A webhook token authenticator can assert which `audiences` a token is valid for:

https://github.com/kubernetes/kubernetes/blob/6d0aab2e38364d9d8e050b5f3a120a36ee588389/staging/src/k8s.io/api/authentication/v1/types.go#L91-L102

The empty list of `audiences` means "valid against the audience of the Kubernetes API server."

A JWT authenticator is unable to express this.  Instead, it can only express that "if you see any audience from this list, consider that equivalent to the audience of the Kubernetes API server."

```yaml
apiVersion: apiserver.config.k8s.io/v1beta1
kind: AuthenticationConfiguration
jwt:
- issuer:
    url: ...
    audiences:
    - audience1
    - audience2
    audienceMatchPolicy: MatchAny
  claimValidationRules: ...
...
```

For example, in the above config, `audience1` and `audience2` are considered equivalent to the API server audience (regardless of what the actual value of the API server audience is).

This means that if some "server" with audience `foo` wants to use the token review API for token verification, the "client" can only use either Kube SA tokens or tokens from a webhook authenticator to authenticate against that "server."  The workaround for the server would be to directly verify the token itself, but that would mean it would need to effectively implement the entire JWT authenticator logic itself.

One possible approach would be to allow for the use of a CEL expression to determine the `audiences`:

```yaml
apiVersion: apiserver.config.k8s.io/v1beta1
kind: AuthenticationConfiguration
jwt:
- issuer:
    url: ...
    audiences: null # must be empty
    audienceMatchPolicy: MatchViaCEL # allows the use of the audiencesExpression field
    # CEL expression that returns empty string array to mean
    # valid against the audience of the Kubernetes API server.
    # Otherwise the returned string array list is used to perform
    # an audience intersection check exactly as how it is performed
    # for the webhook token authenticator.
    audiencesExpression: "..."
  claimValidationRules: ...
...
```

/sig auth
/triage accepted

@aramase @liggitt 
jwt: should we allow assertion of non-Kubernetes API server audiences?
This is a GitHub Issue
repo:kubernetes
owner:kubernetes
Title : jwt: should we allow assertion of non-Kubernetes API server audiences?
Issue date:

--- start body ---
A webhook token authenticator can assert which `audiences` a token is valid for:

https://github.com/kubernetes/kubernetes/blob/6d0aab2e38364d9d8e050b5f3a120a36ee588389/staging/src/k8s.io/api/authentication/v1/types.go#L91-L102

The empty list of `audiences` means "valid against the audience of the Kubernetes API server."

A JWT authenticator is unable to express this.  Instead, it can only express that "if you see any audience from this list, consider that equivalent to the audience of the Kubernetes API server."

```yaml
apiVersion: apiserver.config.k8s.io/v1beta1
kind: AuthenticationConfiguration
jwt:
- issuer:
    url: ...
    audiences:
    - audience1
    - audience2
    audienceMatchPolicy: MatchAny
  claimValidationRules: ...
...
```

For example, in the above config, `audience1` and `audience2` are considered equivalent to the API server audience (regardless of what the actual value of the API server audience is).

This means that if some "server" with audience `foo` wants to use the token review API for token verification, the "client" can only use either Kube SA tokens or tokens from a webhook authenticator to authenticate against that "server."  The workaround for the server would be to directly verify the token itself, but that would mean it would need to effectively implement the entire JWT authenticator logic itself.

One possible approach would be to allow for the use of a CEL expression to determine the `audiences`:

```yaml
apiVersion: apiserver.config.k8s.io/v1beta1
kind: AuthenticationConfiguration
jwt:
- issuer:
    url: ...
    audiences: null # must be empty
    audienceMatchPolicy: MatchViaCEL # allows the use of the audiencesExpression field
    # CEL expression that returns empty string array to mean
    # valid against the audience of the Kubernetes API server.
    # Otherwise the returned string array list is used to perform
    # an audience intersection check exactly as how it is performed
    # for the webhook token authenticator.
    audiencesExpression: "..."
  claimValidationRules: ...
...
```

/sig auth
/triage accepted

@aramase @liggitt 
--- end body ---
