Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update GCP auth docs for signJwt transition to Service Account Credentials API #11568

Merged
merged 2 commits into from May 11, 2021
Merged

Update GCP auth docs for signJwt transition to Service Account Credentials API #11568

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
565b9c5
Update GCP auth docs for sign JWT transition to Service Account Crede…
austingebauer May 7, 2021
6cff72d
adds note about project parameter being removed
austingebauer May 11, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 1 addition & 1 deletion website/content/api-docs/auth/gcp.mdx
View file
Open in desktop
Expand Up @@ -468,5 +468,5 @@ $ curl \

[gcp-adc]: https://developers.google.com/identity/protocols/application-default-credentials
[jwt]: https://tools.ietf.org/html/rfc7519
[signjwt-method]: https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts/signJwt
[signjwt-method]: https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/signJwt
[instance-token]: https://cloud.google.com/compute/docs/instances/verifying-instance-identity#request_signature
8 changes: 4 additions & 4 deletions website/content/docs/agent/autoauth/methods/gcp.mdx
View file
Open in desktop
Expand Up @@ -13,7 +13,7 @@ authentication types are supported.
## Credentials

Vault will use the GCP SDK's normal credential chain behavior. You can set a
static `credentials` value but it is usually not needed. If running on GCE
static `credentials` value, but it is usually not needed. If running on GCE
using Application Default Credentials, you may need to specify the service
account and project since ADC does not provide metadata used to automatically
determine these.
Expand All @@ -30,8 +30,8 @@ determine these.
- `service_account` `(string: optional)` - The service account to use, if it
cannot be automatically determined

- `project` `(string: optional)` - The project to use, if it cannot be
automatically determined

- `jwt_exp` `(string or int: optional)` - The number of minutes a generated JWT
should be valid for when using the `iam` method; defaults to 15 minutes

-> **Note:** The `project` parameter has been removed in Vault 1.5.9+, 1.6.5+, and 1.7.2+.
It is no longer needed for configuration and will be ignored if provided.
38 changes: 21 additions & 17 deletions website/content/docs/auth/gcp.mdx
View file
Open in desktop
Expand Up @@ -37,13 +37,15 @@ request to Vault. This helper is only available for IAM-type roles.
$ vault login -method=gcp \
role="my-role" \
service_account="authenticating-account@my-project.iam.gserviceaccount.com" \
project="my-project" \
jwt_exp="15m" \
credentials=@path/to/signer/credentials.json
```

For more usage information, run `vault auth help gcp`.

-> **Note:** The `project` parameter has been removed in Vault 1.5.9+, 1.6.5+, and 1.7.2+.
It is no longer needed for configuration and will be ignored if provided.

### Via the CLI

```shell-session
Expand Down Expand Up @@ -229,9 +231,9 @@ for IAM service accounts looks like this:

[![Vault Google Cloud IAM Login Workflow](/img/vault-gcp-iam-auth-workflow.svg)](/img/vault-gcp-iam-auth-workflow.svg)

1. The client generates a signed JWT using the IAM
[`projects.serviceAccounts.signJwt`][signjwt-method] method. For examples of
how to do this, see the [Generating JWTs](#generating-jwts) section.
1. The client generates a signed JWT using the Service Account Credentials
[`projects.serviceAccounts.signJwt`][signjwt-method] API method. For examples
of how to do this, see the [Generating JWTs](#generating-jwts) section.

2. The client sends this signed JWT to Vault along with a role name.

Expand Down Expand Up @@ -269,10 +271,10 @@ another cloud provider.
This section details the various methods and examples for obtaining JWT
tokens.

### IAM
### Service Account Credentials API

This describes how to use the GCP IAM [API method][signjwt-method] directly
to generate the signed JWT with the claims that Vault expects. Note the CLI
This describes how to use the GCP Service Account Credentials [API method][signjwt-method]
directly to generate the signed JWT with the claims that Vault expects. Note the CLI
does this process for you and is much easier, and that there is very little
reason to do this yourself.

Expand All @@ -288,33 +290,35 @@ Vault requires the following minimum claim set:
}
```

For the API method, expiration is optional and will default to an hour.
If specified, expiration must be a
[NumericDate](https://tools.ietf.org/html/rfc7519#section-2) value (seconds from
Epoch). This value must be before the max JWT expiration allowed for a role.
This defaults to 15 minutes and cannot be more than 1 hour.
For the API method, providing the expiration claim `exp` is required. If it is omitted,
it will not be added automatically and Vault will deny authentication. Expiration must
be specified as a [NumericDate](https://tools.ietf.org/html/rfc7519#section-2) value
(seconds from Epoch). This value must be before the max JWT expiration allowed for a
role. This defaults to 15 minutes and cannot be more than 1 hour.

One you have all this information, the JWT token can be signed using curl and
[oauth2l](https://github.com/google/oauth2l):

```text
ROLE="my-role"
PROJECT="my-project"
SERVICE_ACCOUNT="service-account@my-project.iam.gserviceaccount.com"
OAUTH_TOKEN="$(oauth2l header cloud-platform)"
JWT_CLAIM="{\\\"aud\\\":\\\"vault/${ROLE}\\\", \\\"sub\\\": \\\"${SERVICE_ACCOUNT}\\\"}"
EXPIRATION="<your_token_expiration>"
JWT_CLAIM="{\\\"aud\\\":\\\"vault/${ROLE}\\\", \\\"sub\\\": \\\"${SERVICE_ACCOUNT}\\\", \\\"exp\\\": ${EXPIRATION}}"

curl \
--header "${OAUTH_TOKEN}" \
--header "Content-Type: application/json" \
--request POST \
--data "{\"payload\": \"${JWT_CLAIM}\"}" \
"https://iam.googleapis.com/v1/projects/${PROJECT}/serviceAccounts/${SERVICE_ACCOUNT}:signJwt"
"https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${SERVICE_ACCOUNT}:signJwt"
```

#### gcloud Example

You can also do this through the (currently beta) gcloud command.
You can also do this through the (currently beta) gcloud command. Note that you will
be required to provide the expiration claim `exp` as a part of the JWT input to the
command.

```shell-session
$ gcloud beta iam service-accounts sign-jwt $INPUT_JWT_CLAIMS $OUTPUT_JWT_FILE \
Expand Down Expand Up @@ -352,7 +356,7 @@ The GCP Auth Plugin has a full HTTP API. Please see the
[API docs][api-docs] for more details.

[jwt]: https://tools.ietf.org/html/rfc7519
[signjwt-method]: https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts/signJwt
[signjwt-method]: https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/signJwt
[cloud-creds]: https://cloud.google.com/docs/authentication/production#providing_credentials_to_your_application
[service-accounts]: https://cloud.google.com/compute/docs/access/service-accounts
[api-docs]: /api/auth/gcp
Expand Down