Skip to content

Commit 4fb479f

Browse files
committed
docs: add OIDC support documentation for SinkBinding and ContainerSource
Fixes #6216 - Add SinkBinding and ContainerSource to the OIDC compatibility list - Document the /oidc/token file mount feature - Add practical example showing how to use the OIDC token in containers
1 parent 6c9f7c1 commit 4fb479f

File tree

1 file changed

+36
-0
lines changed

1 file changed

+36
-0
lines changed

docs/versioned/eventing/features/sender-identity.md

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ OIDC authentication is currently supported for the following components:
4242
- [ApiServerSource](./../../sources/apiserversource/)
4343
- [PingSource](./../../sources/ping-source/)
4444
- [KafkaSource](./../../sources/kafka-source/)
45+
- [SinkBinding](./../../custom-event-source/sinkbinding/)
46+
- [ContainerSource](./../../custom-event-source/containersource/)
4547

4648
## Sender Identity Configuration
4749

@@ -66,6 +68,40 @@ data:
6668
authentication-oidc: "enabled"
6769
```
6870
71+
## OIDC Token for SinkBinding and ContainerSource
72+
73+
When the `authentication-oidc` feature is enabled and a SinkBinding or ContainerSource has a sink with an OIDC audience, Knative Eventing automatically mounts the OIDC token to the container.
74+
75+
The token is available at the following path:
76+
77+
```
78+
/oidc/token
79+
```
80+
81+
This file contains a valid OIDC access token for the sink's audience. Your application can read this file and include the token in the `Authorization` header when sending events to the sink.
82+
83+
### Example: Sending authenticated events
84+
85+
The following example shows how to read the OIDC token and send an authenticated event to the sink in a container:
86+
87+
```bash
88+
# Read the OIDC token and sink URL
89+
TOKEN=$(cat /oidc/token)
90+
91+
# Send an authenticated CloudEvent to the sink
92+
curl -X POST "$K_SINK" \
93+
-H "Authorization: Bearer $TOKEN" \
94+
-H "Content-Type: application/json" \
95+
-H "Ce-Id: 1" \
96+
-H "Ce-Source: my-container-source" \
97+
-H "Ce-Type: my.event.type" \
98+
-H "Ce-Specversion: 1.0" \
99+
-d '{"message": "Hello from ContainerSource"}'
100+
```
101+
102+
!!! note
103+
The token is automatically refreshed by Knative Eventing before it expires. Your application should read the token from the file for each request, or implement token refresh logic.
104+
69105
## Verifying that the feature is working
70106

71107
Save the following YAML into a file called `default-broker-example.yaml`

0 commit comments

Comments
 (0)