Merge pull request #70310 from mikedanese/trev10

echo audiences in anonymous and insecure authenticators

staging/src/k8s.io/apiserver/pkg/authentication/request/anonymous/BUILD

@@ -25,6 +25,7 @@ go_library(
     deps = [
         "//staging/src/k8s.io/apiserver/pkg/authentication/authenticator:go_default_library",
         "//staging/src/k8s.io/apiserver/pkg/authentication/user:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/endpoints/request:go_default_library",
     ],
 )
 

staging/src/k8s.io/apiserver/pkg/authentication/request/anonymous/anonymous.go

@@ -21,6 +21,7 @@ import (
 
 	"k8s.io/apiserver/pkg/authentication/authenticator"
 	"k8s.io/apiserver/pkg/authentication/user"
+	"k8s.io/apiserver/pkg/endpoints/request"
 )
 
 const (
@@ -31,11 +32,13 @@ const (
 
 func NewAuthenticator() authenticator.Request {
 	return authenticator.RequestFunc(func(req *http.Request) (*authenticator.Response, bool, error) {
+		auds, _ := request.AudiencesFrom(req.Context())
 		return &authenticator.Response{
 			User: &user.DefaultInfo{
 				Name:   anonymousUser,
 				Groups: []string{unauthenticatedGroup},
 			},
+			Audiences: auds,
 		}, true, nil
 	})
 }

staging/src/k8s.io/apiserver/pkg/authentication/request/anonymous/anonymous_test.go

@@ -17,6 +17,7 @@ limitations under the License.
 package anonymous
 
 import (
+	"net/http"
 	"testing"
 
 	"k8s.io/apimachinery/pkg/util/sets"
@@ -26,7 +27,7 @@ import (
 
 func TestAnonymous(t *testing.T) {
 	var a authenticator.Request = NewAuthenticator()
-	r, ok, err := a.AuthenticateRequest(nil)
+	r, ok, err := a.AuthenticateRequest(&http.Request{})
 	if err != nil {
 		t.Fatalf("Unexpected error %v", err)
 	}

staging/src/k8s.io/apiserver/pkg/server/deprecated_insecure_serving.go

@@ -25,6 +25,7 @@ import (
 
 	"k8s.io/apiserver/pkg/authentication/authenticator"
 	"k8s.io/apiserver/pkg/authentication/user"
+	"k8s.io/apiserver/pkg/endpoints/request"
 	"k8s.io/client-go/rest"
 )
 
@@ -79,10 +80,12 @@ func (s *DeprecatedInsecureServingInfo) NewLoopbackClientConfig() (*rest.Config,
 type InsecureSuperuser struct{}
 
 func (InsecureSuperuser) AuthenticateRequest(req *http.Request) (*authenticator.Response, bool, error) {
+	auds, _ := request.AudiencesFrom(req.Context())
 	return &authenticator.Response{
 		User: &user.DefaultInfo{
 			Name:   "system:unsecured",
 			Groups: []string{user.SystemPrivilegedGroup, user.AllAuthenticated},
 		},
+		Audiences: auds,
 	}, true, nil
 }