Audiences required for Kubernetes authentication role - Inconsistent documentation

Vault
1

I’m looking into upgrading our Vault to 1.21, and reading through the upgrade notes. I notice the “Important changes” page has a section “Audiences required for Kubernetes authentication roles”, which seems to indicate that we now need to specify an audience in the role configuration. We’re also seeing warnings like this in the logs of our existing Vault:

A role without an audience was used to authenticate into Vault. Vault v1.21+ will require roles to have an audience.

However, reading through the actual changelog, I see no mention of this change. I also don’t see it in the vault-plugin-auth-kubernetes changelog, although there I see a link to a pull request that reverted that log message, and it sounds like audiences might not be required in 1.21 after all: Update audience warning message for Kubernetes auth roles by jaireddjawed · Pull Request #330 · hashicorp/vault-plugin-auth-kubernetes · GitHub

Was this a planned change that ended up being reverted, without the documentation being updated, or do we indeed need to specify an audience in our roles configuration before upgrading to 1.21?

2 Likes
2

Hi Sarah,

I think there was/is a PR somewhere to fix that in the upgrade notes - ill see if I can find out what happened to it.

The change making it required was rolled back based on peoples feedback. It is still recommended to set audience but not required.

3

PR incoming to remove this from the 1.21 docs you were looking at - thanks for flagging.

1 Like