[Bug]: vault_kubernetes_secret_backend empty jwt when disable_local_ca_jwt true

[mikkel3000]

Terraform Core Version

1.9.2

Terraform Vault Provider Version

4.4.0

Vault Server Version

1.17.3

Affected Resource(s)

vault_kubernetes_secret_backend

Expected Behavior

When using vault_kubernetes_secret_backend with empty kubernetes_ca_cert = null and disable_local_ca_jwt = true the service account jwt should be populated, but is not.

Setting kubernetes secret backend with:

resource "vault_kubernetes_secret_backend" "vault-kubernetes-secret-backend" {
  count                = 1
  path                 = "kubernetes-example-cluster"
  kubernetes_host      = "https://cluster-api.example-cluster.myorg.com"
  kubernetes_ca_cert   = null
  service_account_jwt  = "EXAMPLEJWT"
  disable_local_ca_jwt = true
}

Expects to see.

Actual Behavior

Service Account JWT is empty.
I did not use "EXAMPLEJWT" when applying it, i used an actual service account jwt.
Gives following in vault ui:

Relevant Error/Panic Output Snippet

No errors, works fine from vault ui.

Terraform Configuration Files

resource "vault_kubernetes_secret_backend" "vault-kubernetes-secret-backend" {
  count                = 1
  path                 = "kubernetes-example-cluster"
  kubernetes_host      = "https://cluster-api.example-cluster.myorg.com"
  kubernetes_ca_cert   = null
  service_account_jwt  = "EXAMPLEJWT"
  disable_local_ca_jwt = true
}

Steps to Reproduce

Try to apply the terraform resource and observe the missing JWT.

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

No response

Would you like to implement a fix?

None

[fairclothjm]

Hello @mikkel3000, I am sorry you are having trouble here.

I believe this is expected behavior. The service_account_jwt is not returned in the READ request from the kubernetes backend's /config endpoint so the UI will have no way of displaying it.

$ vault write -f kubernetes/config kubernetes_host=foo service_account_jwt="header.payload.signature"
Success! Data written to: kubernetes/config

$ vault read kubernetes/config
Key                     Value
---                     -----
disable_local_ca_jwt    false
kubernetes_ca_cert      n/a
kubernetes_host         foo

[mikkel3000]

Ah, okay thanks. I guess something else must be the problem!