ci-operator-checkconfig: add audience ownership validation

Add an allowed-audiences-config mechanism that restricts which
org/repo combinations can use specific service account token
audiences. This prevents unauthorized CI configs from using
audiences belonging to other teams' WIF pools.

Follows the existing cluster profile ownership pattern:
- Config file maps audiences to allowed org/repo owners
- ci-operator-checkconfig validates at PR time
- Unlisted audiences are unrestricted (permissive by default)
- Missing config file is treated as empty (no restrictions)

New flag: --allowed-audiences-config (optional)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: patjlm

cmd/ci-operator-checkconfig/main.go

@@ -36,20 +36,23 @@ type options struct {
 	clusterProfiles          api.ClusterProfilesMap
 	clusterClaimOwners       api.ClusterClaimOwnersMap
 	clusterProfileSetDetails validation.ClusterProfileSetDetails
+	allowedAudiences         api.AllowedAudiencesMap
 }
 
 func (o *options) parse() error {
 	var registryDir string
 	var profilesConfigPath string
 	var clusterClaimConfigPath string
 	var clusterProfileSetDetailsPath string
+	var allowedAudiencesConfigPath string
 
 	fs := flag.NewFlagSet("", flag.ExitOnError)
 
 	fs.StringVar(&registryDir, "registry", "", "Path to the step registry directory")
 	fs.StringVar(&profilesConfigPath, "cluster-profiles-config", "", "Path to the cluster profile config file")
 	fs.StringVar(&clusterClaimConfigPath, "cluster-claim-owners-config", "", "Path to the cluster claim owners config file")
 	fs.StringVar(&clusterProfileSetDetailsPath, "cluster-profile-set-details", "", "Path to the cluster profile set details file")
+	fs.StringVar(&allowedAudiencesConfigPath, "allowed-audiences-config", "", "Path to the allowed audiences config file")
 	o.Options.Bind(fs)
 
 	if err := fs.Parse(os.Args[1:]); err != nil {
@@ -72,6 +75,14 @@ func (o *options) parse() error {
 	}
 	o.clusterClaimOwners = claimOwners
 
+	if allowedAudiencesConfigPath != "" {
+		allowedAudiences, err := load.AllowedAudiencesConfig(allowedAudiencesConfigPath)
+		if err != nil {
+			return fmt.Errorf("failed to load allowed audiences config: %w", err)
+		}
+		o.allowedAudiences = allowedAudiences
+	}
+
 	ciOPConfigAgent, err := agents.NewConfigAgent(o.ConfigDir, nil, agents.WithOrg(o.Org), agents.WithRepo(o.Repo))
 	if err != nil {
 		return fmt.Errorf("failed to create CI Op config agent: %w", err)
@@ -110,7 +121,8 @@ func (o *options) validate() (ret []error) {
 	errCh := make(chan error)
 	map_ := func() error {
 		validator := validation.NewValidator(o.clusterProfiles, o.clusterClaimOwners,
-			validation.WithClusterProfileSetDetails(o.clusterProfileSetDetails))
+			validation.WithClusterProfileSetDetails(o.clusterProfileSetDetails),
+			validation.WithAllowedAudiences(o.allowedAudiences))
 		for c := range inputCh {
 			if err := o.validateConfiguration(&validator, outputCh, c); err != nil {
 				errCh <- fmt.Errorf("failed to validate configuration %s: %w", c.Metadata.RelativePath(), err)

pkg/api/types.go

@@ -2996,6 +2996,21 @@ type ClusterClaimOwnerDetails struct {
 	Repos []string `yaml:"repos,omitempty"`
 }
 
+// AllowedAudiencesMap maps audience strings to their ownership details.
+// Audiences in this map are restricted to configs from the listed org/repo owners.
+// Audiences not in this map are unrestricted.
+type AllowedAudiencesMap map[string]AllowedAudienceDetails
+
+type AllowedAudienceDetails struct {
+	Audience string                  `yaml:"audience" json:"audience"`
+	Owners   []AllowedAudienceOwners `yaml:"owners,omitempty" json:"owners,omitempty"`
+}
+
+type AllowedAudienceOwners struct {
+	Org   string   `yaml:"org" json:"org"`
+	Repos []string `yaml:"repos,omitempty" json:"repos,omitempty"`
+}
+
 const (
 	EphemeralClusterTestDoneSignalSecretName = "test-done-signal"
 )

pkg/load/load.go

@@ -309,3 +309,25 @@ func ClusterClaimOwnersConfig(configPath string) (api.ClusterClaimOwnersMap, err
 	}
 	return clusterClaimOwnersMap, nil
 }
+
+// AllowedAudiencesConfig loads allowed audiences information from its config in the release repository.
+// If the file does not exist, an empty map is returned.
+func AllowedAudiencesConfig(configPath string) (api.AllowedAudiencesMap, error) {
+	configContents, err := os.ReadFile(configPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return make(api.AllowedAudiencesMap), nil
+		}
+		return nil, fmt.Errorf("failed to read allowed audiences config: %w", err)
+	}
+
+	var audiencesList []api.AllowedAudienceDetails
+	if err = yaml.Unmarshal(configContents, &audiencesList); err != nil {
+		return nil, fmt.Errorf("failed to unmarshall allowed audiences config: %w", err)
+	}
+	allowedAudiencesMap := make(api.AllowedAudiencesMap)
+	for _, a := range audiencesList {
+		allowedAudiencesMap[a.Audience] = a
+	}
+	return allowedAudiencesMap, nil
+}

pkg/validation/config.go

@@ -24,6 +24,7 @@ type ClusterProfileSetDetails map[api.ClusterProfile][]string
 type Validator struct {
 	validClusterProfiles    api.ClusterProfilesMap
 	validClusterClaimOwners api.ClusterClaimOwnersMap
+	allowedAudiences        api.AllowedAudiencesMap
 	// hasTrapCache avoids redundant regexp searches on step commands.
 	hasTrapCache map[string]bool
 	cpsDetails   ClusterProfileSetDetails
@@ -35,6 +36,10 @@ func WithClusterProfileSetDetails(cpsDetails ClusterProfileSetDetails) func(*Val
 	return func(v *Validator) { v.cpsDetails = cpsDetails }
 }
 
+func WithAllowedAudiences(audiences api.AllowedAudiencesMap) func(*Validator) {
+	return func(v *Validator) { v.allowedAudiences = audiences }
+}
+
 // NewValidator creates an object that optimizes bulk validations.
 func NewValidator(profiles api.ClusterProfilesMap, clusterClaimOwners api.ClusterClaimOwnersMap, opts ...ValidatorOption) Validator {
 	v := Validator{
@@ -700,6 +705,6 @@ func Observer(observer api.Observer) []error {
 	// this observer in the future. This technically disallows users from using `from:`
 	// to refer to an image from a release payload for an observer, but this should be
 	// not of any real issue and will at least be obvious to the user on presubmit.
-	errs = append(errs, validateFromAndFromImage(newContext("", nil, nil, nil), observer.From, observer.FromImage, nil, nil)...)
+	errs = append(errs, validateFromAndFromImage(newContext("", nil, nil, nil, nil), observer.From, observer.FromImage, nil, nil)...)
 	return errs
 }

pkg/validation/test.go

@@ -73,6 +73,8 @@ type context struct {
 	inputImagesSeen testInputImages
 	// releases is used to validate references to release images .
 	releases sets.Set[string]
+	// metadata is used for ownership checks (e.g., audience restrictions).
+	metadata *api.Metadata
 }
 
 // newContext creates a top-level context.
@@ -81,6 +83,7 @@ func newContext(
 	env api.TestEnvironment,
 	releases sets.Set[string],
 	inputImagesSeen testInputImages,
+	metadata *api.Metadata,
 ) *context {
 	return &context{
 		field:           field,
@@ -89,6 +92,7 @@ func newContext(
 		leasesSeen:      sets.New[string](),
 		inputImagesSeen: inputImagesSeen,
 		releases:        releases,
+		metadata:        metadata,
 	}
 }
 
@@ -575,7 +579,7 @@ func (v *Validator) validateTestConfigurationType(
 			clusterCount++
 			validationErrors = append(validationErrors, v.validateClusterProfile(fieldRoot, testConfig.ClusterProfile, metadata)...)
 		}
-		context := newContext(fieldPath(fieldRoot), testConfig.Environment, releases, inputImagesSeen)
+		context := newContext(fieldPath(fieldRoot), testConfig.Environment, releases, inputImagesSeen, metadata)
 		validationErrors = append(validationErrors, validateLeases(context.addField("leases"), testConfig.Leases)...)
 		if testConfig.NodeArchitecture != nil {
 			validationErrors = append(validationErrors, validateNodeArchitecture(fieldRoot, *testConfig.NodeArchitecture))
@@ -586,7 +590,7 @@ func (v *Validator) validateTestConfigurationType(
 	}
 	if testConfig := test.MultiStageTestConfigurationLiteral; testConfig != nil {
 		typeCount++
-		context := newContext(fieldPath(fieldRoot).addField("steps"), testConfig.Environment, releases, inputImagesSeen)
+		context := newContext(fieldPath(fieldRoot).addField("steps"), testConfig.Environment, releases, inputImagesSeen, metadata)
 		if testConfig.ClusterProfile != "" {
 			clusterCount++
 			validationErrors = append(validationErrors, v.validateClusterProfile(fieldRoot, testConfig.ClusterProfile, metadata)...)
@@ -695,7 +699,7 @@ func (v *Validator) validateLiteralTestStep(context *context, stage testStage, s
 	}
 	ret = append(ret, validateDependencies(string(context.field), step.Dependencies)...)
 	ret = append(ret, validateLeases(context.addField("leases"), step.Leases)...)
-	ret = append(ret, validateServiceAccountTokens(string(context.field), step.ServiceAccountTokens)...)
+	ret = append(ret, v.validateServiceAccountTokens(string(context.field), step.ServiceAccountTokens, context.metadata)...)
 	if step.NodeArchitecture != nil {
 		if err := validateNodeArchitecture(string(context.field), *step.NodeArchitecture); err != nil {
 			ret = append(ret, err)
@@ -943,12 +947,18 @@ func validateLeases(context *context, leases []api.StepLease) (ret []error) {
 	return
 }
 
-func validateServiceAccountTokens(fieldRoot string, tokens []api.ServiceAccountTokenVolume) (ret []error) {
+func (v *Validator) validateServiceAccountTokens(fieldRoot string, tokens []api.ServiceAccountTokenVolume, metadata *api.Metadata) (ret []error) {
 	mountPaths := sets.New[string]()
 	for i, token := range tokens {
 		fieldPath := fmt.Sprintf("%s.service_account_tokens[%d]", fieldRoot, i)
 		if token.Audience == "" {
 			ret = append(ret, fmt.Errorf("%s.audience: must not be empty", fieldPath))
+		} else if v.allowedAudiences != nil {
+			if details, ok := v.allowedAudiences[token.Audience]; ok {
+				if err := verifyAudienceOwnership(details, metadata); err != nil {
+					ret = append(ret, err)
+				}
+			}
 		}
 		if token.MountPath == "" {
 			ret = append(ret, fmt.Errorf("%s.mount_path: must not be empty", fieldPath))
@@ -964,6 +974,26 @@ func validateServiceAccountTokens(fieldRoot string, tokens []api.ServiceAccountT
 	return
 }
 
+// verifyAudienceOwnership checks if metadata's org and repo match those in the
+// audience config, verifying if it's one of the owners of the audience.
+func verifyAudienceOwnership(audience api.AllowedAudienceDetails, m *api.Metadata) error {
+	if m == nil || m.Org == "" {
+		return nil
+	}
+	if len(audience.Owners) == 0 {
+		return nil
+	}
+	for _, owner := range audience.Owners {
+		if owner.Org != m.Org {
+			continue
+		}
+		if owner.Repos == nil || util.Contains(owner.Repos, m.Repo) {
+			return nil
+		}
+	}
+	return fmt.Errorf("%s/%s is not allowed to use service account token audience %q", m.Org, m.Repo, audience.Audience)
+}
+
 func validateNodeArchitectureOverrides(fieldRoot string, nodeArchitectureOverrides api.NodeArchitectureOverrides) error {
 	for index, arch := range nodeArchitectureOverrides {
 		if err := arch.Validate(); err != nil {

pkg/validation/test_test.go

@@ -1094,7 +1094,7 @@ func TestValidateTestSteps(t *testing.T) {
 		clusterClaim: api.ClaimRelease{ReleaseName: "myclaim-as", OverrideName: "myclaim"},
 	}} {
 		t.Run(tc.name, func(t *testing.T) {
-			context := newContext("test", nil, tc.releases, make(testInputImages))
+			context := newContext("test", nil, tc.releases, make(testInputImages), nil)
 			if tc.seen != nil {
 				context.namesSeen = tc.seen
 			}
@@ -1135,7 +1135,7 @@ func TestValidatePostSteps(t *testing.T) {
 		}},
 	}} {
 		t.Run(tc.name, func(t *testing.T) {
-			context := newContext("test", nil, tc.releases, make(testInputImages))
+			context := newContext("test", nil, tc.releases, make(testInputImages), nil)
 			if tc.seen != nil {
 				context.namesSeen = tc.seen
 			}
@@ -1173,7 +1173,7 @@ func TestValidateParameters(t *testing.T) {
 	}} {
 		t.Run(tc.name, func(t *testing.T) {
 			v := NewValidator(nil, nil)
-			err := v.validateLiteralTestStep(newContext("test", tc.env, tc.releases, make(testInputImages)), testStageTest, api.LiteralTestStep{
+			err := v.validateLiteralTestStep(newContext("test", tc.env, tc.releases, make(testInputImages), nil), testStageTest, api.LiteralTestStep{
 				As:       "as",
 				From:     "from",
 				Commands: "commands",