Vault Operator with external vault not working with audience claims in policy?

Vault
1

So … trying out the Vault operator, and running through the demo in GitHub - hashicorp-education/learn-vault-secrets-operator and the article here → The Vault Secrets Operator on Kubernetes | Vault | HashiCorp Developer

Except I am using an external Vault for these examples, and I grant the system:auth-delegator access to the service account described in the VaultAuth for my external vault Kubernetes auth. Like this

apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
  name: static-auth
  namespace: app
spec:
  method: kubernetes
  mount: kubernetes
  kubernetes:
    role: role1
    serviceAccount: default
    audiences:
    - vault

And

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: vault-auth-delegator
subjects:
- kind: ServiceAccount
  name: default
  namespace: app
roleRef:
  kind: ClusterRole
  name: system:auth-delegator
  apiGroup: rbac.authorization.k8s.io

But this setup still gave me a 403 … untill I removed the audience from both my role definition in the Kubernetes Auth AND off course from my VaultAuth definition.

Without the audience there it just worked and whoopy… my secrets from vault were created.

Is there a known issue here with handling the audience claim when working against an a Vault external to Kubernetes?

2

Actually … this should probably be a github issue to the vault operator repo … creating it there and leaving this here still … Audience claims issues when using client jwt to external vault authentication? · Issue #553 · hashicorp/vault-secrets-operator · GitHub