[CNCF LFX Proposal] OpenKruise: Open-Source JWT Token Issuance and ID Token Distribution

### CNCF Project

OpenKruise

### Term

2026 Term 3 (Sep-Nov)

### Program Name

Support identity provider based on keycloak etc.

### Program Description

* Description: OpenKruise Agents provides a Kubernetes-native platform for orchestrating AI agent sandboxes. With the recent merge of #648 (gateway-side JWT verification via OIDC) and #671 (TokenKind-based token issuance interface), the project now has the interfaces and scaffolding for standards-based token issuance and verification — but does not yet ship an open-source implementation that mints real signed tokens or propagates them into sandboxes.

This project will implement a complete open-source token lifecycle: signed JWT access token issuance, signed ID token issuance, an OIDC discovery and JWKS endpoint so the gateway verifier can bootstrap, and ID token distribution into the sandbox runtime. The implementation should also support integration with open-source identity providers such as Keycloak and Dex, giving community users a fully open-source, end-to-end signed-token authentication path. The implementation will integrate with the existing token refresh controller and claim/clone flows without changing the API contract or CRD schema.

* Expected Outcome:

* An open-source IdentityProvider that signs real JWT access tokens with asymmetric keys, with key rotation support

* An OIDC discovery and JWKS endpoint served by the sandbox-manager, eliminating the need for an external identity provider in community deployments

* Signed ID token issuance integrated with the existing SecurityTokenRefreshReconciler for automatic refresh before expiry

* A PropagateSecurityToken implementation that delivers the ID token into the sandbox runtime, with refresh-on-update and cleanup on sandbox lifecycle events

* End-to-end tests covering the full token lifecycle from claim through gateway verification to ID token propagation and refresh

* A design proposal and user-facing documentation

* Recommended Skills:

* Go programming (strong proficiency required)
* Kubernetes (CRDs, controllers, controller-runtime, Secrets, RBAC)
* JWT, OIDC, and JWKS concepts (token signing, claim design, key rotation)
* Cryptography fundamentals (asymmetric keys, RSA/ECDSA, X.509)
* Kubernetes operator patterns and reconciliation loops
* E2E testing (Ginkgo, pytest)

### Technologies

Go, Kubernetes, OIDC, JWT

### Skills same as Technologies?

- [x] Yes, the required skills are the same as the technologies listed above.

### Required/Desirable Skills

_No response_

### Mentors

Zhao Mingshan | @zmberg | berg.zms@gmail.com | bergzhao
Kai Shi | @BH4AWS | bh4aws@gmail.com | bh4aws

### Upstream Issue URL

https://github.com/openkruise/agents/issues/659

### Application Prerequisites

- [x] Resume
- [x] Cover Letter
- [ ] School Enrollment Verification
- [ ] Participation Permission from school or employer
- [ ] Coding Challenge
- [ ] Custom Prerequisite (fill in details below)

### Coding Challenge URL

_No response_

### Custom Prerequisite Name

_No response_

### Custom Prerequisite Description

_No response_

### Custom Prerequisite — File Upload

- [ ] Yes — completion of this task requires the mentee to submit a file.

---
**LFX program:** [CNCF - OpenKruise: Support identity provider based on keycloak etc. (2026 Term 3)](https://mentorship.lfx.linuxfoundation.org/project/9fd0145c-e463-481a-9cd9-f13f9dab8794)

Start by reading the interfaces and scaffolding from #648 and #671, then trace SecurityTokenRefreshReconciler, PropagateSecurityToken, and the sandbox-manager entry points. The work is done when signed access and ID tokens, discovery and JWKS endpoints, sandbox propagation and refresh/cleanup behavior, end-to-end lifecycle tests, and user-facing documentation are complete without changing the API contract or CRD schema.

Written by the indexing model from the issue text.