hashicorp / hashicorp/vault-secrets-operator

Call signJwt endpoint rather than generateIdToken for GCP JWT's

Open
#892 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
600
Forks
146
Avg merge
3d 8h
Merged PRs (30d)
6

Description

**Is your feature request related to a problem? Please describe.**
Currently VSO generates JWTs that are 1 hour long using the `generateIdToken` endpoint, which is longer than the default `max_jwt_exp` on the Vault side leading to errors unless you manually increase `max_jwt_exp`.

**Describe the solution you'd like**
Instead, the `signJwt` endpoint could be used and `exp` could be set to a shorter value. I believe the existing iamcredentials package has a `SignJwt` method that could be used instead and the response includes a `SignedJwt` string that I believe is the same format as the existing token response.

**Describe alternatives you've considered**
Alternatively we can just increase the `max_jwt_exp` but it would be good if vault-secrets-operator worked with the defaults and the change seems small.

**Additional context**

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.