send audience to tokenreview api

[rvasilevsf]

This PR addresses #73.

I've tested this with EKS 1.14.
This setup requires a token_reviewer_jwt with system:auth-delegator permissions. Also EKS projected tokens are not issued from kubernetes, but from OIDC (https://oidc.eks.us-east-1.amazonaws.com/id/), so this requires the configuration of issuer as well.

Here's my config:

vault write auth/kubernetes/config \
kubernetes_host=https://CF07473106A573AC4F2567E17CF8B150.gr7.us-east-1.eks.amazonaws.com \
kubernetes_ca_cert=@ca.crt \
issuer="https://oidc.eks.us-east-1.amazonaws.com/id/CF07473106A573AC4F2567E17CF8B150" \
token_reviewer_jwt="<MY_JWT_REVIEWER_TOKEN>"

Old authentication w/o audience also works, just make sure your role isn't provisioned with it and general config issuer is the default one (e.g. no issuer setting).

[hashicorp-cla]

All committers have signed the CLA.

[riuvshyn]

can we expect this fix to be included in the next bugfix?

cc @kalafut @jefferai 🙏

@rvasilevsf please sign CLA

[rvasilevsf]

I've signed the CLA.
@jasonodonnell would you be able to review the PR?
Thanks.

[rvasilevsf]

Ping...

@catsby

[jasonodonnell]

Hi @rvasilevsf,

This code looks fine but there isn't any test coverage for the issuer. Can you add some? I will test this on EKS and for backwards compatibility today.

[rvasilevsf]

@jasonodonnell there isn't one because this is very specific to AWS.

[jasonodonnell]

LGTM