Skip to content

Injected Agent config uses token_path instead of path for jwt auth method #660

@mxk

Description

@mxk

When the injector is deployed with AGENT_INJECT_VAULT_AUTH_TYPE set to jwt, or when using vault.hashicorp.com/auth-type: jwt annotation, the generated (simplified) agent config looks like this:

{
  "auto_auth": {
    "method": {
      "type": "jwt",
      "mount_path": "<path>",
      "config": {
        "role": "<role>",
        "token_path": "/var/run/secrets/vault.hashicorp.com/serviceaccount/token"
      }
    }
}

This is invalid because the jwt auth uses path rather than token_path config parameter. This appears to be set here.

In addition, it may be beneficial to set remove_jwt_after_reading to false by default because removing the token fails due to the projected volume being read-only.

We're currently using the following annotations to work around these issues:

vault.hashicorp.com/auth-config-path: /var/run/secrets/vault.hashicorp.com/serviceaccount/token
vault.hashicorp.com/auth-config-remove-jwt-after-reading: 'false'

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions