Consolidate STS code

[howardjohn]

Currently we have 2-3 partially overlapping STS usages in Istio. Would be good to consolidate these. Below captures my notes quickly running through these:

caclient/credentials:
calls TokenExchange (CA)
inline code for TokenManager.GenerateToken

TokenManager - STS -> response. GenerateToken
Can also get "metadata"
1 impl: stsservice/tokenmanager

tokenmanager.Plugin -> STS -> response. TokenManager just delegates to this
1 impl: google/tokenexchangeplugin
has a cache for access token (also for federated token, but its never actually used)
constructFederatedTokenRequest - token -> federated accesstoken (http req w/ retry)
access token - federated access token -> access token for gcp-sa-meshdataplane.iam.gserviceaccount.com:generateAccessToken
finally convets to StsResponseParameters format

TokenExchanger: token -> token
1 impl: providers/google/stsclient
create raw map (instead of StsRequestParameters)
http request to sts.googleapis.com/v1/token with retry
response into federatedTokenResponse
return AccessToken

Users:

• XDS: TokenManager.GenerateToken then unmarshal StsResponseParameters to get .AccessToken
• CA: TokenExchanger.ExchangeToken, returns access token directly
• STS server: gets sts req over http, calls tokenManager.GenerateToken. Responses with json directly
  So it seems the CA is a subset of XDS/STS Server

[howardjohn]

not stale

…

On Tue, Apr 26, 2022 at 10:03 PM Istio Policy Bot ***@***.***> wrote: 🧭 This issue or pull request has been automatically marked as stale because it has not had activity from an Istio team member since 2022-01-26. It will be closed on 2022-05-11 unless an Istio team member takes action. Please see this wiki page <https://github.com/istio/istio/wiki/Issue-and-Pull-Request-Lifecycle-Manager> for more information. Thank you for your contributions. *Created by the issue and PR lifecycle manager*. — Reply to this email directly, view it on GitHub <#37021 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAEYGXNCR6TL4YFVHMAC5TLVHDDBRANCNFSM5M322YHQ> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[istio-policy-bot]

🚧 This issue or pull request has been closed due to not having had activity from an Istio team member since 2022-04-27. If you feel this issue or pull request deserves attention, please reopen the issue. Please see this wiki page for more information. Thank you for your contributions.

Created by the issue and PR lifecycle manager.