Comments (6)
Looks like TLS might have been the issue.
If I change my vault config to the following:
disable_mlock = true
listener "tcp" {
address = "0.0.0.0:8200"
tls_disable = 1
}
plugin_directory = "/usr/local/libexec/vault"
storage "consul" {
address = "127.0.0.1:8500"
path = "vault/"
}
I'm not able to configure the vault auth plugin:
vault write auth/kubernetes/config \
kubernetes_host=https://35.197.84.128 \
[email protected]
Success! Data written to: auth/kubernetes/config
from vault-plugin-auth-kubernetes.
Note: I normally run vault with tls_require_and_verify_client_cert
set to true, but have disabled it for testing this plugin.
from vault-plugin-auth-kubernetes.
Hi @kelseyhightower,
Because plugins use the normal vault API to unwrap a one time use Vault token they need to access the Vault API. When using tls_require_and_verify_client_cert
plugins will need to be configured with the TLS client certs. Try running this catalog command instead:
vault write sys/plugins/catalog/kubernetes \
sha_256=7da474c70fd4d3ce14508fd19a4cae8160e1f47ebe365e077fd0f8094d1dfacb \
command="vault-plugin-auth-kubernetes --ca-cert=/etc/vault/tls/ca.pem --client-cert=/etc/vault/tls/vault.pem --client-key=/etc/vault/tls/vault-key.pem"
And replace the paths with the appropriate values for the client cert/key
from vault-plugin-auth-kubernetes.
Going to close this since the above command should have fixed the issue
from vault-plugin-auth-kubernetes.
I am getting the same issue as @kelseyhightower even with valid certificates defined. My plugin is just a copy of the mock plugin in vault source. I can confirm that the client certificates do work using environment variables against the vault client. Perhaps my issue is with the plugin itself and not the certs?
from vault-plugin-auth-kubernetes.
If you are having issues with a custom plugin, please raise an issue against the main Vault repo.
from vault-plugin-auth-kubernetes.
Related Issues (20)
- Make issuer validation work with Kubernetes 1.21+ by default HOT 6
- Rename disable_iss_validation HOT 1
- Re-configuring role fails after upgrading existing deployment to Vault 1.9.x HOT 4
- Authentication backend defined token_type is not override by role token_type HOT 1
- Allow specifying a namespace selector for the allowed namespace from which to authenticate
- BREAKING CHANGE: proposal: make `kubernetes_host` array to provide fallback mechanism and retry resiliency
- JWT signing algorithm ES384 became unsupported since version 0.13.0 HOT 1
- [docs] allow patching of roles HOT 14
- Unable to authenticate to external k8s cluster HOT 3
- Kubernetes API errors are not logged as errors HOT 5
- TLS errors after failed plugin initialization HOT 3
- CA cert on local disk is not reloaded if changed
- The audience claim is not checked, the parameter `audience` in the Kubernetes auth role is ineffective HOT 4
- Context Canceled on all authentication attempts for 10 minutes after an API node has shutdown HOT 14
- Unable to make Kubernetes requests: no such host HOT 1
- GitHub Actions - deprecated warnings found - action required!
- Support for path nesting like kv2 engine when nesting multiple kubernetes clusters configs in same path
- Add token_reviewer_jwt as login parameter
- Consider token lookup event configurable HOT 1
- How to bypass certificate check when connect to Kubernetes HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from vault-plugin-auth-kubernetes.