actions/vault-action
5
0
Fork 0
mirror of https://github.com/hashicorp/vault-action.git synced 2025-11-07 15:16:56 +00:00
Code Activity Actions

Merge da8ea015b7 into 2c5827061f

Browse source
This commit is contained in:
Keith Murry 2025-07-28 23:39:55 +00:00 committed by GitHub
commit 80759d54a9
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 12 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
README.md
View file

@ -236,7 +236,7 @@ with:
You can configure trust between your own OIDC Provider and Vault You can configure trust between your own OIDC Provider and Vault
with the JWT auth method. Provide a `role` & `jwtPrivateKey` parameters, with the JWT auth method. Provide a `role` & `jwtPrivateKey` parameters,
additionally you can pass `jwtKeyPassword` & `jwtTtl` parameters additionally you can pass `jwtKeyPassword`, `jwtTtl`, & `jwtIat` parameters.
```yaml ```yaml
with: with:
@ -247,6 +247,7 @@ with:
jwtPrivateKey: ${{ secrets.JWT_PRIVATE_KEY }} jwtPrivateKey: ${{ secrets.JWT_PRIVATE_KEY }}
jwtKeyPassword: ${{ secrets.JWT_KEY_PASS }} jwtKeyPassword: ${{ secrets.JWT_KEY_PASS }}
jwtTtl: 3600 # 1 hour, default value jwtTtl: 3600 # 1 hour, default value
jwtIat: 60 # 1 min, default value. Negative int postdates
``` ```
### Kubernetes ### Kubernetes

4
action.yml
View file

@ -89,6 +89,10 @@ inputs:
description: 'Time in seconds, after which token expires' description: 'Time in seconds, after which token expires'
required: false required: false
default: 3600 default: 3600
jwtIat:
description: 'Number of seconds (int) to predate the token issued at (iat).'
required: false
default: 60
secretEncodingType: secretEncodingType:
description: 'The encoding type of the secret to decode. If not specified, the secret will not be decoded. Supported values: base64, hex, utf8' description: 'The encoding type of the secret to decode. If not specified, the secret will not be decoded. Supported values: base64, hex, utf8'
required: false required: false

2
integrationTests/basic/jwt_auth.test.js
View file

@ -44,7 +44,7 @@ function mockGithubOIDCResponse(aud= "https://github.com/hashicorp/vault-action"
ref_type: "branch", ref_type: "branch",
job_workflow_ref: "hashicorp/vault-action/.github/workflows/workflow.yml@refs/heads/main", job_workflow_ref: "hashicorp/vault-action/.github/workflows/workflow.yml@refs/heads/main",
iss: 'vault-action', iss: 'vault-action',
iat: now, iat: now - 60,
nbf: now, nbf: now,
exp: now + 3600, exp: now + 3600,
}; };

8
src/auth.js
View file

@ -34,6 +34,7 @@ async function retrieveToken(method, client) {
const privateKey = Buffer.from(privateKeyRaw, 'base64').toString(); const privateKey = Buffer.from(privateKeyRaw, 'base64').toString();
const keyPassword = core.getInput('jwtKeyPassword', { required: false }); const keyPassword = core.getInput('jwtKeyPassword', { required: false });
const tokenTtl = core.getInput('jwtTtl', { required: false }) || '3600'; // 1 hour const tokenTtl = core.getInput('jwtTtl', { required: false }) || '3600'; // 1 hour
const tokenIat = core.getInput('jwtIat', { required: false }) || '60';
const githubAudience = core.getInput('jwtGithubAudience', { required: false }); const githubAudience = core.getInput('jwtGithubAudience', { required: false });
if (!privateKey) { if (!privateKey) {
@ -42,7 +43,7 @@ async function retrieveToken(method, client) {
return result; return result;
}); });
} else { } else {
jwt = generateJwt(privateKey, keyPassword, Number(tokenTtl)); jwt = generateJwt(privateKey, keyPassword, Number(tokenTtl), Number(tokenIat));
} }
return await getClientToken(client, method, path, { jwt: jwt, role: role }); return await getClientToken(client, method, path, { jwt: jwt, role: role });
@ -84,14 +85,15 @@ async function retrieveToken(method, client) {
* @param {string} privateKey * @param {string} privateKey
* @param {string} keyPassword * @param {string} keyPassword
* @param {number} ttl * @param {number} ttl
* @param {number} iat
*/ */
function generateJwt(privateKey, keyPassword, ttl) { function generateJwt(privateKey, keyPassword, ttl, iat) {
const alg = 'RS256'; const alg = 'RS256';
const header = { alg: alg, typ: 'JWT' }; const header = { alg: alg, typ: 'JWT' };
const now = rsasign.KJUR.jws.IntDate.getNow(); const now = rsasign.KJUR.jws.IntDate.getNow();
const payload = { const payload = {
iss: 'vault-action', iss: 'vault-action',
iat: now, iat: now - iat,
nbf: now, nbf: now,
exp: now + ttl, exp: now + ttl,
event: process.env.GITHUB_EVENT_NAME, event: process.env.GITHUB_EVENT_NAME,