Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Part 7/n - Add kubernetes auth plugin #105

Merged
merged 176 commits into from
Feb 2, 2024
Merged

Part 7/n - Add kubernetes auth plugin #105

merged 176 commits into from
Feb 2, 2024

Conversation

cipherboy
Copy link
Member

This imports the Kubernetes auth plugin as discussed in #64, bringing it in-tree with history.

This is part of #68, broken up to make review easier.

@naphelps When it comes time for merge, I'd suggest making this one a rebase merge if you can to preserve history. Thanks!

briankassouf and others added 30 commits August 31, 2017 10:24
@briankassouf
first commit
2de267a
@briankassouf
Initial merge (#1)
5bb695c 
* Start work on kuberentes auth

* Add vendoring and further work on the plugin

* Add test and fix jwt parsing

* comment

* Allow configuration of many Certs

* Use service account name for binding instead of UID

* Add lookup in kuberenetes

*  Add better error handling to the kubernetes call

* Added examples directory

* Update vendoring

* Use the TokenReview API to validate the JWT

* Fix vendoring

* Update basic example and rename it

* Add a sidecar example

* Remove extra file

* fix renewals

* Validate the JWT before calling into the TokenReview API

* Add comments and don't export the backend object

* Add tests and fix up some role parsing

* Add tests for configuration of the backend

* Add tests for loging in

* Update the help text

* More help text

* Make it easier to read and store certificates

* Fix locking and add additional login tests

* Add more login tests

* Remove examples

* Add build scripts

* Add license

* Fix a few issues

* a few fixes from code review

* Some minor fixes

* Make mismatched JWT errors a little more clear

* Add comments about the review factory settings

* Update deps

* Rename certificates to publick keys and clean up the PEM parsing logic

* A few small fixes from code review

* Add persona lookahead function

* Use rest client for fewer dependencies

* Don't use the kubernetes client (#2)

* Don't use the kubernetes client

* Fix bearer token

* Remove some debug code

* Add comments

* Fix unmarshaling of json

* Fix a few of the path descriptions

* No need to lock on config update/read

* Fix vet issue
@briankassouf
Update README.md
cb05268
@briankassouf
Make the PEM Signing Keys Optional (#4)
e6ff3b4 
* Make the PEM Signing Keys Optional

* Make ca cert or pem keys required

* Fix issue where the service account was not being returned

* Add more tests

* Update path_login.go
@briankassouf @jefferai
Validate that the user returned from TokenReview is a service account (…
aca9c90 
…openbao#7)
@briankassouf
Add a separate Token Reviewer token to use with the kubernetes API (o…
3822590 
…penbao#9)

* Add a separate Token Reviewer token to use with the kubernetes API

* Add the token reviewer to the config read response

* Add a note about falling back to the login JWT
@jefferai
Add a note about the security model.
d9b90d6
@jefferai
Update README.md
b5c02a1
@briankassouf
Update the vault dep to pull in Alias changes
b664845
@vishalnayak
s/persona/alias
ea209ae
@vishalnayak
Merge pull request openbao#10 from hashicorp/update-vault-dep
7b79e81 
Update the vault dep to pull in Alias changes
@briankassouf
Update vault deps
bf36d31
@jefferai
Update deps (openbao#11)
d5afd9b
@jefferai
Persona -> Alias in test
74f42fa
@briankassouf
Fix typo in readme
642384e
@jefferai
Add seal wrap storage config
9d1bbbd
@briankassouf
Update Deps and add context (openbao#17)
b8a63d1 
* Update Deps and add context

* Add deps
@calvn
Plumb context through paths and funcs that touch storage
d8c4d21
@briankassouf
Update deps
e3d2115
@briankassouf
Merge pull request openbao#18 from hashicorp/storage-context
31ab624 
Plumb context through paths and funcs that touch storage
@jefferai
Sync updates
3fcdd11
@jefferai
Update vendor
cbf4a8b
@jefferai
Update vendoring
f33ac92
@jefferai
Bump deps
40c3fdc
@jefferai
Update deps
60136e2
@jefferai
Bump some deps
6c7dd3f
@giskarda @jefferai
Fix spelling error (openbao#21)
20b6a16
@jefferai
Remove client secret from being returned on config
2457cd4
@vishalnayak
update deps
9c9d946
@vishalnayak
dep update
4c9ce51
tomhjp and others added 26 commits July 12, 2023 16:48
@tomhjp
Use port forwarding in integration tests to communicate with Vault pod (
8f67364 
openbao#200)
@thevilledev
chore: add missing error checks (openbao#202)
1039cbc
@hashicorp-copywrite
[COMPLIANCE] Add Copyright and License Headers (openbao#203)
4354ccb 
Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>
@fairclothjm
workflows: add bulk dep update job (openbao#204)
fb48d77 
* workflows: add bulk dep update job

* update reviewer team
@dependabot
Bump google.golang.org/grpc from 1.41.0 to 1.53.0 (openbao#201)
533605d
@raymonstah
update dependencies (openbao#206)
b846de8
@tvoran @abinet
Allow any token type for TokenReviewer validation (openbao#207)
8d9f472 
Co-authored-by: Andriy Binetsky <abinet@gmail.com>
@tvoran
update changelog for v0.17.1 release (openbao#208)
1e08e57
@hc-github-team-secure-vault-ecosystem
Automated dependency upgrades (openbao#209)
76e1b8d
@tvoran
go, k8s, and actions updates (openbao#212)
fa07e70 
Build with go 1.21.3, and update related packages. Pin github actions
to latest trusted versions, and test with k8s 1.24-1.28 and Vault
1.15.0.
@dependabot
Bump google.golang.org/grpc from 1.57.0 to 1.57.1 (openbao#213)
753b767 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.57.0 to 1.57.1.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.57.0...v1.57.1)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@hc-github-team-secure-vault-ecosystem
Automated dependency upgrades (openbao#215)
dad4d04 
Co-authored-by: hc-github-team-secure-vault-ecosystem <hc-github-team-secure-vault-ecosystem@users.noreply.github.com>
@dependabot
Bump github.com/docker/docker from 24.0.5+incompatible to 24.0.7+inco…
5e539a5 
…mpatible (openbao#214)

Bumps [github.com/docker/docker](https://github.com/docker/docker) from 24.0.5+incompatible to 24.0.7+incompatible.
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](moby/moby@v24.0.5...v24.0.7)

---
updated-dependencies:
- dependency-name: github.com/docker/docker
  dependency-type: indirect
...

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump github.com/go-jose/go-jose/v3 from 3.0.0 to 3.0.1 (openbao#216)
def4577 
Bumps [github.com/go-jose/go-jose/v3](https://github.com/go-jose/go-jose) from 3.0.0 to 3.0.1.
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Changelog](https://github.com/go-jose/go-jose/blob/v3/CHANGELOG.md)
- [Commits](go-jose/go-jose@v3.0.0...v3.0.1)

---
updated-dependencies:
- dependency-name: github.com/go-jose/go-jose/v3
  dependency-type: indirect
...

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump github.com/go-jose/go-jose/v3 in /integrationtest (openbao#217)
7f07086 
Bumps [github.com/go-jose/go-jose/v3](https://github.com/go-jose/go-jose) from 3.0.0 to 3.0.1.
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Changelog](https://github.com/go-jose/go-jose/blob/v3/CHANGELOG.md)
- [Commits](go-jose/go-jose@v3.0.0...v3.0.1)

---
updated-dependencies:
- dependency-name: github.com/go-jose/go-jose/v3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@hc-github-team-secure-vault-ecosystem
Automated dependency upgrades (openbao#219)
5dfb046 
Co-authored-by: hc-github-team-secure-vault-ecosystem <hc-github-team-secure-vault-ecosystem@users.noreply.github.com>
@thyton @f4z3r @benashz
VAULT-6936 support bound service account namespace selector (openbao#218
0f4be0b 
)

---------

Co-authored-by: Jakob Beckmann <jakobbeckmann@pm.me>
Co-authored-by: Ben Ash <32777270+benashz@users.noreply.github.com>
@thyton
add missing CHANGELOG entry for PR openbao#218 (openbao#220)
7bd7455
@hashicorp-copywrite
[COMPLIANCE] Add Copyright and License Headers (openbao#222)
df8dfe2 
Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>
@dependabot
Bump golang.org/x/crypto from 0.14.0 to 0.17.0 (openbao#223)
d366ec3 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.14.0 to 0.17.0.
- [Commits](golang/crypto@v0.14.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /integrationtest (o…
3c47be5 
…penbao#224)

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.14.0 to 0.17.0.
- [Commits](golang/crypto@v0.14.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@thyton @benashz
indicate that token reviewer jwt is set on config read (openbao#221)
6f9c733 
---------

Co-authored-by: Ben Ash <32777270+benashz@users.noreply.github.com>
@cipherboy
Replace hashicorp/vault -> openbao/openbao in auth/kubernetes
83fcb74 
Signed-off-by: Alexander Scheel <alexander.m.scheel@gmail.com>
@cipherboy
Add 'builtin/credential/kubernetes/' from commit '83fcb745e67ec9f3e9f…
66ffa30 
…94a2ce942c96b3edacac3'

git-subtree-dir: builtin/credential/kubernetes
git-subtree-mainline: 6365ced
git-subtree-split: 83fcb74
@cipherboy
Rename cmd/vault-plugin-auth-kubernetes -> kubernetes
0da3329 
Cherry-pick of 918e4c6.

Signed-off-by: Alexander Scheel <alexander.m.scheel@gmail.com>
@cipherboy
builtin/auth/kubernetes over hashicorp/vault-plugin-auth-kubernetes
dd6535a 
This switches all references to the Kubernetes plugin to use the new
internal location for the plugin over the external, HashiCorp owned
plugin.

Cherry-pick of 3bd3c9f.

Signed-off-by: Alexander Scheel <alexander.m.scheel@gmail.com>
@cipherboy
Copy link
Member Author

@naphelps Updated, thanks!

@naphelps naphelps merged commit d0fdf53 into openbao:main Feb 2, 2024
2 of 9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@naphelps naphelps naphelps approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet