Adds new config option disable_local_ca_jwt

[tvoran]

Overview

Adds an option to disable defaulting to the local CA cert and service account JWT
when running in a Kubernetes pod.

Design of Change

Adds a new config option disable_local_ca_jwt which defaults to false. So by default, the current behavior is preserved: if either kubernetes_ca_cert or token_reviewer_jwt isn't specified, the local version in the pod will be used. Setting disable_local_ca_jwt=true disables using the local versions.

Related Issues/Pull Requests

• Issue #93
• PR #94

Contributor Checklist

• My Docs PR Link
• Add output for any tests not ran in CI to the PR description (eg, acceptance tests)

testacc output, Click to expand!

❯ make testacc
==> Checking that code complies with gofmt requirements...
go generate 
VAULT_ACC=1 go test -tags='vault-plugin-auth-kubernetes' $(go list ./... | grep -v /vendor/) -v  -timeout 45m
=== RUN   TestConfig_Read
--- PASS: TestConfig_Read (0.00s)
=== RUN   TestConfig
--- PASS: TestConfig (0.00s)
=== RUN   TestConfig_LocalCaJWT
=== RUN   TestConfig_LocalCaJWT/no_CA_or_JWT,_default_to_local
=== RUN   TestConfig_LocalCaJWT/CA_set,_default_to_local_JWT
=== RUN   TestConfig_LocalCaJWT/JWT_set,_default_to_local_CA
=== RUN   TestConfig_LocalCaJWT/CA_and_disable_local_default
--- PASS: TestConfig_LocalCaJWT (0.00s)
    --- PASS: TestConfig_LocalCaJWT/no_CA_or_JWT,_default_to_local (0.00s)
    --- PASS: TestConfig_LocalCaJWT/CA_set,_default_to_local_JWT (0.00s)
    --- PASS: TestConfig_LocalCaJWT/JWT_set,_default_to_local_CA (0.00s)
    --- PASS: TestConfig_LocalCaJWT/CA_and_disable_local_default (0.00s)
=== RUN   TestLogin
--- PASS: TestLogin (0.00s)
=== RUN   TestLogin_ECDSA_PEM
--- PASS: TestLogin_ECDSA_PEM (0.01s)
=== RUN   TestLogin_NoPEMs
--- PASS: TestLogin_NoPEMs (0.00s)
=== RUN   TestLoginSvcAcctAndNamespaceSplats
2020-09-18T13:42:49.955-0700 [ERROR] login unauthorized due to: JWT names did not match
--- PASS: TestLoginSvcAcctAndNamespaceSplats (0.00s)
=== RUN   TestAliasLookAhead
--- PASS: TestAliasLookAhead (0.00s)
=== RUN   TestLoginIssValidation
--- PASS: TestLoginIssValidation (0.00s)
=== RUN   TestLoginProjectedToken
=== RUN   TestLoginProjectedToken/normal
=== RUN   TestLoginProjectedToken/fail
=== RUN   TestLoginProjectedToken/projected-token
=== RUN   TestLoginProjectedToken/projected-token-expired
=== RUN   TestLoginProjectedToken/projected-token-invalid-role
--- PASS: TestLoginProjectedToken (0.00s)
    --- PASS: TestLoginProjectedToken/normal (0.00s)
    --- PASS: TestLoginProjectedToken/fail (0.00s)
    --- PASS: TestLoginProjectedToken/projected-token (0.00s)
    --- PASS: TestLoginProjectedToken/projected-token-expired (0.00s)
    --- PASS: TestLoginProjectedToken/projected-token-invalid-role (0.00s)
=== RUN   TestPath_Create
--- PASS: TestPath_Create (0.00s)
=== RUN   TestPath_Read
--- PASS: TestPath_Read (0.00s)
=== RUN   TestPath_Delete
--- PASS: TestPath_Delete (0.00s)
PASS
ok  	github.com/hashicorp/vault-plugin-auth-kubernetes	0.342s
?   	github.com/hashicorp/vault-plugin-auth-kubernetes/cmd/vault-plugin-auth-kubernetes	[no test files]

• Backwards compatible

[catsby]

LGTM, comment on testing style

[catsby]

LGTM