Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Docs deprecate token issuer validation #13019

Merged
merged 15 commits into from
Nov 18, 2021
Merged

Docs deprecate token issuer validation #13019

Show file tree
Hide file tree
Changes from 14 commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
f7a98ce
change default vaule for disable_iss_validation to be true
imthaghost Nov 2, 2021
fb844b0
mark as deprecated | remove issuer from sample
imthaghost Nov 5, 2021
90e942c
deprecation section
imthaghost Nov 9, 2021
80f2fe7
additional informaiton about when fields will be removed
imthaghost Nov 10, 2021
94c5cae
additional deprecation note under csi provider
imthaghost Nov 10, 2021
a9b5b4f
punctuation
imthaghost Nov 10, 2021
c82e850
make the deprecation note more noticable
imthaghost Nov 17, 2021
f506f51
missing issuer sentence | remove whitespace
imthaghost Nov 18, 2021
8a916bd
Merge branch 'main' into docs/k8s-issuer-validation
imthaghost Nov 18, 2021
944b787
Update website/content/docs/platform/k8s/csi/index.mdx
imthaghost Nov 18, 2021
ed47e3c
cleanup
imthaghost Nov 18, 2021
3369416
additional deprecation comments
imthaghost Nov 18, 2021
c886898
fix discovery link
imthaghost Nov 18, 2021
306e526
highlight
imthaghost Nov 18, 2021
1ff8749
no need to configure the issuer
imthaghost Nov 18, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 9 additions & 4 deletions website/content/api-docs/auth/kubernetes.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,11 +37,17 @@ access the Kubernetes API.
JWTs. If a certificate is given, its public key will be
extracted. Not every installation of Kubernetes exposes these
keys.
- `issuer` `(string: "")` - Optional JWT issuer. If no issuer is specified, then this plugin will
use `kubernetes/serviceaccount` as the default issuer. See [these instructions](/docs/platform/k8s/csi#setting-issuer-for-kubernetes-authentication) for looking up the issuer for a given Kubernetes cluster.
- `disable_iss_validation` `(bool: false)` - Disable JWT issuer validation. Allows to skip ISS validation.
- `disable_local_ca_jwt` `(bool: false)` - Disable defaulting to the local CA cert and service account JWT when running in a Kubernetes pod.

### Deprecated Parameters

-> The following fields have been deprecated and will be removed in a future release:

- `disable_iss_validation` `(bool: true)` **Deprecated** Disable JWT issuer validation. Allows to skip ISS validation.

- `issuer` `(string: "")` **Deprecated** Optional JWT issuer. If no issuer is specified, then this plugin will use `kubernetes/serviceaccount` as the default issuer.
See [these instructions](/docs/auth/kubernetes#discovering-the-service-account-issuer) for looking up the issuer for a given Kubernetes cluster.

### Caveats

If Vault is running in a Kubernetes Pod, the `kubernetes_ca_cert` and
Expand Down Expand Up @@ -97,7 +103,6 @@ $ curl \
"kubernetes_host": "https://192.168.99.100:8443",
"kubernetes_ca_cert": "-----BEGIN CERTIFICATE-----.....-----END CERTIFICATE-----",
"pem_keys": ["-----BEGIN CERTIFICATE-----.....", .....],
"disable_iss_validation": false,
"disable_local_ca_jwt": false
}
}
Expand Down
2 changes: 2 additions & 0 deletions website/content/docs/auth/kubernetes.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,8 @@ management tool.

### Discovering the service account `issuer`

-> **Deprecated:** The `issuer` parameter has been deprecated as of Vault 1.9 and will be removed in a future release.

Kubernetes 1.21+ clusters may require setting the service account
[`issuer`](/api-docs/auth/kubernetes#issuer) to the same value as
`kube-apiserver`'s `--service-account-issuer` flag. This is because the service
Expand Down
2 changes: 2 additions & 0 deletions website/content/docs/platform/k8s/csi/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,8 @@ account provided to pods if no service account is defined.

### Setting `issuer` for Kubernetes authentication

-> **Deprecated:** The `issuer` parameter has been deprecated as of Vault 1.9 and will be removed in a future release.
imthaghost marked this conversation as resolved.
Show resolved Hide resolved

You will likely need to set [`issuer`](/api-docs/auth/kubernetes#issuer) when
configuring Kubernetes authentication for the Vault CSI Provider.
Vault CSI Provider does not use the default token associated with service accounts.
Expand Down