auth/kubernetes: support for dynamically reloading short-lived tokens #13595

tsaarni · 2022-01-07T17:00:49Z

This change is continuation to hashicorp/vault-plugin-auth-kubernetes#122 where support was added for dynamically reloading Kubernetes short-lived tokens for better Kubernetes 1.21+ compatibility. This change takes the feature into use in Vault.

Uplift new version of Kubernetes auth plugin that does not store the service account token persistently to Vault storage.
Update the documentation to recommend local token again when running Vault inside cluster.

Fixes #12855

Signed-off-by: Tero Saarni [email protected]

* Uplift new version of Kubernetes auth plugin that does not store the service account token persistently to Vault storage. * Update the documentation to recommend local token again when running Vault inside cluster. Signed-off-by: Tero Saarni <[email protected]>

tsaarni · 2022-01-07T17:05:56Z

go.mod

@@ -96,7 +96,7 @@ require (
 	github.com/hashicorp/vault-plugin-auth-gcp v0.11.3
 	github.com/hashicorp/vault-plugin-auth-jwt v0.11.4
 	github.com/hashicorp/vault-plugin-auth-kerberos v0.5.0
-	github.com/hashicorp/vault-plugin-auth-kubernetes v0.11.3
+	github.com/hashicorp/vault-plugin-auth-kubernetes v0.7.1-0.20220107030939-d289258274b7


@tvoran Would it be possible to tag a new release of vault-plugin-auth-kubernetes so that we can rever to proper version number?

We'll be tagging a new release of vault-plugin-auth-kubernetes later in Vault's release cycle, so this pseudo version is good for now.

tsaarni · 2022-01-07T17:13:40Z

@tomhjp, @tvoran I've sent this PR to uplift hashicorp/vault-plugin-auth-kubernetes#122 into Vault.

I added proposal for documentation changes, though I feel they are maybe bit unnecessarily complicated for in-cluster deployment. User should not need to be aware about short-lived tokens anymore as reloading is transparent - though I guess the information is necessary since user can be running older version of Vault.

(for running Vault outside-cluster, I'm not sure if copying service account tokens from cluster has ever been that good idea - I think client cert support might have been better)

Signed-off-by: Tero Saarni <[email protected]>

tvoran · 2022-01-07T18:42:12Z

go.mod

@@ -96,7 +96,7 @@ require (
 	github.com/hashicorp/vault-plugin-auth-gcp v0.11.3
 	github.com/hashicorp/vault-plugin-auth-jwt v0.11.4
 	github.com/hashicorp/vault-plugin-auth-kerberos v0.5.0
-	github.com/hashicorp/vault-plugin-auth-kubernetes v0.11.3
+	github.com/hashicorp/vault-plugin-auth-kubernetes v0.7.1-0.20220107030939-d289258274b7


We'll be tagging a new release of vault-plugin-auth-kubernetes later in Vault's release cycle, so this pseudo version is good for now.

tvoran · 2022-01-07T18:42:23Z

changelog/13595.txt

@@ -0,0 +1,2 @@
+```release-note:improvement
+auth/kubernetes: Added support for short-lived tokens for Kubernetes 1.21+ compatibility


How about adding "dynamically reloading" somewhere in here? Previously, short-lived tokens worked, just not well :)

Suggested change

auth/kubernetes: Added support for short-lived tokens for Kubernetes 1.21+ compatibility

auth/kubernetes: Added support for dynamically reloading short-lived tokens for better Kubernetes 1.21+ compatibility

```

go.sum

tomhjp

Thanks for raising this! A few small suggestions. This should definitely make it into 1.10. For now we should probably just get this merged into main, and then it will automatically go live on the website when 1.10 gets released but not before.

tomhjp · 2022-01-11T14:49:28Z

website/content/docs/auth/kubernetes.mdx

@@ -155,6 +154,7 @@ table summarizes the options, each of which is explained in more detail below.

 | Option                               | All tokens are short-lived | Can revoke tokens early | Other considerations |
 | ------------------------------------ | -------------------------- | ----------------------- | -------------------- |
+| Use local token as reviewer JWT      | Yes                        | Yes                     | Requires Vault VERSION_TODO |


Suggested change

| Use local token as reviewer JWT | Yes | Yes | Requires Vault VERSION_TODO |

| Use local token as reviewer JWT | Yes | Yes | Requires Vault (1.10+) to be deployed on the Kubernetes cluster |

tomhjp · 2022-01-11T14:55:54Z

website/content/docs/auth/kubernetes.mdx

+    kubernetes_host=https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_PORT
+```
+
+!> **Note:** Requires Vault VERSION_TODO. In earlier versions the service account


Suggested change

!> **Note:** Requires Vault VERSION_TODO. In earlier versions the service account

!> **Note:** Requires Vault 1.10+. In earlier versions the service account

tomhjp · 2022-01-11T14:58:05Z

website/content/docs/auth/kubernetes.mdx

@@ -168,6 +168,23 @@ short-lived tokens. If you would like to disable this, set

 [k8s-extended-tokens]: https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/#options

+#### Use local service account token as the reviewer JWT
+
+When running Vault in a Kubernetes pod the recommended option is to use local


Suggested change

When running Vault in a Kubernetes pod the recommended option is to use local

When running Vault in a Kubernetes pod the recommended option is to use the pod's local

tomhjp · 2022-01-11T15:08:09Z

website/content/docs/auth/kubernetes.mdx

+short-lived tokens. Local token and CA certificate are used by configuring the
+auth method without setting `token_reviewer_jwt` and `kubernetes_ca_cert`.


Suggested change

short-lived tokens. Local token and CA certificate are used by configuring the

auth method without setting `token_reviewer_jwt` and `kubernetes_ca_cert`.

short-lived tokens. To use the local token and CA certificate, omit

`token_reviewer_jwt` and `kubernetes_ca_cert` when configuring the auth method.

Vault will attempt to load them from `token` and `ca.crt` respectively inside

the default mount folder `/var/run/secrets/kubernetes.io/serviceaccount/`.

The first half of the suggestion is just re-wording. With the second half, I was trying to demystify how it works, but perhaps it's too detailed. Take or leave the suggestions as you like :)

This is good clarification, thanks! Taken it as such :)

…#13595) * auth/kubernetes: support for short-lived tokens * Uplift new version of Kubernetes auth plugin that does not store the service account token persistently to Vault storage. * Update the documentation to recommend local token again when running Vault inside cluster. Signed-off-by: Tero Saarni <[email protected]> * Added changelog entry Signed-off-by: Tero Saarni <[email protected]> * clarification to changelog entry, executed go mod tidy * clarifications and added targeted release version

…lived tokens into release/1.9.x (#13698) * auth/kubernetes: support for dynamically reloading short-lived tokens (#13595) * auth/kubernetes: support for short-lived tokens * Uplift new version of Kubernetes auth plugin that does not store the service account token persistently to Vault storage. * Update the documentation to recommend local token again when running Vault inside cluster. Signed-off-by: Tero Saarni <[email protected]> * Added changelog entry Signed-off-by: Tero Saarni <[email protected]> * clarification to changelog entry, executed go mod tidy * clarifications and added targeted release version * update available version to 1.9.3+ and changelog renamed changelog file to the backport pr number. * update go.mod to [email protected] Co-authored-by: Tero Saarni <[email protected]> Co-authored-by: Theron Voran <[email protected]>

tsaarni requested a review from taoism4504 as a code owner January 7, 2022 17:00

vercel bot temporarily deployed to Preview – vault-storybook January 7, 2022 17:00 Inactive

tsaarni commented Jan 7, 2022

View reviewed changes

Added changelog entry

690fe6f

Signed-off-by: Tero Saarni <[email protected]>

vercel bot temporarily deployed to Preview – vault-storybook January 7, 2022 17:18 Inactive

heatherezell added auth/k8s ecosystem labels Jan 7, 2022

heatherezell requested a review from tvoran January 7, 2022 17:25

tvoran reviewed Jan 7, 2022

View reviewed changes

tvoran requested a review from tomhjp January 7, 2022 20:56

clarification to changelog entry, executed go mod tidy

a69405e

vercel bot temporarily deployed to Preview – vault-storybook January 8, 2022 08:32 Inactive

tsaarni changed the title ~~auth/kubernetes: support for short-lived tokens~~ auth/kubernetes: support for dynamically reloading short-lived tokens Jan 8, 2022

tomhjp reviewed Jan 11, 2022

View reviewed changes

clarifications and added targeted release version

6dc21ce

vercel bot temporarily deployed to Preview – vault-storybook January 12, 2022 07:23 Inactive

tvoran approved these changes Jan 15, 2022

View reviewed changes

tvoran merged commit 3f7dd79 into hashicorp:main Jan 15, 2022

tvoran added the backport/1.9.x label Jan 19, 2022

hc-github-team-secure-vault-core mentioned this pull request Jan 19, 2022

Backport of auth/kubernetes: support for dynamically reloading short-lived tokens into release/1.9.x #13698

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

auth/kubernetes: support for dynamically reloading short-lived tokens #13595

auth/kubernetes: support for dynamically reloading short-lived tokens #13595

tsaarni commented Jan 7, 2022 •

edited

Loading

tsaarni Jan 7, 2022

tvoran Jan 7, 2022

tsaarni commented Jan 7, 2022

tvoran Jan 7, 2022

tvoran Jan 7, 2022

tsaarni Jan 8, 2022

tomhjp left a comment

tomhjp Jan 11, 2022

tsaarni Jan 12, 2022

tomhjp Jan 11, 2022

tsaarni Jan 12, 2022

tomhjp Jan 11, 2022

tsaarni Jan 12, 2022

tomhjp Jan 11, 2022

tsaarni Jan 12, 2022

		@@ -0,0 +1,2 @@
		```release-note:improvement
		auth/kubernetes: Added support for short-lived tokens for Kubernetes 1.21+ compatibility

	auth/kubernetes: Added support for short-lived tokens for Kubernetes 1.21+ compatibility
	auth/kubernetes: Added support for dynamically reloading short-lived tokens for better Kubernetes 1.21+ compatibility
	```

	\| Use local token as reviewer JWT \| Yes \| Yes \| Requires Vault VERSION_TODO \|
	\| Use local token as reviewer JWT \| Yes \| Yes \| Requires Vault (1.10+) to be deployed on the Kubernetes cluster \|

	!> Note: Requires Vault VERSION_TODO. In earlier versions the service account
	!> Note: Requires Vault 1.10+. In earlier versions the service account

	When running Vault in a Kubernetes pod the recommended option is to use local
	When running Vault in a Kubernetes pod the recommended option is to use the pod's local

		short-lived tokens. Local token and CA certificate are used by configuring the
		auth method without setting `token_reviewer_jwt` and `kubernetes_ca_cert`.

-short-lived tokens. Local token and CA certificate are used by configuring the
-auth method without setting `token_reviewer_jwt` and `kubernetes_ca_cert`.
+short-lived tokens. To use the local token and CA certificate, omit
+`token_reviewer_jwt` and `kubernetes_ca_cert` when configuring the auth method.
+Vault will attempt to load them from `token` and `ca.crt` respectively inside
+the default mount folder `/var/run/secrets/kubernetes.io/serviceaccount/`.

auth/kubernetes: support for dynamically reloading short-lived tokens #13595

auth/kubernetes: support for dynamically reloading short-lived tokens #13595

Conversation

tsaarni commented Jan 7, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tsaarni commented Jan 7, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tomhjp left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tsaarni commented Jan 7, 2022 •

edited

Loading