hashicorp / hashicorp/vault-secrets-operator
Call signJwt endpoint rather than generateIdToken for GCP JWT's
- Dominant language
- Go
- Stars
- 600
- Forks
- 146
- Avg merge
- 3d 8h
- Merged PRs (30d)
- 6
Description
**Is your feature request related to a problem? Please describe.**
Currently VSO generates JWTs that are 1 hour long using the `generateIdToken` endpoint, which is longer than the default `max_jwt_exp` on the Vault side leading to errors unless you manually increase `max_jwt_exp`.
**Describe the solution you'd like**
Instead, the `signJwt` endpoint could be used and `exp` could be set to a shorter value. I believe the existing iamcredentials package has a `SignJwt` method that could be used instead and the response includes a `SignedJwt` string that I believe is the same format as the existing token response.
**Describe alternatives you've considered**
Alternatively we can just increase the `max_jwt_exp` but it would be good if vault-secrets-operator worked with the defaults and the change seems small.
**Additional context**
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.