search

hashicorp / vault-secrets-operator

The Vault Secrets Operator (VSO) allows Pods to consume Vault secrets natively from Kubernetes Secrets.
https://hashicorp.com
Other
471 stars 102 forks source link

Call signJwt endpoint rather than generateIdToken for GCP JWT's #892

Open jameshartig opened 3 months ago

jameshartig commented 3 months ago

Is your feature request related to a problem? Please describe. Currently VSO generates JWTs that are 1 hour long using the generateIdToken endpoint, which is longer than the default max_jwt_exp on the Vault side leading to errors unless you manually increase max_jwt_exp.

Describe the solution you'd like Instead, the signJwt endpoint could be used and exp could be set to a shorter value. I believe the existing iamcredentials package has a SignJwt method that could be used instead and the response includes a SignedJwt string that I believe is the same format as the existing token response.

Describe alternatives you've considered Alternatively we can just increase the max_jwt_exp but it would be good if vault-secrets-operator worked with the defaults and the change seems small.

Additional context

tvoran commented 2 months ago

Hi @jameshartig, I'm fairly sure we tried the signJwt endpoint at first, but it wasn't working correctly for this auth flow. The people we talked with at Google recommended generateIdToken instead. Perhaps something's changed in the meantime?

jameshartig commented 2 months ago

@tvoran I appreciate the context. I'll work on an MR and test it in our environment. Let me also see if I can get someone from Google to confirm either way.