Cannot register vault-plugin-auth-kubernetes plugin about vault-plugin-auth-kubernetes

[kelseyhightower]

Looks like TLS might have been the issue.

If I change my vault config to the following:

disable_mlock = true

listener "tcp" {
      address = "0.0.0.0:8200"
      tls_disable = 1
}
plugin_directory = "/usr/local/libexec/vault"

storage "consul" {
      address = "127.0.0.1:8500"
      path = "vault/"
}

I'm not able to configure the vault auth plugin:

vault write auth/kubernetes/config \
  kubernetes_host=https://35.197.84.128 \
  [email protected]

Success! Data written to: auth/kubernetes/config

[kelseyhightower]

Note: I normally run vault with tls_require_and_verify_client_cert set to true, but have disabled it for testing this plugin.

[briankassouf]

Hi @kelseyhightower,

Because plugins use the normal vault API to unwrap a one time use Vault token they need to access the Vault API. When using tls_require_and_verify_client_cert plugins will need to be configured with the TLS client certs. Try running this catalog command instead:

vault write sys/plugins/catalog/kubernetes \
  sha_256=7da474c70fd4d3ce14508fd19a4cae8160e1f47ebe365e077fd0f8094d1dfacb \
  command="vault-plugin-auth-kubernetes --ca-cert=/etc/vault/tls/ca.pem --client-cert=/etc/vault/tls/vault.pem --client-key=/etc/vault/tls/vault-key.pem"

And replace the paths with the appropriate values for the client cert/key

[briankassouf]

Going to close this since the above command should have fixed the issue

[bernielomax]

I am getting the same issue as @kelseyhightower even with valid certificates defined. My plugin is just a copy of the mock plugin in vault source. I can confirm that the client certificates do work using environment variables against the vault client. Perhaps my issue is with the plugin itself and not the certs?

[jefferai]

If you are having issues with a custom plugin, please raise an issue against the main Vault repo.