Comments (6)
Vault should pass the token to create TokenReview to the kubernetes Host without check the format or validity of the token.
It is the responsibility of the Kubernetes Host (and so potentially Rancher, OpenShift, other proxy for federation, ...), not Vault.
from vault-plugin-auth-kubernetes.
rancher authentication token is a base64 encoded string and being used for basic authentication, so no JWT token validation required at all to get access to k8s API behind it (yes, RBAC is disabled)
encoded token
distributed as a part of kubectl config file
this is how rancher request looks like
token = base64encode('Basic ' + base64encode('<access key>:<secret key>'))
curl -H "Authorization: Bearer $token" https://<rancher_url>/r/projects/<id>/kubernetes:6443
for example it is possible to add one more flag to options (like use_basic_auth) and if this flag is set to true ignore everything related to JWT token validation, submit POST with that simplified token
instead of JWT token to rancher url
from vault-plugin-auth-kubernetes.
from vault-plugin-auth-kubernetes.
If Rancher has a totally different access mechanism it feels like it requires a different plugin. Over time this plugin is going to become more Kubernetes specific, not less.
from vault-plugin-auth-kubernetes.
xref. rancher/rancher#30420
from vault-plugin-auth-kubernetes.
xref. rancher/rancher#7504
from vault-plugin-auth-kubernetes.
Related Issues (20)
- Make issuer validation work with Kubernetes 1.21+ by default HOT 6
- Rename disable_iss_validation HOT 1
- Re-configuring role fails after upgrading existing deployment to Vault 1.9.x HOT 4
- Authentication backend defined token_type is not override by role token_type HOT 1
- Allow specifying a namespace selector for the allowed namespace from which to authenticate
- BREAKING CHANGE: proposal: make `kubernetes_host` array to provide fallback mechanism and retry resiliency
- JWT signing algorithm ES384 became unsupported since version 0.13.0 HOT 1
- [docs] allow patching of roles HOT 14
- Unable to authenticate to external k8s cluster HOT 3
- Kubernetes API errors are not logged as errors HOT 5
- TLS errors after failed plugin initialization HOT 3
- CA cert on local disk is not reloaded if changed
- The audience claim is not checked, the parameter `audience` in the Kubernetes auth role is ineffective HOT 4
- Context Canceled on all authentication attempts for 10 minutes after an API node has shutdown HOT 14
- Unable to make Kubernetes requests: no such host HOT 1
- GitHub Actions - deprecated warnings found - action required!
- Support for path nesting like kv2 engine when nesting multiple kubernetes clusters configs in same path
- Add token_reviewer_jwt as login parameter
- Consider token lookup event configurable HOT 1
- How to bypass certificate check when connect to Kubernetes HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from vault-plugin-auth-kubernetes.