Support function authentication with OpenFaaS IAM

[welteki]

Description

Support invoking functions that have the OpenFaaS IAM based built in function authentication enabled.

The CLI now uses the client.InvokeFunction method from the OpenFaaS go-sdk to invoke functions. Support for IAM authentication is part of the go-sdk. The SDK will handle exchanging the OpenFaaS API access token for a function access token that is only valid for the requested function.

The invoke command automatically tries to detect if a function requires authentication. This is done by invoking the function without an Authorization header. If the function responds with a 401 (Unauthorized) response status the CLI looks at the realm directive in the WWW-Authenticate header to check if the function requires authentication. The request is retried this time with authentication.

This change also adds a new optional flag, --auth to the invoke command. If the flag is set the CLI will skip the check to detect if authentication is required and immediately invoke the function with a function access token.

When running function with the local-run command, the OPENFAAS_NAME and OPENFAAS_NAMESPACE env
variables are set together with jwt_local_auth to support built-in function authentication.

Motivation and Context

• I have raised an issue to propose this change (required)

Support IAM authentication for functions.

How Has This Been Tested?

• Unit test were added to cover changes.

• Verified header, query parameters, and the content type set through flags are correctly used in the request.

• Verified it is possible to sign the request.

• Verified functions without authentication can be invoked.

  export FAAS_DEBUG=true
  echo | ./faas-cli invoke env
  
  POST https://gw.example.com/function/env.openfaas-fn
  Content-Type: [text/plain]
  
  PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
  HOSTNAME=env-86d79fd685-7ngmn
  OPENFAAS_NAME=env
  fprocess=env
  HOME=/home/app
  Http_Content_Type=text/plain
  Http_X_Forwarded_Uri=/function/env.openfaas-fn
  Http_X_Start_Time=1716564494196297298
  Http_X_Call_Id=054ccda4-73b4-4054-9c50-d2dc9897034c
  Http_User_Agent=Go-http-client/1.1
  Http_Method=POST
  ...

• Verified functions that require authentication can be invoked.

  export FAAS_DEBUG=true
  echo | ./faas-cli invoke alpine
  
  POST https://gw.example.com/function/alpine.openfaas-fn
  Content-Type: [text/plain]
  
  POST https://gw.example.com/function/alpine.openfaas-fn
  Content-Type: [text/plain]
  Authorization: Bearer REDACTED
  
  PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
  HOSTNAME=alpine-5b86546786-h667k
  jwt_auth=true
  OPENFAAS_NAME=alpine
  fprocess=env
  HOME=/home/app
  Http_Accept_Encoding=gzip
  Http_Authorization=Bearer REDACTED
  Http_Content_Type=text/plain
  Http_X_Start_Time=1716564766604284251
  Http_User_Agent=Go-http-client/1.1
  Http_X_Forwarded_Uri=/function/alpine.openfaas-fn
  Http_X_Call_Id=5637ac7c-bd72-4a57-94db-f7090d9a1c68
  ...

• Verified the bearer is included in the first call when the --auth flag is set.

  export FAAS_DEBUG=true
  echo | ./faas-cli invoke alpine --auth
  
  POST https://gw.example.com/function/alpine.openfaas-fn
  Content-Type: [text/plain]
  Authorization: Bearer REDACTED
  
  PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
  HOSTNAME=alpine-5b86546786-h667k
  jwt_auth=true
  OPENFAAS_NAME=alpine
  fprocess=env
  HOME=/home/app
  Http_User_Agent=Go-http-client/1.1
  Http_Accept_Encoding=gzip
  Http_Content_Type=text/plain
  Http_X_Call_Id=406c0a77-8b37-401e-a901-b68a4c7d32e4
  Http_Authorization=Bearer REDACTED
  Http_X_Forwarded_Uri=/function/alpine.openfaas-fn
  Http_X_Start_Time=1716565000220711406
  Http_Method=POST
  Http_Path=/
  ...

• Verified functions that require authentication can be invoked asynchronously.

  echo | ./faas-cli invoke alpine --auth --async
  
  POST https://gw.example.com/async-function/alpine.openfaas-fn
  Content-Type: [text/plain]
  Authorization: Bearer REDACTED
  
  Function submitted asynchronously.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I've read the CONTRIBUTION guide
• I have signed-off my commits with git commit -s
• I have added tests to cover my changes.
• All new and existing tests passed.

[alexellis]

In this example, I see the --auth flag mentioned, but it's not given in the example?

[welteki]

In this example, I see the --auth flag mentioned, but it's not given in the example?

This is a mistake, I updated the example and I can confirm the --auth flag is working.

[alexellis]

Why is the namespace needed now?

It should still be possible to invoke without a namespace suffix, so I'm unsure why this change was made.

[welteki]

The go-sdk which, is now used to invoke functions, always needs a namespace to be specified. This is required for getting access tokens for functions if the function is authenticated (the full reference to a function, including the namespace, is required to request an access token)

This is why a function will always be invoked in the default namespace openfaas-fn if no namespace is provided explicitly.

[alexellis]

Please could you respond to the comments?

[alexellis]

Approved