fix: enable Vault JWT auth without Spire for KMS signing by infernus01 · Pull Request #1616 · tektoncd/chains

infernus01 · 2026-04-08T06:49:21Z

Changes

Setting signers.kms.auth.oidc.path and signers.kms.auth.oidc.role in the Chains ConfigMap without Spire does nothing. The OIDC path and role are parsed correctly but never used — the code falls through to VAULT_TOKEN /~/.vault-token and fails:
error configuring kms signer with config {hashivault://supply-chain {http://vault.vault:8200/ {jwt tekton-chains} { }}}: read .vault-token file: open /home/nonroot/.vault-token: no such file or directory

Now with this PR, when OIDC path/role are configured and no Spire or static token is present, read the Kubernetes service account token from /var/run/secrets/kubernetes.io/serviceaccount/token and use it for Vault JWT auth. A new config key signers.kms.auth.oidc.token-path allows overriding the default path.
Priority order: Spire → static token → K8s SA token

fixes: #1479

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

Has Docs included if any changes are user facing
Has Tests included if any functionality added or changed
Follows the commit message standard
Meets the Tekton contributor standards (including
functionality, content, code)
Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings)
Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

Fix Vault KMS JWT auth (OIDC) to work without Spire by reading the Kubernetes service account token when signers.kms.auth.oidc.path and signers.kms.auth.oidc.role are configured. Added new optional config key signers.kms.auth.oidc.token-path to override the default token file path.

infernus01 · 2026-04-08T06:49:44Z

/kind bug

ab-ghosh · 2026-04-20T13:24:30Z

Core fix looks good, the priority chain (Spire → static token → K8s SA JWT) preserves backward compatibility.
Tested the changes and it works and fixes the bug

/lgtm

jkhelil · 2026-04-22T06:06:42Z

Please add a release note

When signers.kms.auth.oidc.path and signers.kms.auth.oidc.role are set in the Chains ConfigMap without Spire, the controller now reads the Kubernetes service account token from the pod filesystem and uses it for Vault JWT auth login. Previously, the OIDC token field was only populated by Spire, causing the code to fall through to VAULT_TOKEN lookup and fail with "read .vault-token file: no such file or directory". Signed-off-by: Shubham Bhardwaj <shubbhar@redhat.com>

tekton-robot · 2026-05-06T12:28:18Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign jkhelil after the PR has been reviewed.
You can assign the PR to them by writing /assign @jkhelil in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

ab-ghosh · 2026-05-12T07:50:31Z

+		if tokenPath == "" {
+			tokenPath = defaultOIDCTokenPath
+		}
+		token, err := os.ReadFile(tokenPath)


can we reuse the existing getKMSAuthToken function here instead of calling os.ReadFile directly

Ah yes that is intentional, since getKMSAuthToken uses TrimSuffix("\n") which only strips a single trailing newline. That's fine for static Vault tokens, but for the OIDC JWT path I used TrimSpace because for example if someone has a token file with just whitespaces like " \n \n", TrimSuffix would leave " \n " (looks non-empty, gets sent to Vault, confusing error), while TrimSpace correctly gives us "" which we then catch with the empty file check.

The empty file check itself is the other difference, since getKMSAuthToken might return "" without error, but here an empty token might cause the code to drop the entire OIDC config and fall back to VAULT_TOKEN, which is the exact bug this PR is fixing.

So same os.ReadFile, but different post-processing needs.

ab-ghosh · 2026-05-12T11:12:27Z

/lgtm

infernus01 · 2026-05-19T09:44:28Z

/cc @ab-ghosh @anithapriyanatarajan @jkhelil

Copilot

Pull request overview

This PR fixes Vault KMS JWT (OIDC) auth when running Tekton Chains without Spire by adding a fallback that reads the Kubernetes service account token from a file and passes it as the Vault JWT for login.

Changes:

Add signers.kms.auth.oidc.token-path config to specify a JWT file for Vault OIDC auth (defaulting to the K8s SA token path).
Update KMS signer initialization to load the JWT from file when OIDC is configured and no Spire/static token is present.
Add unit tests and docs coverage for the new configuration behavior.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
pkg/config/config.go	Adds `KMSAuthOIDC.TokenPath` and parses the new config key.
pkg/config/config_test.go	Adds a test ensuring the new OIDC token-path config is parsed correctly.
pkg/chains/signing/kms/kms.go	Implements OIDC JWT file fallback (default K8s SA token path).
pkg/chains/signing/kms/kms_test.go	Adds tests for the OIDC JWT file behavior and precedence.
docs/config.md	Documents `signers.kms.auth.oidc.token-path` and its default.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

 		rpcAuth.OIDC.Token = token
 	}
+
+	if rpcAuth.OIDC.Token == "" && rpcAuth.Token == "" && (cfg.Auth.OIDC.Path != "" || cfg.Auth.OIDC.Role != "") {


 	"github.com/tektoncd/chains/pkg/chains/signing"
 )

+const defaultOIDCTokenPath = "/var/run/secrets/kubernetes.io/serviceaccount/token" //nolint:gosec // Not a credential, this is the path to read the K8s SA token file from


+		switch {
+		case r.URL.Path == "/v1/auth/jwt/login" && r.Method == http.MethodPut:
+			loginCalled = true
+			receivedPath = "jwt"
+


+	assert.Equal(t, "jwt", receivedPath,
+		"auth path must match the configured OIDC path")


+	if err == nil {
+		t.Fatal("expected error when default SA token path does not exist")
+	}
+	assert.Contains(t, err.Error(), "reading OIDC token")
+	assert.Contains(t, err.Error(), defaultOIDCTokenPath,
+		"error must reference the default K8s SA token path")
+}


jkhelil · 2026-06-16T13:46:14Z

 		rpcAuth.OIDC.Token = token
 	}
+
+	if rpcAuth.OIDC.Token == "" && rpcAuth.Token == "" && (cfg.Auth.OIDC.Path != "" || cfg.Auth.OIDC.Role != "") {


+1 to copilot

jkhelil · 2026-06-16T13:47:16Z

 	}
+
+	if rpcAuth.OIDC.Token == "" && rpcAuth.Token == "" && (cfg.Auth.OIDC.Path != "" || cfg.Auth.OIDC.Role != "") {
+		tokenPath := cfg.Auth.OIDC.TokenPath


add debug
logger.Debug("OIDC token path for Vault JWT auth", "path", tokenPath)

tekton-robot requested review from jkhelil and wlynch April 8, 2026 06:49

tekton-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Apr 8, 2026

tekton-robot added the kind/bug Categorizes issue or PR as related to a bug. label Apr 8, 2026

infernus01 force-pushed the vault-auth branch from 82dc8dc to d61310d Compare April 8, 2026 08:22

infernus01 closed this Apr 9, 2026

infernus01 reopened this Apr 9, 2026

tekton-robot assigned ab-ghosh Apr 20, 2026

tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Apr 20, 2026

infernus01 force-pushed the vault-auth branch from d61310d to 7e8ebb9 Compare May 6, 2026 12:28

tekton-robot removed the lgtm Indicates that a PR is ready to be merged. label May 6, 2026

ab-ghosh reviewed May 12, 2026

View reviewed changes

tekton-robot added the lgtm Indicates that a PR is ready to be merged. label May 12, 2026

tekton-robot requested review from ab-ghosh and anithapriyanatarajan May 19, 2026 09:44

jkhelil requested a review from Copilot June 16, 2026 13:37

Copilot started reviewing on behalf of jkhelil June 16, 2026 13:38 View session

Copilot AI reviewed Jun 16, 2026

View reviewed changes

jkhelil reviewed Jun 16, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: enable Vault JWT auth without Spire for KMS signing#1616

fix: enable Vault JWT auth without Spire for KMS signing#1616
infernus01 wants to merge 1 commit into
tektoncd:mainfrom
infernus01:vault-auth

infernus01 commented Apr 8, 2026 •

edited

Loading

Uh oh!

infernus01 commented Apr 8, 2026

Uh oh!

ab-ghosh commented Apr 20, 2026

Uh oh!

jkhelil commented Apr 22, 2026

Uh oh!

tekton-robot commented May 6, 2026

Uh oh!

ab-ghosh May 12, 2026

Uh oh!

infernus01 May 12, 2026

Uh oh!

ab-ghosh commented May 12, 2026

Uh oh!

infernus01 commented May 19, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

jkhelil Jun 16, 2026

Uh oh!

jkhelil Jun 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

		assert.Equal(t, "jwt", receivedPath,
		"auth path must match the configured OIDC path")

Conversation

infernus01 commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Submitter Checklist

Release Notes

Uh oh!

infernus01 commented Apr 8, 2026

Uh oh!

ab-ghosh commented Apr 20, 2026

Uh oh!

jkhelil commented Apr 22, 2026

Uh oh!

tekton-robot commented May 6, 2026

Uh oh!

ab-ghosh May 12, 2026

Choose a reason for hiding this comment

Uh oh!

infernus01 May 12, 2026

Choose a reason for hiding this comment

Uh oh!

ab-ghosh commented May 12, 2026

Uh oh!

infernus01 commented May 19, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

jkhelil Jun 16, 2026

Choose a reason for hiding this comment

Uh oh!

jkhelil Jun 16, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

infernus01 commented Apr 8, 2026 •

edited

Loading