Provide the OIDC token for the SinkBinding as a volume

[creydr]

Problem

As the Eventing OIDC feature track describes, the SinkBinding controller will add a volume to its managing container, which contains the token for authentication.
This will be a token for the SinkBindings identity (from .status.auth.serviceAccountName) and issued for the sinks audience (.status.sinkAudience).
The token will not be injected as a env var for security reasons and as it would not be refreshable without a pod restart.
The SinkBinding controller will take care of the token handling & refreshing.

For the SinkBinding controller, this means:

• when the sink has no audience defined:
  • no change in behavior
• when the the sink has an audience defined:
  • create a secret containing a JWT for the sinkbinding
  • mount this secret as a volume into the referencing resource as a volume to /oidc/token
  • take care about token renewals and updates of the secret

Additonal Information

• requires Provide a library for OIDC token management #7175

[rahulii]

/assign

[Cali0707]

Hey @rahulii are you still working on this? If you are and need help, feel free to reach out here or on slack.

If you don't want to work on this anymore, please let me know. Thanks!

[creydr]

@rahulii As we didn't hear anything on this since some time, I would unassign you from this to give other contributors a chance to work on this.
Feel free to assign it to you again, when you're ready to work on it.