You are looking at the documentation of a prior release. To read the documentation of the latest release, please
visit here.
New to KubeVault? Please start here.
The JWT
auth method can be used to authenticate with Vault using OIDC
or by providing a JWT
.
The OIDC
method allows authentication via a configured OIDC Provider
using the user’s web browser. This method may be initiated from the Vault UI
or the command line. Alternatively, a JWT
can be provided directly.
Enable & Configure JWT/OIDC Auth method
While deploying the VaultServer
it’s possible to define the list of auth methods users want to enable with it.
A VaultServer
.spec.authMethods
section may look like this:
spec:
authMethods:
- type: jwt
path: jwt
jwtConfig:
...
- type: oidc
path: oidc
oidcConfig:
...
.spec.authMethods.type
is a required field, the type of authentication method we want to enable..spec.authMethods.path
is a required field, the path where we want to enable this authentication method..spec.authMethods.jwtConfig / .spec.authMethods.oidcConfig
contains various configuration for this authentication method. Some of theparamerters
are listed here:defaultLeaseTTL
- The default lease duration, specified as a string duration like “5s” or “30m”.maxLeaseTTL
- The maximum lease duration, specified as a string duration like “5s” or “30m”.pluginName
- The name of the plugin in the plugin catalog to use.auditNonHMACRequestKeys
- List of keys that will not be HMAC’d by audit devices in the request data object.auditNonHMACResponseKeys
- List of keys that will not be HMAC’d by audit devices in the response data object.listingVisibility
- Specifies whether to show this mount in the UI-specific listing endpoint.passthroughRequestHeaders
- List of headers to whitelist and pass from the request to the backend.credentialSecretRef
- K8s Secret reference containing credential related secrets.tlsSecretRef
- K8s Secret reference containing tls related secrets.oidcDiscoveryURL
- The OIDC Discovery URL, without any .well-known component (base path). Cannot be used with “jwks_url” or “jwt_validation_pubkeys”.oidcClientID
- The OAuth Client ID from the provider for OIDC roles.oidcResponseMode
- The response mode to be used in the OAuth2 request. Allowed values are “query” and “form_post”. Defaults to “query”. If using Vault namespaces, and oidc_response_mode is “form_post”, then “namespace_in_state” should be set to false.oidcResponseTypes
- (comma-separated string, or array of strings:) - The response types to request. Allowed values are “code” and “id_token”. Defaults to “code”. Note: “id_token” may only be used if “oidc_response_mode” is set to “form_post”. defaultRole
- The default role to use if none is provided during login.providerConfig
- Configuration options for provider-specific handling. Providers with specific handling include: Azure, Google. The options are described in each provider’s section in OIDC Provider Setup.jwksURL
- JWKS URL to use to authenticate signatures. Cannot be used with “oidc_discovery_url” or “jwt_validation_pubkeys”.jwtValidationPubkeys
- (comma-separated string, or array of strings:). A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used with “jwks_url” or “oidc_discovery_url”. jwtSupportedAlgs
- (comma-separated string, or array of strings:) A list of supported signing algorithms. Defaults to [RS256] for OIDC roles. Defaults to all available algorithms for JWT roles. boundIssuer
- The value against which to match the iss claim in a JWT.
After an authentication method is successfully enabled, KubeVault
operator will configure it with the provided configuration.
After successfully enabling & configuring authentication methods, a VaultServer .status.authMethodStatus
may look like this:
status:
authMethodStatus:
- path: jwt
status: EnableSucceeded
type: jwt
- path: kubernetes
status: EnableSucceeded
type: kubernetes
We can verify it using the Vault CLI
:
$ vault auth list
Path Type Accessor Description
---- ---- -------- -----------
jwt/ jwt auth_jwt_ba23cc30 n/a
kubernetes/ kubernetes auth_kubernetes_40fd86fd n/a
token/ token auth_token_950c8b80 token based credentials
So, this is how JWT/OIDC
authentication method could be enabled & configured with KubeVault
.
For a step-by-step guide on JWT/OIDC authentication method, see this.