Unable to login to auth/kubernetes backend using JWT about vault-plugin-auth-kubernetes

[briankassouf]

Hi @falzm,

How did you configure the auth backend? (https://www.vaultproject.io/api/auth/kubernetes/index.html#configure-method)

Did you provide a token_reviewer_jwt?

[falzm]

I've configured the auth backend this way:

$ vault write auth/kubernetes/config \
    kubernetes_host=https://x.x.x.x  \
    kubernetes_ca_cert=@k8s_ca.crt \
    token_reviewer_jwt=@vault_sa.token

With the referenced files generated such as:

$ export K8S_VAULT_SA_SECRET=$(kubectl get serviceaccount vault -o json | jq -r .secrets[0].name)

$ kubectl get secret ${K8S_VAULT_SA_SECRET} -o json | jq -r '.data["token"]' | base64 -d ; echo > vault_sa.token

$ kubectl get secret ${K8S_VAULT_SA_SECRET} -o json | jq -r '.data["ca.crt"]' | base64 -d > k8s_ca.crt

[falzm]

I've found the problem, it is the same as this one: my file vault_sa.token ends with a trailing newline character (\n) and Vault doesn't trim it out before passing the JWT to the k8s TokenReview API. By removing the trailing character it works as intended.

I'll submit a PR fixing this bug.