hashicorp / vault-plugin-auth-kubernetes

Vault authentication plugin for Kubernetes Service Accounts
https://www.vaultproject.io/docs/auth/kubernetes.html
Mozilla Public License 2.0
207 stars 61 forks source link

Read config endpoint does not indicate if token_reviewer_jwt is set #68

Open coryflucas opened 5 years ago

coryflucas commented 5 years ago

Currently since the read config endpoint does not expose the token_reviewer_jwt field for security reasons, but there is no indication if it is set or not. Because this field is optional, it doesn't seem to be possible to tell if its set other than trying to login with a kubernetes JWT that does not have access to the token reviewer API. It would be nice if the API returned the token_reviewer_jwt masked, or just a field that indicate it was set (something like token_reviewer_jwt_provided as a boolean).

Happy to provide a PR if this is something you'd be interested in supporting.

Thanks for the great product!

pschulten commented 3 years ago

@coryflucas if you set up the config with terraform you can check if token_reviewer_jwt is set in the state file

komapa commented 1 year ago

You should really just return the sha256 of the value so you can allow tools like terraform to fix drift. That will solve 99.9% of the use cases to get it from the config api endpoint