search

hashicorp / vault-plugin-auth-kubernetes

Vault authentication plugin for Kubernetes Service Accounts
https://www.vaultproject.io/docs/auth/kubernetes.html
Mozilla Public License 2.0
206 stars 62 forks source link

fix: validate JWT token on alias look ahead #114

Closed benashz closed 2 years ago

benashz commented 2 years ago

This PR adds support for validating that a request's JWT token contains the required claims for the bound role.

Design of Change

Validate the JWT token against a known Vault role. If it is deemed to be invalid return an error.

Note: the token is not passed to Kubernetes token review API, as this is only needed for login.