-
Notifications
You must be signed in to change notification settings - Fork 175
Open
Labels
bugSomething isn't workingSomething isn't working
Description
When the injector is deployed with AGENT_INJECT_VAULT_AUTH_TYPE
set to jwt
, or when using vault.hashicorp.com/auth-type: jwt
annotation, the generated (simplified) agent config looks like this:
{
"auto_auth": {
"method": {
"type": "jwt",
"mount_path": "<path>",
"config": {
"role": "<role>",
"token_path": "/var/run/secrets/vault.hashicorp.com/serviceaccount/token"
}
}
}
This is invalid because the jwt
auth uses path
rather than token_path
config parameter. This appears to be set here.
In addition, it may be beneficial to set remove_jwt_after_reading
to false
by default because removing the token fails due to the projected volume being read-only.
We're currently using the following annotations to work around these issues:
vault.hashicorp.com/auth-config-path: /var/run/secrets/vault.hashicorp.com/serviceaccount/token
vault.hashicorp.com/auth-config-remove-jwt-after-reading: 'false'
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't working