Add oidc login to vault

[sudo-bmitch]

Signed-off-by: Brandon Mitchell git@bmitch.net

Summary

This adds the ability to login to vault using OIDC to get a token, and removes dependencies on environment variables.

I'm using this with Spire+OIDC to use Vault as a KMS without hard coding credentials in CI. Here's what that code looks like:

...
	kmsOpts := []signature.RPCOption{}
	rpcAuth := options.RPCAuth{
		Address: cfg.Auth.Address,
		OIDC: options.RPCAuthOIDC{
			Role: cfg.Auth.Role,
			Path: cfg.Auth.Path,
		},
	}
	jwtSource, err := workloadapi.NewJWTSource(
		ctx,
		workloadapi.WithClientOptions(workloadapi.WithAddr(cfg.Auth.Spire.Sock)),
	)
	if err != nil {
		return err
	}
	svid, err := jwtSource.FetchJWTSVID(ctx, jwtsvid.Params{Audience: cfg.Auth.Spire.Audience})
	if err != nil {
		return err
	}
	rpcAuth.OIDC.Token = svid.Marshal()
	kmsOpts = append(kmsOpts, options.WithRPCAuthOpts(rpcAuth))
	k, err := kms.Get(context.Background(), cfg.KMSRef, crypto.SHA256, kmsOpts...)
	if err != nil {
		return err
	}
...

Ticket Link

Fixes

Release Note

Adding ability to login to Vault using OIDC

[sudo-bmitch]

Test cases are in the works for this. I've got them done for passing the vault token, address, and transit path. Just doing a bit more research on the oidc side to see if that can be easily added to the e2e tests.

[hectorj2f]

@sudo-bmitch golangci-lint is complaining here https://github.com/sigstore/sigstore/runs/4951957521?check_suite_focus=true.

[sudo-bmitch]

@hectorj2f yup, I got those fixed in c1d6eb1. Sorry for missing that in the first pass, I know better. I'll have another commit later today for e2e testing, so no need to rerun CI just yet.

[sudo-bmitch]

Test cases added for the easy parts. I went down the path of trying to get a JWT out of Dex programmatically and started to hit a wall. If anyone has some go or shell code for that, I can add more tests for OIDC auth into vault.

This should be ready for CI @dlorenc

[hectorj2f]

lgtm

[sudo-bmitch]

Double ack. I've now installed golint-ci so I can stop messing up that CI job.