hashicorp / vault-plugin-auth-kubernetes

Vault authentication plugin for Kubernetes Service Accounts

https://www.vaultproject.io/docs/auth/kubernetes.html

Mozilla Public License 2.0

206 stars 62 forks source link

Switch from golang-jwt to cap+jose #151

Closed swenson closed 2 years ago

swenson commented 2 years ago

Overview

This caused stricter token checking around for Issued At and Expiration, so we cleaned up the tokens in the tests to be stored in plain JSON and signed as part of the test initialization to make it easier to see what is going on. This also means that the tests won't start mysteriously failing in 2030. :)

We also updated to the latest hashicorp/cap library to support Kubernetes 1.20 tokens.

Related Issues/Pull Requests

PR #148
PR #149 (old version of this PR)
PR https://github.com/hashicorp/cap/pull/50

Contributor Checklist

[x] Add relevant docs to upstream Vault repository, or sufficient reasoning why docs won’t be added yet
[x] Add output for any tests not ran in CI to the PR description (eg, acceptance tests)
[x] Backwards compatible

swenson commented 2 years ago

Thanks!