kedacore/keda
Hashicorp vault auth allow tokens directly set in TriggerAuthentication
開放
#6,026 建立於 2024年8月2日
authbuggood first issuehelp wantedsecurity
倉庫指標
- 星標
- (10,372 顆星)
- PR 合併指標
- (平均合併 8天 8小時) (30 天內合併 94 個 PR)
描述
Report
Currently, hashicorp vault auth supports 2 login methods, one based on service account and other based on tokens.
The problem is that the token isn't provided from a secret but from the TriggerAuthentication directly. This is a security risk as TriggerAuthentication isn't a sensitive API by design:
Expected Behavior
The token should be recovered from a secret
Actual Behavior
The token is read from the TriggerAuthentication manifest