Support for basic auth via JWS tokens about vault-plugin-auth-kubernetes

[yesteph]

Vault should pass the token to create TokenReview to the kubernetes Host without check the format or validity of the token.
It is the responsibility of the Kubernetes Host (and so potentially Rancher, OpenShift, other proxy for federation, ...), not Vault.

[avoidik]

rancher authentication token is a base64 encoded string and being used for basic authentication, so no JWT token validation required at all to get access to k8s API behind it (yes, RBAC is disabled)

encoded token distributed as a part of kubectl config file

this is how rancher request looks like

token = base64encode('Basic ' + base64encode('<access key>:<secret key>'))
curl -H "Authorization: Bearer $token" https://<rancher_url>/r/projects/<id>/kubernetes:6443

for example it is possible to add one more flag to options (like use_basic_auth) and if this flag is set to true ignore everything related to JWT token validation, submit POST with that simplified token instead of JWT token to rancher url

[avoidik]

#20

[jefferai]

If Rancher has a totally different access mechanism it feels like it requires a different plugin. Over time this plugin is going to become more Kubernetes specific, not less.

[avoidik]

xref. rancher/rancher#30420

[avoidik]

xref. rancher/rancher#7504