k8s-keystone-auth: properly handle token with no project scope (#2881)

k8s-infra-cherrypick-robot · kayrus · web-flow · commit 9ea24f3680bb · 2025-04-29T01:30:00.000-07:00
Co-authored-by: pýrus &lt;kayrus@users.noreply.github.com&gt;
diff --git a/pkg/identity/keystone/authenticator.go b/pkg/identity/keystone/authenticator.go
@@ -66,6 +66,9 @@ func (k *Keystoner) GetTokenInfo(ctx context.Context, token string) (*tokenInfo,
 	if err != nil {
 		return nil, fmt.Errorf("failed to extract project information from Keystone response: %v", err)
 	}
+	if project == nil {
+		return nil, fmt.Errorf("failed to extract project information from Keystone response")
+	}
 
 	roles, err := ret.ExtractRoles()
 	if err != nil {

Original file line number	Diff line number	Diff line change
`@@ -66,6 +66,9 @@ func (k Keystoner) GetTokenInfo(ctx context.Context, token string) (tokenInfo,`
`66`	`66`	`if err != nil {`
`67`	`67`	`return nil, fmt.Errorf("failed to extract project information from Keystone response: %v", err)`
`68`	`68`	`}`
	`69`	`+ if project == nil {`
	`70`	`+ return nil, fmt.Errorf("failed to extract project information from Keystone response")`
	`71`	`+ }`
`69`	`72`
`70`	`73`	`roles, err := ret.ExtractRoles()`
`71`	`74`	`if err != nil {`