Remove K8s Auth Requirement From Docs #1053
Closed
+13
−8
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
Vault
LeahMarieBush
requested changes
Oct 6, 2025
yhyakuna
reviewed
Oct 6, 2025
content/vault/v1.20.x/content/docs/updates/important-changes.mdx
Outdated
Show resolved
Hide resolved
Co-authored-by: Yoko Hyakuna <[email protected]>
|
@jaireddjawed If we're updating the current docs, the PR should merge to main instead of the release branch :) |
Sounds good. I'll open another PR. |
schavis
requested changes
Oct 6, 2025
Comment on lines
+195
to
+200
| We recommend configuring an audience value for Kubernetes authentication roles when possible. | ||
| This enables Vault to validate that the aud (audience) claim in JWT tokens is explicitly intended for Vault, | ||
| reducing the risk of token misuse by other services. While not required, setting an audience is considered a security | ||
| best practice and is encouraged when it doesn't interfere with your workflow. For example, tokens created using | ||
| kubernetes.io/service-account-token do not include an aud claim, so it's appropriate to omit the audience field in this case. | ||
| Here's an example configuration. |
There was a problem hiding this comment.
Suggested change
| We recommend configuring an audience value for Kubernetes authentication roles when possible. | |
| This enables Vault to validate that the aud (audience) claim in JWT tokens is explicitly intended for Vault, | |
| reducing the risk of token misuse by other services. While not required, setting an audience is considered a security | |
| best practice and is encouraged when it doesn't interfere with your workflow. For example, tokens created using | |
| kubernetes.io/service-account-token do not include an aud claim, so it's appropriate to omit the audience field in this case. | |
| Here's an example configuration. | |
| There are cases where configuring audience details can interfere with your | |
| workflow. For example, tokens created using `kubernetes.io/service-account-token` | |
| do not include an aud claim. But we recommend configuring an audience value for | |
| Kubernetes authentication roles whenever possible. Setting explicit audience | |
| details is best practice because it reduces the risk of token misuse by other | |
| services. Vault can use the configured values to validate that the `aud` | |
| (audience) claim in JWT tokens is intended for Vault. | |
| For example: |
Style correction: avoid "this" as a pronoun, avoid possessives
|
Opened a new PR here. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We no longer plan to require audiences in the kubernetes auth plugin. It was later discovered that doing so could break some valid configurations of our customers (more details here).
Instead, we plan to simply recommend that customers specify an
audienceif it does not break their workflow. We log a warning in Vault when an audience is not configured so that customers will be aware.