: the login is refused before any certificate is minted (storage.ValidateGroups).
• Strategy source: Generator.Generate now takes the issuing strategy, and every route passes its own. authn's own identity gets self from the certificate renewer's annotation sync.
• Startup backfill (internal/identitybackfill): stamps Secrets that predate these annotations, and never overwrites existing ones.
  • Groups are read from the stored certificate.
  • Strategy is self, serviceaccount (a mapping with that username exists) or basic (a basic User exists); otherwise unknown. "Both a mapping and a basic User exist" is also unknown.
  • An unreadable certificate or a failed lookup means the Secret is skipped and logged, never stamped with a guess.
• No new RBAC. authn already has list/update on Secrets in its namespace.

Consumer

acmp's onboarding selects positively: it creates a tenant only when the groups contain tenants, and a missing annotation means no onboarding. So the backfill must run (authn 0.28.0) before the demo cutover.

Tests

• storage: comma-containing groups round-trip; no-groups gives an empty value; an empty strategy, an unreadable certificate or a newline group are refused.
• identitybackfill: a fake apiserver plus a fake lookup cover:
  • self, serviceaccount, basic, unknown, and both-exist (unknown);
  • already stamped (untouched) and half stamped (only the missing key added);
  • an unreadable certificate and a lookup error (skipped);
  • a non-clientconfig Secret (ignored);
  • unrelated annotations (preserved).
• serviceaccount handler: issued as StrategyServiceAccount.
• Pre-release kind e2e of fix: renew authn's own client certificate and clamp the login JWT to it (#28) #40 + fix(serviceaccount): stop returning the kubeconfig from /serviceaccount/login (#36) #41 + Stamp identity facts (strategy, groups) on every <user>-clientconfig Secret #42: 18/18 pass (capped signer; backfill against Secrets written by the previous image). Full table in #43.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TLFnUe4HXFphxQNAfqFawZ