Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
WIP: Support using GenerateIdentityToken method for workload identity…
… auth
- Loading branch information
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -18,6 +18,7 @@ import ( | |
|
|
||
| "github.com/hashicorp/go-cleanhttp" | ||
| "github.com/hashicorp/vault/sdk/framework" | ||
|
Check failure on line 20 in backend.go
|
||
| "github.com/hashicorp/vault/sdk/helper/pluginutil" | ||
|
Check failure on line 21 in backend.go
|
||
| "github.com/hashicorp/vault/sdk/logical" | ||
|
Check failure on line 22 in backend.go
|
||
| ) | ||
|
|
||
|
|
@@ -326,13 +327,28 @@ func (b *kubeAuthBackend) loadConfig(ctx context.Context, s logical.Storage) (*k | |
| } | ||
|
|
||
| // Read local JWT token unless it was not stored in config. | ||
| if config.TokenReviewerJWT == "" && config.IdentityTokenAudience == "" { | ||
| config.TokenReviewerJWT, err = b.localSATokenReader.ReadFile() | ||
| if err != nil { | ||
| // Ignore error: make the best effort trying to load local JWT, | ||
| // otherwise the JWT submitted in login payload will be used. | ||
| b.Logger().Debug("failed to read local service account token, will use client token", "error", err) | ||
| } | ||
| } else if config.IdentityTokenAudience != "" { | ||
| resp, err := b.System().GenerateIdentityToken(ctx, pluginutil.IdentityTokenRequest{ | ||
| Key: config.IdentityTokenKey, | ||
| Audience: config.IdentityTokenAudience, | ||
| TTL: config.identityTokenTTL(), | ||
| }) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("failed to generate plugin identity token: %w", err) | ||
| } | ||
| b.Logger().Info("created plugin identity token", "token", resp.Token) | ||
| config.TokenReviewerJWT = resp.Token | ||
| if resp.TTL < config.identityTokenTTL() { | ||
| b.Logger().Debug("generated plugin identity token has shorter TTL than requested", | ||
| "requested", config.IdentityTokenTTLSeconds, "actual", resp.TTL) | ||
| } | ||
| } | ||
|
|
||
| // Read local CA cert unless it was stored in config. | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters