Skip to content

[Vault] Clarify that 1.21 did not make audience required #1221

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Oct 30, 2025
+13 −1
Merged

[Vault] Clarify that 1.21 did not make audience required #1221

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5386afd
Calrify that 1.21 did not make audience required
schavis Oct 30, 2025
644ed0f
tweak sentence
schavis Oct 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion content/vault/v1.20.x/content/api-docs/auth/kubernetes.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,7 +146,12 @@ entities attempting to login.
[LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#labelselector-v1-meta). Currently, label selectors with `matchExpressions` are not supported.
To use label selectors, **Vault must have permission to read namespaces** on the Kubernetes
cluster. If set with `bound_service_account_namespaces`, the conditions are `OR`ed.
- `audience` `(string: "")` - Audience claim to verify in the JWT.
- `audience` `(string: "")` - Audience claim to verify in the JWT. If you leave
`audience` unset, Vault logs a warning about setting an explicit audience
configuration to encourage better security practices. Note: the log entry for
early versions of Vault 1.20.x falsely indicates that `audience` becomes a
required field in Vault 1.21.x. You can safely ignore that portion of the
warning.
- `alias_name_source` `(string: "serviceaccount_uid")` - Configures how identity aliases are generated.
Valid choices are: `serviceaccount_uid` and `serviceaccount_name`.

Expand Down
7 changes: 7 additions & 0 deletions content/vault/v1.20.x/content/docs/updates/important-changes.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -204,6 +204,13 @@ to the official [Snowflake documentation](https://docs.snowflake.com/en/user-gui
Vault logs a warning when you create or update a Kubernetes auth role without an
audience.

<Note title="Note about warning text">
We have no plans to require audience definition in future Vault versions.
Log messages in earlier versions of 1.20.x incorrectly mention that Vault
1.21.x requires audience configuration. You can safely ignore that portion of
the log message.
</Note>

#### Recommendation

There are cases where configuring audience details can interfere with your
Expand Down
Loading