Allow Agent auto auth to read symlinked JWT files #11502
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This came up when helping someone to set up JWT auto auth with Vault Agent in Kubernetes. They had lots of Kubernetes clusters and so didn't want to have to set up a Kubernetes auth mount for each cluster, and instead wanted to use projected Service Account tokens with the JWT auth method. Kubernetes mounts projected tokens using symlinks from an immutable volume mount to help it rotate JWTs when they expire. In this case, the fact the JWT was a symlink stopped JWT auto auth from working, but I see no reason we can't support symlinks in this case.
Currently, the tests are a little fragile in relying on log output. I opted not to change the signature of
ingressToken
to return an error because the actual production code would never pay attention to or change its behaviour based on the return value, but I'm very open to feedback on that.Lastly, I have opted to allow
ioutil.ReadFile
to handle any errors from cases such as a symlink pointing to a directory for simplicity, as when experimenting I found the error message was clear enough without additional handling, e.g.read sym-dir: is a directory
. It's possible I've missed a separate motivation for theIsRegular()
check though.