Vault Token

Infrastructure as Code & Cloud Native
,
4

I realize this is a 4y old thread, but it comes up in search, so adding this for anyone later.

The missing token error from auth/jwt/login means the request reached Vault with an empty jwt field, so $CI_JOB_JWT was empty in that job. It wasn’t a tier limitation: the manual vault write auth/jwt/login … jwt=… flow works on all tiers. Maybe you hit this or a related bug?

Today you don’t use CI_JOB_JWT at all (deprecated in 15.9, removed in 17.0). You mint the token explicitly with an id_tokens block and reference that variable:


auth_job:
  id_tokens:
    VAULT_ID_TOKEN:
      aud: https://vault.example.com   # must match the role's bound_audiences
  script:
    - export VAULT_TOKEN="$(vault write -field=token auth/jwt/login role=$VAULT_ROLE jwt=$VAULT_ID_TOKEN)"

If it still comes back empty, the id_token variable name or the aud is usually the culprit.