hashicorp / vault-plugin-auth-kubernetes

Vault authentication plugin for Kubernetes Service Accounts

https://www.vaultproject.io/docs/auth/kubernetes.html

Mozilla Public License 2.0

206 stars 62 forks source link

VAULT-2003 WIP switch to cap + jose #149

Closed swenson closed 2 years ago

swenson commented 2 years ago

Overview

Remove golang-jwt library direct dependency
Use cap for checking JWT claims
Add additional integration tests to cover more cases
Switch to gofumpt to match vault
Clean up token handing and signing in tests

This mostly pays down technical debt and should hopefully make it easier to work with our JWT code moving forward.

This should cause minimal user-facing changes (notably there might be slight differences in the status code messages when signatures are invalid).

Related Issues/Pull Requests

30
33
Replaces #148

Contributor Checklist

[x] Add relevant docs to upstream Vault repository, or sufficient reasoning why docs won’t be added yet (no user-facing changes made)
[x] Add output for any tests not ran in CI to the PR description (eg, acceptance tests)
[x] Backwards compatible

swenson commented 2 years ago

I'll close this for now in favor of #148 but keep the branch for if we want to circle back to it later.