Commit 42483499 authored by Pierre Smeyers's avatar Pierre Smeyers
Browse files

feat(oidc): OIDC authentication support now requires explicit configuration (see doc) 

Due to CI_JOB_JWT-* variables discontinued, TBC now switches
to ID tokens for Vault authentication support.

BREAKING CHANGE: OIDC authentication support now requires explicit configuration (see doc)
parent 31e884ed

README.md

+3 −0
Original line number Diff line number Diff line
@@ -331,6 +331,7 @@ In order to be able to communicate with the Vault server, the variant requires t 
| ----------------- | -------------------------------------- | ----------------- |

| `TBC_VAULT_IMAGE` | The [Vault Secrets Provider](https://gitlab.com/to-be-continuous/tools/vault-secrets-provider) image to use (can be overridden) | `$CI_REGISTRY/to-be-continuous/tools/vault-secrets-provider:master` |

| `VAULT_BASE_URL`  | The Vault server base API url          | _none_ |

| `VAULT_OIDC_AUD`  | The `aud` claim for the JWT | `$CI_SERVER_URL` |

| :lock: `VAULT_ROLE_ID`   | The [AppRole](https://www.vaultproject.io/docs/auth/approle) RoleID | **must be defined** |

| :lock: `VAULT_SECRET_ID` | The [AppRole](https://www.vaultproject.io/docs/auth/approle) SecretID | **must be defined** |
@@ -363,6 +364,8 @@ include: 
    file: '/templates/gitlab-ci-cf-vault.yml'



variables:

    # audience claim for JWT

    VAULT_OIDC_AUD: "https://vault.acme.host"

    # Secrets managed by Vault

    CF_USER: "@url@http://vault-secrets-provider/api/secrets/b7ecb6ebabc231/my-app/cf/noprod?field=user"

    CF_PASSWORD: "@url@http://vault-secrets-provider/api/secrets/b7ecb6ebabc231/my-app/cf/noprod?field=password"

templates/gitlab-ci-cf-vault.yml

+6 −0
Original line number Diff line number Diff line
@@ -7,6 +7,7 @@ variables: 
  # variables have to be explicitly declared in the YAML to be exported to the service

  VAULT_ROLE_ID: "$VAULT_ROLE_ID"

  VAULT_SECRET_ID: "$VAULT_SECRET_ID"

  VAULT_OIDC_AUD: "$CI_SERVER_URL"



.cf-base:

  services:
@@ -14,3 +15,8 @@ variables: 
      command: ["--service", "cloudfoundry", "3.1.0" ]

    - name: "$TBC_VAULT_IMAGE"

      alias: "vault-secrets-provider"

  variables:

    VAULT_JWT_TOKEN: "$VAULT_JWT_TOKEN"

  id_tokens:

    VAULT_JWT_TOKEN:

      aud: "$VAULT_OIDC_AUD"