Add --audience-claim for GCR Receivers

Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>

cmd/flux/create_secret_receiver.go

@@ -59,6 +59,7 @@ type secretReceiverFlags struct {
 	token         string
 	hostname      string
 	emailClaim    string
+	audienceClaim string
 }
 
 var secretReceiverArgs secretReceiverFlags
@@ -68,6 +69,7 @@ func init() {
 	createSecretReceiverCmd.Flags().StringVar(&secretReceiverArgs.token, "token", "", "webhook token used for payload validation and URL computation, auto-generated if not specified")
 	createSecretReceiverCmd.Flags().StringVar(&secretReceiverArgs.hostname, "hostname", "", "hostname for the webhook URL e.g. flux.example.com")
 	createSecretReceiverCmd.Flags().StringVar(&secretReceiverArgs.emailClaim, "email-claim", "", "IAM service account email, required for gcr type")
+	createSecretReceiverCmd.Flags().StringVar(&secretReceiverArgs.audienceClaim, "audience-claim", "", "custom OIDC token audience for gcr type, defaults to the webhook URL")
 
 	createSecretCmd.AddCommand(createSecretReceiverCmd)
 }
@@ -100,6 +102,7 @@ func createSecretReceiverCmdRun(cmd *cobra.Command, args []string) error {
 		Token:         secretReceiverArgs.token,
 		Hostname:      secretReceiverArgs.hostname,
 		EmailClaim:    secretReceiverArgs.emailClaim,
+		AudienceClaim: secretReceiverArgs.audienceClaim,
 	}
 
 	secret, err := sourcesecret.GenerateReceiver(opts)

cmd/flux/create_secret_receiver_test.go

@@ -56,6 +56,11 @@ func TestCreateReceiverSecret(t *testing.T) {
 			args:   "create secret receiver gcr-secret --type=gcr --token=test-token --hostname=flux.example.com --email-claim=sa@project.iam.gserviceaccount.com --namespace=my-namespace --export",
 			assert: assertGoldenFile("testdata/create_secret/receiver/secret-receiver-gcr.yaml"),
 		},
+		{
+			name:   "gcr receiver secret with custom audience",
+			args:   "create secret receiver gcr-secret --type=gcr --token=test-token --hostname=flux.example.com --email-claim=sa@project.iam.gserviceaccount.com --audience-claim=https://custom.audience.example.com --namespace=my-namespace --export",
+			assert: assertGoldenFile("testdata/create_secret/receiver/secret-receiver-gcr-audience.yaml"),
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {

cmd/flux/testdata/create_secret/receiver/secret-receiver-gcr-audience.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  annotations:
+    notification.toolkit.fluxcd.io/webhook: https://flux.example.com/hook/6d6c55e9affb9d1e0d101ce604ae4270880ec1ff24d1bd2d928fcd64243d21a4
+  name: gcr-secret
+  namespace: my-namespace
+stringData:
+  audience: https://custom.audience.example.com
+  email: sa@project.iam.gserviceaccount.com
+  token: test-token
+

pkg/manifestgen/sourcesecret/options.go

@@ -94,6 +94,7 @@ type Options struct {
 	Token         string
 	Hostname      string
 	EmailClaim    string
+	AudienceClaim string
 }
 
 type VerificationCrt struct {

pkg/manifestgen/sourcesecret/sourcesecret.go

@@ -306,8 +306,12 @@ func GenerateReceiver(options Options) (*manifestgen.Manifest, error) {
 			return nil, fmt.Errorf("email-claim is required for gcr receiver type")
 		}
 		secret.StringData[EmailSecretKey] = options.EmailClaim
+		if options.AudienceClaim != "" {
+			secret.StringData[AudienceSecretKey] = options.AudienceClaim
+		} else {
 			secret.StringData[AudienceSecretKey] = webhookURL
 		}
+	}
 
 	return secretToManifest(secret, options)
 }