Comments (5)
Discussion continued here.
from vault-plugin-auth-kubernetes.
We're having this same problem in Vault v0.10.1. Even if the role has a period set, the issued token does not. The linked discussion above doesn't have a solution, and while it looks like there were some code changes since this discussion, it looks like this is still an issue.
What's the best way to work around this bug? Is there a fix available?
from vault-plugin-auth-kubernetes.
It's not a bug. Periods are only set directly on the token if the token was created via auth/token/create. Otherwise the period is controlled by the token issuer and its associated renew function.
from vault-plugin-auth-kubernetes.
In that case, what's the best way to generate periodic tokens using the Kubernetes auth backend?
The documentation (https://www.vaultproject.io/api/auth/kubernetes/index.html#create-role) seems to indicate that creating a role with a period should cause tokens issued using that role to have that period, but if I'm understanding your comment correctly, this doesn't seem to be the case.
from vault-plugin-auth-kubernetes.
When you create a token, does the TTL match the period value? When you renew it, does the TTL reset to the period value?
from vault-plugin-auth-kubernetes.
Related Issues (20)
- Make issuer validation work with Kubernetes 1.21+ by default HOT 6
- Rename disable_iss_validation HOT 1
- Re-configuring role fails after upgrading existing deployment to Vault 1.9.x HOT 4
- Authentication backend defined token_type is not override by role token_type HOT 1
- Allow specifying a namespace selector for the allowed namespace from which to authenticate
- BREAKING CHANGE: proposal: make `kubernetes_host` array to provide fallback mechanism and retry resiliency
- JWT signing algorithm ES384 became unsupported since version 0.13.0 HOT 1
- [docs] allow patching of roles HOT 14
- Unable to authenticate to external k8s cluster HOT 3
- Kubernetes API errors are not logged as errors HOT 5
- TLS errors after failed plugin initialization HOT 3
- CA cert on local disk is not reloaded if changed
- The audience claim is not checked, the parameter `audience` in the Kubernetes auth role is ineffective HOT 4
- Context Canceled on all authentication attempts for 10 minutes after an API node has shutdown HOT 14
- Unable to make Kubernetes requests: no such host HOT 1
- GitHub Actions - deprecated warnings found - action required!
- Support for path nesting like kv2 engine when nesting multiple kubernetes clusters configs in same path
- Add token_reviewer_jwt as login parameter
- Consider token lookup event configurable HOT 1
- How to bypass certificate check when connect to Kubernetes HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from vault-plugin-auth-kubernetes.