Comments (9)
That doesn't seem like a CA error, it seems like an input error. Can you verify that the parameters you're passing in are what you expect?
from vault-plugin-auth-kubernetes.
MY_ROLE
is a role that is configured on the cluster and MY_JWT_TOKEN
is in the correct format. I have the same result when not interpolating and directly passing the content of the values.
from vault-plugin-auth-kubernetes.
@briankassouf any idea offhand?
from vault-plugin-auth-kubernetes.
Hi @mvisonneau
How did you configure the the backend, specifically the https://www.vaultproject.io/api/auth/kubernetes/index.html#configure-method endpoint?
from vault-plugin-auth-kubernetes.
So this is what I ended up doing in terms of config :
-
kubernernetes_host
: https://rancher.rocks/r/projects/1a1337/kubernetes:6443
The Kubernetes endpoint that I get from Rancher -
kubernetes_ca_cert
: -----BEGIN CERTIFICATE-----[..]
The CA chain that I fetched from AWS -
token_reviewer_jwt
: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ[..]
Base64 decoded token of the SA I created for Vault. -
I left
pem_keys
empty
I also tried once to add the ca.crt
of kubernetes, used for tokens signatures in both kubernetes_ca_cert
and pem_keys
without success.
from vault-plugin-auth-kubernetes.
I just retried using a LetsEncrypt certificate, still the same issue :( continuing to investigate..!
from vault-plugin-auth-kubernetes.
Ok, I seem to have found the issue. Rancher does not authorise external access on the Kubernetes cluster API with a service account token. It has to be through their own auth mechanism, unfortunately this is not a JWT.
When trying to authenticate using the one generated, the API returns a 302, hence the parsing error I guess.
from vault-plugin-auth-kubernetes.
That's a shame. Open a request with Rancher I guess?
from vault-plugin-auth-kubernetes.
Yes, I'll give it a second try by removing the jws parsing on the token_reviewer_jwt
I believe it should be enough even though it's definitely not a valid solution. I'm also working on the AWS EKS preview and it only supports IAM based authentication against the K8S API which implies the same difficulties. I'm wondering what would be the best approach. :/
Closing it for now. Thanks for your help 🙏!
from vault-plugin-auth-kubernetes.
Related Issues (20)
- Make issuer validation work with Kubernetes 1.21+ by default HOT 6
- Rename disable_iss_validation HOT 1
- Re-configuring role fails after upgrading existing deployment to Vault 1.9.x HOT 4
- Authentication backend defined token_type is not override by role token_type HOT 1
- Allow specifying a namespace selector for the allowed namespace from which to authenticate
- BREAKING CHANGE: proposal: make `kubernetes_host` array to provide fallback mechanism and retry resiliency
- JWT signing algorithm ES384 became unsupported since version 0.13.0 HOT 1
- [docs] allow patching of roles HOT 14
- Unable to authenticate to external k8s cluster HOT 3
- Kubernetes API errors are not logged as errors HOT 5
- TLS errors after failed plugin initialization HOT 3
- CA cert on local disk is not reloaded if changed
- The audience claim is not checked, the parameter `audience` in the Kubernetes auth role is ineffective HOT 4
- Context Canceled on all authentication attempts for 10 minutes after an API node has shutdown HOT 14
- Unable to make Kubernetes requests: no such host HOT 1
- GitHub Actions - deprecated warnings found - action required!
- Support for path nesting like kv2 engine when nesting multiple kubernetes clusters configs in same path
- Add token_reviewer_jwt as login parameter
- Consider token lookup event configurable HOT 1
- How to bypass certificate check when connect to Kubernetes HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from vault-plugin-auth-kubernetes.