backport of commit 6a5e556

Author: jaireddjawed

.github/PULL_REQUEST_TEMPLATE.md

@@ -18,15 +18,3 @@ How was this change implemented?
 [Example](https://github.com/hashicorp/vault/commit/2715f5cec982aabc7b7a6ae878c547f6f475bba6)
 [ ] Add output for any tests not ran in CI to the PR description (eg, acceptance tests)
 [ ] Backwards compatible
-
-## PCI review checklist
-
-<!-- heimdall_github_prtemplate:grc-pci_dss-2024-01-05 -->
-
-- [ ] I have documented a clear reason for, and description of, the change I am making.
-
-- [ ] If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
-
-- [ ] If applicable, I've documented the impact of any changes to security controls.
-
-  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

.github/workflows/backport.yaml

@@ -14,4 +14,4 @@ jobs:
       JIRA_SYNC_USER_EMAIL: ${{ secrets.JIRA_SYNC_USER_EMAIL }}
       JIRA_SYNC_API_TOKEN: ${{ secrets.JIRA_SYNC_API_TOKEN }}
     with:
-      teams-array: '["vault-eco-infra"]'
+      teams-array: '["vault-eco"]'

.github/workflows/jira.yaml

@@ -6,17 +6,17 @@ jobs:
   fmtcheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:
           go-version-file: .go-version
       - run: make fmtcheck
 
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:
           go-version-file: .go-version
       - run: make test
@@ -27,16 +27,16 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        kind-k8s-version: [1.29.14, 1.30.13, 1.31.12, 1.32.8, 1.33.4]
+        kind-k8s-version: [1.28.15, 1.29.14, 1.30.10, 1.31.6, 1.32.3]
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Create K8s Kind Cluster
         uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
         with:
           version: v0.27.0
           cluster_name: vault-plugin-auth-kubernetes
           node_image: kindest/node:v${{ matrix.kind-k8s-version }}
-      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:
           go-version-file: .go-version
       - run: make setup-integration-test

.github/workflows/tests.yaml

@@ -0,0 +1,21 @@
+---
+name: Backport Assistant Runner for Vault Plugin Eco Projects
+on:
+  pull_request_target:
+    types:
+      - closed
+      - labeled
+jobs:
+  backport-targeted-release-branch:
+    if: github.event.pull_request.merged
+    runs-on: ubuntu-latest
+    container: hashicorpdev/backport-assistant:0.3.1
+    steps:
+      - name: Backport changes to targeted release branch
+        env:
+          BACKPORT_LABEL_REGEXP: "backport/vault-(?P<target>\\d+\\.\\d+\\.\\w+)"
+          BACKPORT_TARGET_TEMPLATE: "release/vault-{{.target}}"
+          BACKPORT_MERGE_COMMIT: true
+          GITHUB_TOKEN: ${{ secrets.VAULT_ECO_GITHUB_TOKEN }}
+        run: |
+          backport-assistant backport -merge-method=squash -gh-automerge

.github/workflows/vault-plugin-backport.yml

@@ -1,59 +1,15 @@
-## v0.23.0
-### October 3, 2025
-
-* change audience warning text since audiences wont be required in Vault 1.21 (#330)
-* Upgrade Go Version (#329)
-* Automated dependency upgrades (#324)
-* ci: Update k8s versions to 1.33-1.29 (#326)
-* init changie (#323)
-* Bump actions/checkout in the github-actions-breaking group (#322)
-* Automated dependency upgrades (#317)
-* Add backport assistant workflow (#320)
-* VAULT-36974: Add backport assistant workflow (#319)
-* [Compliance] - PR Template Changes Required (#318)
-
-## 0.22.2 (June 17, 2025)
+## Unreleased
 
 ### Build
-* Build with go 1.24.4
-* Test with k8s versions 1.28-1.32
-
-### Changes
-
-Added warning that roles will require an audience starting in v0.23.0 [GH-301](https://github.com/hashicorp/vault-plugin-auth-kubernetes/pull/301).
-
-### Dependency updates
-
-  * `github.com/hashicorp/vault/api` v1.16.0 -> v1.20.0
-  * `github.com/hashicorp/vault/sdk` v0.17.0 -> v0.18.0
-
-## 0.22.1 (May 30, 2025)
-
-### Build
-* Build with go 1.24.3
+* Build with go 1.23.7
 * Test with k8s versions 1.28-1.32
 
 ### Dependency updates
-
-* `github.com/go-jose/go-jose/v4` v4.0.4 -> v4.1.0
+* `github.com/go-jose/go-jose/v4` v4.0.4 -> v4.0.5
 * `github.com/hashicorp/cap` v0.8.0 -> v0.9.0
-* `github.com/hashicorp/vault/sdk` v0.15.0 -> v0.17.0
-* `k8s.io/api` v0.32.1 -> v0.33.1
-* `k8s.io/apimachinery` v0.32.1 -> v0.33.1
-
-## 0.21.1 (June 17, 2025)
-
-### Build
-* Build with go 1.24.4
-* Test with k8s versions 1.28-1.32
-
-### Changes
-
-Added warning that roles will require an audience starting in v0.23.0 [GH-301](https://github.com/hashicorp/vault-plugin-auth-kubernetes/pull/301).
-
-### Dependency updates
-
-* `github.com/go-jose/go-jose/v4` v4.0.4 -> v4.1.0
+* `github.com/hashicorp/vault/sdk` v0.15.0 -> v0.15.2
+* `k8s.io/api` v0.32.1 -> v0.32.2
+* `k8s.io/apimachinery` v0.32.1 -> v0.32.2
 
 ## 0.21.0 (Feb 12, 2025)
 
@@ -69,20 +25,6 @@ Added warning that roles will require an audience starting in v0.23.0 [GH-301](h
 * `k8s.io/apimachinery` v0.31.0 -> v0.32.1
 * `github.com/hashicorp/go-sockaddr` v1.0.6 -> v1.0.7
 
-## 0.20.1 (June 17, 2025)
-
-### Build
-* Build with go 1.24.4
-* Test with k8s versions 1.28-1.32
-
-### Changes
-
-Added warning that roles will require an audience starting in v0.23.0 [GH-301](https://github.com/hashicorp/vault-plugin-auth-kubernetes/pull/301).
-
-### Dependency updates
-
-* `github.com/go-jose/go-jose/v4` v4.0.4 -> v4.1.0
-
 ## 0.20.0 (Sept 4, 2024)
 
 ### Build:

CHANGELOG.md

@@ -3,7 +3,7 @@ TESTARGS  ?= '-test.v'
 KIND_CLUSTER_NAME ?= vault-plugin-auth-kubernetes
 
 # kind k8s version
-KIND_K8S_VERSION ?= v1.33.4
+KIND_K8S_VERSION ?= v1.32.3
 
 .PHONY: default
 default: dev
@@ -52,7 +52,7 @@ setup-integration-test: teardown-integration-test vault-image
 	kind --name $(KIND_CLUSTER_NAME) load docker-image hashicorp/vault:dev
 	kubectl --context="kind-$(KIND_CLUSTER_NAME)" create namespace test
 	kubectl --context="kind-$(KIND_CLUSTER_NAME)" label namespaces test target=integration-test other=label
-	helm upgrade --install vault vault --repo https://helm.releases.hashicorp.com --version=0.30.1 \
+	helm upgrade --install vault vault --repo https://helm.releases.hashicorp.com --version=0.29.1 \
 		--kube-context="kind-$(KIND_CLUSTER_NAME)" \
 		--wait --timeout=5m \
 		--namespace=test \

Makefile

@@ -130,4 +130,3 @@ make setup-integration-test
 # Run the integration tests against Vault inside the cluster
 make integration-test
 ```
-

README.md

@@ -3,16 +3,16 @@ module github.com/hashicorp/vault-plugin-auth-kubernetes
 go 1.25.1
 
 require (
-	github.com/go-jose/go-jose/v4 v4.1.2
+	github.com/go-jose/go-jose/v4 v4.1.3
 	github.com/go-test/deep v1.1.1
-	github.com/hashicorp/cap v0.10.0
+	github.com/hashicorp/cap v0.11.0
 	github.com/hashicorp/go-cleanhttp v0.5.2
 	github.com/hashicorp/go-hclog v1.6.3
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2
 	github.com/hashicorp/go-sockaddr v1.0.7
 	github.com/hashicorp/go-uuid v1.0.3
-	github.com/hashicorp/vault/api v1.21.0
-	github.com/hashicorp/vault/sdk v0.19.0
+	github.com/hashicorp/vault/api v1.22.0
+	github.com/hashicorp/vault/sdk v0.20.0
 	github.com/mitchellh/mapstructure v1.5.0
 	k8s.io/api v0.34.1
 	k8s.io/apimachinery v0.34.1

go.mod

@@ -85,8 +85,8 @@ github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sa
 github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY=
 github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
-github.com/go-jose/go-jose/v4 v4.1.2 h1:TK/7NqRQZfgAh+Td8AlsrvtPoUyiHh0LqVvokh+1vHI=
-github.com/go-jose/go-jose/v4 v4.1.2/go.mod h1:22cg9HWM1pOlnRiY+9cQYJ9XHmya1bYW8OeDM6Ku6Oo=
+github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
+github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
@@ -160,8 +160,8 @@ github.com/googleapis/gax-go/v2 v2.14.1/go.mod h1:Hb/NubMaVM88SrNkvl8X/o8XWwDJEP
 github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 h1:bkypFPDjIYGfCYD5mRBvpqxfYX1YCS1PXdKYWi8FsN0=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0/go.mod h1:P+Lt/0by1T8bfcF3z737NnSbmxQAppXMRziHUxPOC8k=
-github.com/hashicorp/cap v0.10.0 h1:OJM3JQTwVO1DigRIPNTxM387oqXlokKhttZHotU0b1s=
-github.com/hashicorp/cap v0.10.0/go.mod h1:HKbv27kfps+wONFNyNTHpAQmU/DCjjDuB5HF6mFsqPQ=
+github.com/hashicorp/cap v0.11.0 h1:tnMNgIWEdbmyx0fulrlLPNHowsprg34xFWflOEB3t1s=
+github.com/hashicorp/cap v0.11.0/go.mod h1:HKbv27kfps+wONFNyNTHpAQmU/DCjjDuB5HF6mFsqPQ=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -216,10 +216,10 @@ github.com/hashicorp/golang-lru v1.0.2 h1:dV3g9Z/unq5DpblPpw+Oqcv4dU/1omnb4Ok8iP
 github.com/hashicorp/golang-lru v1.0.2/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I=
 github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
-github.com/hashicorp/vault/api v1.21.0 h1:Xej4LJETV/spWRdjreb2vzQhEZt4+B5yxHAObfQVDOs=
-github.com/hashicorp/vault/api v1.21.0/go.mod h1:IUZA2cDvr4Ok3+NtK2Oq/r+lJeXkeCrHRmqdyWfpmGM=
-github.com/hashicorp/vault/sdk v0.19.0 h1:cpjxJ5qnEEX7xtVXaFpXpqfiFTs2hzyQiHS7oJRrvMM=
-github.com/hashicorp/vault/sdk v0.19.0/go.mod h1:IYPuA9rZdJjmvssaRWhqs6XQNH6g6XBLjIxOdOVYVrM=
+github.com/hashicorp/vault/api v1.22.0 h1:+HYFquE35/B74fHoIeXlZIP2YADVboaPjaSicHEZiH0=
+github.com/hashicorp/vault/api v1.22.0/go.mod h1:IUZA2cDvr4Ok3+NtK2Oq/r+lJeXkeCrHRmqdyWfpmGM=
+github.com/hashicorp/vault/sdk v0.20.0 h1:a4ulj2gICzw/qH0A4+6o36qAHxkUdcmgpMaSSjqE3dc=
+github.com/hashicorp/vault/sdk v0.20.0/go.mod h1:xEjAt/n/2lHBAkYiRPRmvf1d5B6HlisPh2pELlRCosk=
 github.com/hashicorp/yamux v0.1.2 h1:XtB8kyFOyHXYVFnwT5C3+Bdo8gArse7j2AQ0DA0Uey8=
 github.com/hashicorp/yamux v0.1.2/go.mod h1:C+zze2n6e/7wshOZep2A70/aQU6QBRWJO/G6FT1wIns=
 github.com/jackc/chunkreader v1.0.0/go.mod h1:RT6O25fNZIuasFJRyZ4R/Y2BbhasbmZXF9QQ7T3kePo=