Skip to content

Set Vault OIDC rotation period default to 256000h #1281

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tuteng wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Set Vault OIDC rotation period default to 256000h #1281

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1116646
Set Vault OIDC rotation period default to 256000h
tuteng Jul 3, 2026
ef12248
Merge branch 'master' into tuteng-vault-oidc-rotation-period-256000h
tuteng Jul 3, 2026
0e0e777
Use configured Vault OIDC rotation period in LDAP init
tuteng Jul 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions charts/sn-platform/conf/vault/init_vault_streamnative_console/vault-ldap-init.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,33 +17,33 @@ sed -i "s#MOUNT_ACCESSOR#$serviceAccountMountAccessor#g" /vault-ldap/super-servi

vault policy write user /vault-ldap/user.hcl
vault write identity/entity name="user" policies="user"
vault write identity/oidc/key/user name=user rotation_period=24h verification_ttl=24h
vault write identity/oidc/key/user name=user rotation_period=$ROTATION_PERIOD verification_ttl=24h
vault write identity/oidc/role/user key=user ttl=12h template=@/vault-ldap/user-template.json
userClientId=$(vault read identity/oidc/role/user | grep client_id | awk '{print $2}')
vault write identity/oidc/key/user name=user rotation_period=24h verification_ttl=24h allowed_client_ids=$userClientId
vault write identity/oidc/key/user name=user rotation_period=$ROTATION_PERIOD verification_ttl=24h allowed_client_ids=$userClientId

vault policy write super-user /vault-ldap/user.hcl
vault write identity/entity name="super-user" policies="super-user"
vault write identity/oidc/key/super-user name=super-user rotation_period=24h verification_ttl=24h
vault write identity/oidc/key/super-user name=super-user rotation_period=$ROTATION_PERIOD verification_ttl=24h
vault write identity/oidc/role/super-user key=super-user ttl=12h template=@/vault-ldap/super-user-template.json
superUserClientId=$(vault read identity/oidc/role/super-user | grep client_id | awk '{print $2}')
vault write identity/oidc/key/super-user name=super-user rotation_period=24h verification_ttl=24h allowed_client_ids=$superUserClientId
vault write identity/oidc/key/super-user name=super-user rotation_period=$ROTATION_PERIOD verification_ttl=24h allowed_client_ids=$superUserClientId

vault policy write service-account /vault-ldap/service-account.hcl
vault write identity/entity name="service-account" policies="service-account"
canonicalId=$(vault read identity/entity/name/service-account | grep -v _id | grep id | awk '{print $2}')
vault write identity/entity-alias name="service-account" mount_accessor=$serviceAccountMountAccessor canonical_id=$canonicalId metadata=name='service-account'
vault write identity/oidc/key/service-account name=service-account rotation_period=24h verification_ttl=24h
vault write identity/oidc/key/service-account name=service-account rotation_period=$ROTATION_PERIOD verification_ttl=24h
vault write identity/oidc/role/service-account key=service-account ttl=12h template=@/vault-ldap/service-account-template.json
serviceAccountClientId=$(vault read identity/oidc/role/service-account | grep client_id | awk '{print $2}')
vault write identity/oidc/key/service-account name=service-account rotation_period=24h verification_ttl=24h allowed_client_ids=$serviceAccountClientId
vault write identity/oidc/key/service-account name=service-account rotation_period=$ROTATION_PERIOD verification_ttl=24h allowed_client_ids=$serviceAccountClientId

vault policy write super-service-account /vault-ldap/service-account.hcl
vault write identity/entity name="super-service-account" policies="super-service-account"
canonicalId=$(vault read identity/entity/name/super-service-account | grep -v _id | grep id | awk '{print $2}')
vault write identity/entity-alias name="super-service-account" mount_accessor=$serviceAccountMountAccessor canonical_id=$canonicalId metadata=name='super-service-account'
vault write identity/oidc/key/super-service-account name=super-service-account rotation_period=24h verification_ttl=24h
vault write identity/oidc/key/super-service-account name=super-service-account rotation_period=$ROTATION_PERIOD verification_ttl=24h
vault write identity/oidc/role/super-service-account key=super-service-account ttl=12h template=@/vault-ldap/super-service-account-template.json
superServiceAccountClientId=$(vault read identity/oidc/role/super-service-account | grep client_id | awk '{print $2}')
vault write identity/oidc/key/super-service-account name=super-service-account rotation_period=24h verification_ttl=24h allowed_client_ids=$superServiceAccountClientId
vault write identity/oidc/key/super-service-account name=super-service-account rotation_period=$ROTATION_PERIOD verification_ttl=24h allowed_client_ids=$superServiceAccountClientId
vault write auth/approle/role/apachepulsar policies=super-service-account
2 changes: 1 addition & 1 deletion charts/sn-platform/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2873,7 +2873,7 @@ vault:
name: ""
oidcToken:
# verification_ttl cannot be longer than 10x rotation_period
rotation_period: 24h
rotation_period: 256000h
# verification_ttl should be greater than the value of ttl below
# https://developer.hashicorp.com/vault/api-docs/secret/identity/tokens#verification_ttl
verification_ttl: 24h
Expand Down
Loading