scottk/vault
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/vault.git synced 2025-11-01 19:17:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

Docs deprecate token issuer validation (#13019)

Browse Source 
* change default vaule for disable_iss_validation to be true

* mark as deprecated | remove issuer from sample

* deprecation section

* additional informaiton about when fields will be removed

* additional deprecation note under csi provider

* punctuation

* make the deprecation note more noticable

* missing issuer sentence | remove whitespace

* Update website/content/docs/platform/k8s/csi/index.mdx

Co-authored-by: Ben Ash <32777270+benashz@users.noreply.github.com>

* cleanup

* additional deprecation comments

* fix discovery link

* highlight

* no need to configure the issuer

Co-authored-by: Ben Ash <32777270+benashz@users.noreply.github.com>
This commit is contained in:
Gary Frederick
2021-11-18 15:16:54 -08:00
committed by GitHub
parent 1804ac1efd
commit bd09f70fa2
3 changed files with 14 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
website/content/api-docs/auth/kubernetes.mdx
View File

@@ -37,11 +37,17 @@ access the Kubernetes API.
JWTs. If a certificate is given, its public key will be
extracted. Not every installation of Kubernetes exposes these
keys.
- `issuer` `(string: "")` - Optional JWT issuer. If no issuer is specified, then this plugin will
use `kubernetes/serviceaccount` as the default issuer. See [these instructions](/docs/platform/k8s/csi#setting-issuer-for-kubernetes-authentication) for looking up the issuer for a given Kubernetes cluster.
- `disable_iss_validation` `(bool: false)` - Disable JWT issuer validation. Allows to skip ISS validation.
- `disable_local_ca_jwt` `(bool: false)` - Disable defaulting to the local CA cert and service account JWT when running in a Kubernetes pod.
### Deprecated Parameters
-> The following fields have been deprecated and will be removed in a future release:
- `disable_iss_validation` `(bool: true)` **Deprecated** Disable JWT issuer validation. Allows to skip ISS validation.
- `issuer` `(string: "")` **Deprecated** Optional JWT issuer. If no issuer is specified, then this plugin will use `kubernetes/serviceaccount` as the default issuer.
See [these instructions](/docs/auth/kubernetes#discovering-the-service-account-issuer) for looking up the issuer for a given Kubernetes cluster.
### Caveats
If Vault is running in a Kubernetes Pod, the `kubernetes_ca_cert` and
@@ -97,7 +103,6 @@ $ curl \
"kubernetes_host": "https://192.168.99.100:8443",
"kubernetes_ca_cert": "-----BEGIN CERTIFICATE-----.....-----END CERTIFICATE-----",
"pem_keys": ["-----BEGIN CERTIFICATE-----.....", .....],
"disable_iss_validation": false,
"disable_local_ca_jwt": false
}
}

2
website/content/docs/auth/kubernetes.mdx
View File

@@ -103,6 +103,8 @@ management tool.
### Discovering the service account `issuer`
-> **Deprecated:** The `issuer` parameter has been deprecated as of Vault 1.9 and will be removed in a future release.
Kubernetes 1.21+ clusters may require setting the service account
[`issuer`](/api-docs/auth/kubernetes#issuer) to the same value as
`kube-apiserver`'s `--service-account-issuer` flag. This is because the service

4
website/content/docs/platform/k8s/csi/index.mdx
View File

@@ -50,7 +50,9 @@ account provided to pods if no service account is defined.
### Setting `issuer` for Kubernetes authentication
You will likely need to set [`issuer`](/api-docs/auth/kubernetes#issuer) when
-> **Deprecated:** The `issuer` parameter has been deprecated as of Vault 1.9 and will be removed in a future release.
If running Vault prior to version 1.9, you will likely need to set [`issuer`](/api-docs/auth/kubernetes#issuer) when
configuring Kubernetes authentication for the Vault CSI Provider.
Vault CSI Provider does not use the default token associated with service accounts.
Instead, it creates a token with a short TTL whose lifetime is also bound to the