search

hashicorp / vault-k8s

First-class support for Vault and Kubernetes.
Mozilla Public License 2.0
786 stars 169 forks source link

Azure authentication method doesn't work with federated token #554

Open kchervonets opened 11 months ago

kchervonets commented 11 months ago

I have a service account in my AKS which I used to create a federated token. If I use this service account with my pod, the pod gets a AZURE_FEDERATED_TOKEN_FILE: /var/run/secrets/azure/tokens/azure-identity-token

if I try to login to the vault using azure methond and the following set of annotations on the same pod

  `azure.workload.identity/use: "true"
    vault.hashicorp.com/agent-inject: "true"
    vault.hashicorp.com/agent-init-first: "true"
    vault.hashicorp.com/namespace: "default"
    vault.hashicorp.com/role: "dev-role"
    vault.hashicorp.com/auth-path: "auth/azure"
    vault.hashicorp.com/auth-type: "azure"`

I have a vault-agent-init running with the following error:

2023-11-20T21:43:59.828Z [ERROR] agent.auth.handler: error getting path or data from method: error="error response in metadata from http://169.254.169.254/metadata/identity/oauth2/token: {\"error\":\"invalid_request\",\"error_description\":\"Identity not found\"}" backoff=4m48.84s

It does not seem like the federation token is supported by this method, does it?