![使用 `-tls-skip-verify` 和 EKS ca.crt 启用 Vault JWT 失败,并出现 `x509:由未知机构签名的证书`](https://linux22.com/image/781205/%E4%BD%BF%E7%94%A8%20%60-tls-skip-verify%60%20%E5%92%8C%20EKS%20ca.crt%20%E5%90%AF%E7%94%A8%20Vault%20JWT%20%E5%A4%B1%E8%B4%A5%EF%BC%8C%E5%B9%B6%E5%87%BA%E7%8E%B0%20%60x509%EF%BC%9A%E7%94%B1%E6%9C%AA%E7%9F%A5%E6%9C%BA%E6%9E%84%E7%AD%BE%E5%90%8D%E7%9A%84%E8%AF%81%E4%B9%A6%60.png)
我们需要在托管于我们的 EKS 集群中的 vault 中启用 JWT 身份验证,以准备使用 K8s 1.24 OIDC 并使用 Vault 测试令牌更新。我正在关注几个地方的文档:
https://banzaicloud.com/blog/kubernetes-oidc/
https://www.vaultproject.io/docs/auth/jwt/oidc-providers/kubernetes
https://www.vaultproject.io/docs/auth/kubernetes#discovering-the-service-account-issuer
https://learn.hashicorp.com/tutorials/vault/agent-kubernetes?in=vault/auth-methods
配置看起来相当简单。我困惑的是,当需要将 JWT 配置写入 vault 时,配置失败,如下所示:
vault write -tls-skip-verify auth/jwt/config oidc_discovery_url=https://oidc.eks.us-west-2.amazonaws.com/id/xxxxxxxxxxxxxxxxxxxxxx oidc_discovery_ca_pem=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt bound_issuer=https://oidc.eks.us-west-2.amazonaws.com/id/xxxxxxxxxxxxxxxxxxxxxx
...
...
...
* error checking oidc discovery URL: error creating provider with given values: Get "https://vault.vault:8200/.well-known/openid-configuration": x509: certificate signed by unknown authority
获取 CA:
at 22:37:06 ❯ \kubectl config view --raw --minify --flatten --output 'jsonpath={.clusters[].cluster.certificate-authority-data}' | base64 --decode | openssl x509 -text -noout
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 0 (0x0)
Signature Algorithm: sha256WithRSAEncryption
Issuer: CN = kubernetes
Validity
Not Before: Oct 15 05:07:03 2022 GMT
Not After : Oct 12 05:07:03 2032 GMT
Subject: CN = kubernetes
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
此处使用的 CA 是集群各处提供的 CA。它位于 kubeconfig 中,位于集群的颁发者中,并与 pod 中的服务帐户数据一起安装,就像我在上面命令中使用的一样。据我所知没有其他 CA。此外,使用-tls-skip-verify
不受尊重,这让我有点困惑。
如能就此处发生的情况提供任何指点,我将不胜感激。