Enabling JWT authentication in HashiCorp
Enabling JWT is simple; configuring it is a little trickier. It’s simple to enable using the UI, but you need API or CLI calls to configure it securely. So, we’re going to use each of them in this process so you get a little bit of experience with each of the methods available.
There is also official GitHub documentation for this here: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-hashicorp-vault. It gives a very basic example, but it’s not up to date nor is it very secure, so we’ll use parts of it and expand on it further.
Let’s just quickly go over what we’re configuring in this section. We will configure our instance to allow JWT to be enabled as a form of authentication and for the authentication to be set up to understand how to verify GitHub tokens.
Enabling JWT for GitHub-produced tokens
In this section, we’re...