NVIDIA / NVIDIA/ai-cloud-validation
bug: K8sOidcIssuerCheck: proves the wrong path — authenticated kubectl, never the anonymous JWKS fetch
Open
Beginner friendly
Nobody has claimed this yet.
bug
kubernetes
priority-0
- Dominant language
- Python
- Stars
- 27
- Forks
- 33
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 28
Description
Fetches discovery doc through the API server with authenticated kubectl. Requirement is anonymous external reachability — the opposite path. Never fetches jwks_uri, so a 404 JWKS passes
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the K8sOidcIssuerCheck implementation and its existing tests. Trace how it fetches the discovery document, then verify the check uses anonymous external access and also fetches the advertised jwks_uri. Done means an unreachable or 404 JWKS endpoint fails validation instead of passing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes, python
- Domain
- authentication, testing
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100