Can't issue tokens about vault-plugin-auth-kubernetes

[jefferai]

That doesn't seem like a CA error, it seems like an input error. Can you verify that the parameters you're passing in are what you expect?

[mvisonneau]

MY_ROLE is a role that is configured on the cluster and MY_JWT_TOKEN is in the correct format. I have the same result when not interpolating and directly passing the content of the values.

[jefferai]

@briankassouf any idea offhand?

[briankassouf]

Hi @mvisonneau

How did you configure the the backend, specifically the https://www.vaultproject.io/api/auth/kubernetes/index.html#configure-method endpoint?

[mvisonneau]

So this is what I ended up doing in terms of config :

• kubernernetes_host: https://rancher.rocks/r/projects/1a1337/kubernetes:6443
  The Kubernetes endpoint that I get from Rancher

• kubernetes_ca_cert: -----BEGIN CERTIFICATE-----[..]
  The CA chain that I fetched from AWS

• token_reviewer_jwt: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ[..]
  Base64 decoded token of the SA I created for Vault.

• I left pem_keys empty

I also tried once to add the ca.crt of kubernetes, used for tokens signatures in both kubernetes_ca_cert and pem_keys without success.

[mvisonneau]

I just retried using a LetsEncrypt certificate, still the same issue :( continuing to investigate..!

[mvisonneau]

Ok, I seem to have found the issue. Rancher does not authorise external access on the Kubernetes cluster API with a service account token. It has to be through their own auth mechanism, unfortunately this is not a JWT.

When trying to authenticate using the one generated, the API returns a 302, hence the parsing error I guess.

[jefferai]

That's a shame. Open a request with Rancher I guess?

[mvisonneau]

Yes, I'll give it a second try by removing the jws parsing on the token_reviewer_jwt I believe it should be enough even though it's definitely not a valid solution. I'm also working on the AWS EKS preview and it only supports IAM based authentication against the K8S API which implies the same difficulties. I'm wondering what would be the best approach. :/

Closing it for now. Thanks for your help 🙏!