From 11166466fff2f3eee30bfb178bbd78ee15adf81e Mon Sep 17 00:00:00 2001 From: Guangning E Date: Fri, 3 Jul 2026 18:52:31 +0800 Subject: [PATCH 1/2] Set Vault OIDC rotation period default to 256000h --- charts/sn-platform/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/sn-platform/values.yaml b/charts/sn-platform/values.yaml index 9e7b72595..a6386bdf9 100644 --- a/charts/sn-platform/values.yaml +++ b/charts/sn-platform/values.yaml @@ -2850,7 +2850,7 @@ vault: name: "" oidcToken: # verification_ttl cannot be longer than 10x rotation_period - rotation_period: 24h + rotation_period: 256000h # verification_ttl should be greater than the value of ttl below # https://developer.hashicorp.com/vault/api-docs/secret/identity/tokens#verification_ttl verification_ttl: 24h From 0e0e777c038df0a2c279b097240ad4237d4027dc Mon Sep 17 00:00:00 2001 From: Guangning E Date: Fri, 3 Jul 2026 19:09:15 +0800 Subject: [PATCH 2/2] Use configured Vault OIDC rotation period in LDAP init --- .../vault-ldap-init.sh | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/charts/sn-platform/conf/vault/init_vault_streamnative_console/vault-ldap-init.sh b/charts/sn-platform/conf/vault/init_vault_streamnative_console/vault-ldap-init.sh index 8ce0116f8..212411ad7 100644 --- a/charts/sn-platform/conf/vault/init_vault_streamnative_console/vault-ldap-init.sh +++ b/charts/sn-platform/conf/vault/init_vault_streamnative_console/vault-ldap-init.sh @@ -17,33 +17,33 @@ sed -i "s#MOUNT_ACCESSOR#$serviceAccountMountAccessor#g" /vault-ldap/super-servi vault policy write user /vault-ldap/user.hcl vault write identity/entity name="user" policies="user" -vault write identity/oidc/key/user name=user rotation_period=24h verification_ttl=24h +vault write identity/oidc/key/user name=user rotation_period=$ROTATION_PERIOD verification_ttl=24h vault write identity/oidc/role/user key=user ttl=12h template=@/vault-ldap/user-template.json userClientId=$(vault read identity/oidc/role/user | grep client_id | awk '{print $2}') -vault write identity/oidc/key/user name=user rotation_period=24h verification_ttl=24h allowed_client_ids=$userClientId +vault write identity/oidc/key/user name=user rotation_period=$ROTATION_PERIOD verification_ttl=24h allowed_client_ids=$userClientId vault policy write super-user /vault-ldap/user.hcl vault write identity/entity name="super-user" policies="super-user" -vault write identity/oidc/key/super-user name=super-user rotation_period=24h verification_ttl=24h +vault write identity/oidc/key/super-user name=super-user rotation_period=$ROTATION_PERIOD verification_ttl=24h vault write identity/oidc/role/super-user key=super-user ttl=12h template=@/vault-ldap/super-user-template.json superUserClientId=$(vault read identity/oidc/role/super-user | grep client_id | awk '{print $2}') -vault write identity/oidc/key/super-user name=super-user rotation_period=24h verification_ttl=24h allowed_client_ids=$superUserClientId +vault write identity/oidc/key/super-user name=super-user rotation_period=$ROTATION_PERIOD verification_ttl=24h allowed_client_ids=$superUserClientId vault policy write service-account /vault-ldap/service-account.hcl vault write identity/entity name="service-account" policies="service-account" canonicalId=$(vault read identity/entity/name/service-account | grep -v _id | grep id | awk '{print $2}') vault write identity/entity-alias name="service-account" mount_accessor=$serviceAccountMountAccessor canonical_id=$canonicalId metadata=name='service-account' -vault write identity/oidc/key/service-account name=service-account rotation_period=24h verification_ttl=24h +vault write identity/oidc/key/service-account name=service-account rotation_period=$ROTATION_PERIOD verification_ttl=24h vault write identity/oidc/role/service-account key=service-account ttl=12h template=@/vault-ldap/service-account-template.json serviceAccountClientId=$(vault read identity/oidc/role/service-account | grep client_id | awk '{print $2}') -vault write identity/oidc/key/service-account name=service-account rotation_period=24h verification_ttl=24h allowed_client_ids=$serviceAccountClientId +vault write identity/oidc/key/service-account name=service-account rotation_period=$ROTATION_PERIOD verification_ttl=24h allowed_client_ids=$serviceAccountClientId vault policy write super-service-account /vault-ldap/service-account.hcl vault write identity/entity name="super-service-account" policies="super-service-account" canonicalId=$(vault read identity/entity/name/super-service-account | grep -v _id | grep id | awk '{print $2}') vault write identity/entity-alias name="super-service-account" mount_accessor=$serviceAccountMountAccessor canonical_id=$canonicalId metadata=name='super-service-account' -vault write identity/oidc/key/super-service-account name=super-service-account rotation_period=24h verification_ttl=24h +vault write identity/oidc/key/super-service-account name=super-service-account rotation_period=$ROTATION_PERIOD verification_ttl=24h vault write identity/oidc/role/super-service-account key=super-service-account ttl=12h template=@/vault-ldap/super-service-account-template.json superServiceAccountClientId=$(vault read identity/oidc/role/super-service-account | grep client_id | awk '{print $2}') -vault write identity/oidc/key/super-service-account name=super-service-account rotation_period=24h verification_ttl=24h allowed_client_ids=$superServiceAccountClientId +vault write identity/oidc/key/super-service-account name=super-service-account rotation_period=$ROTATION_PERIOD verification_ttl=24h allowed_client_ids=$superServiceAccountClientId vault write auth/approle/role/apachepulsar policies=super-service-account