-
Notifications
You must be signed in to change notification settings - Fork 1.9k
Support for joining Actions in un-reachable GitHub Enterprise Servers via Static JWKS #48973
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
🤖 Vercel preview here: https://docs-4gtklpkkt-goteleport.vercel.app/docs/ver/preview |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It's interesting how we are adding static JWK for unreachable github enterprise, and dynamic fetching JWKS for EKS clusters with short-lived key-sets 😅
I suppose we'll need to do both each time now.
Do we know how often GHE rotates its JWKS?
🤖 Vercel preview here: https://docs-5yx8ks8v7-goteleport.vercel.app/docs/ver/preview |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I would like to see static_jwks being marshaled as structpb because json in strings doesn't marshal well
🤖 Vercel preview here: https://docs-4pq2hkhtp-goteleport.vercel.app/docs/ver/preview |
@strideynet See the table below for backport results.
|
… via Static JWKS (#48973) * Add JWKS based validator for github tokens * Extend proto * Update auth srvr github join impl to support static jwks * Ignore govet * initialize with jwks validator * Update docs * Update terraform shizz * Regenerate various things
… via Static JWKS (#48973) * Add JWKS based validator for github tokens * Extend proto * Update auth srvr github join impl to support static jwks * Ignore govet * initialize with jwks validator * Update docs * Update terraform shizz * Regenerate various things
…ervers via Static JWKS (#48973) (#49052) * Support for joining Actions in un-reachable GitHub Enterprise Servers via Static JWKS (#48973) * Add JWKS based validator for github tokens * Extend proto * Update auth srvr github join impl to support static jwks * Ignore govet * initialize with jwks validator * Update docs * Update terraform shizz * Regenerate various things * Fix key generation
Closes #30831
changelog: Added support for directly configuring JWKS for GitHub joining for circumstances where the GHES is not reachable by the Teleport Auth Service.