指定环境后GitHub Actions无法JWT认证Vault，如何配置绑定声明？

当GitHub Actions作业配置了environment后，GitHub生成的OIDC JWT令牌中的sub（主题）声明格式会发生变化，导致你原本的Vault绑定规则无法匹配。

问题根源 #

未指定环境时，sub声明格式为：

repo:organization-name/repo-name:ref:refs/heads/main

指定environment: production后，sub会追加环境标识，格式变为：

repo:organization-name/repo-name:environment:production:ref:refs/heads/main

你的Vault配置中bound_subject还是旧格式，因此认证时会出现claim "sub" does not match any associated bound claim values错误。

修改Vault配置 #

更新github_oidc_bindings中的bound_subject字段，加入环境标识：

module "github-actions" {
  source               = "../../module/github-actions"
  vault_addr           = local.vault_addr
  env                  = local.env
  application_name     = local.application_name
  role                 = format("%s-%s-onboarding", local.env, local.application_name)
  github_oidc_bindings = [
    {
      audience : "https://github.com/organization-name",
      vault_role_name : "vault-role-name",
      bound_subject : "repo:organization-name/repo-name:environment:production:ref:refs/heads/main",
      vault_policies : [
        "vault-policy-name"
      ]
    }
  ]
}

兼容有无环境的场景（可选） #

如果需要让同一个Vault角色同时支持有环境和无环境的作业，可以添加多个绑定条目，或者使用Vault的bound_claims进行更灵活的匹配：

github_oidc_bindings = [
  {
    audience : "https://github.com/organization-name",
    vault_role_name : "vault-role-name",
    # 单独绑定各字段，精准匹配环境和分支
    bound_claims = {
      repository = "organization-name/repo-name",
      ref = "refs/heads/main",
      environment = "production"
    },
    vault_policies : [
      "vault-policy-name"
    ]
  },
  # 保留原绑定支持无环境的作业
  {
    audience : "https://github.com/organization-name",
    vault_role_name : "vault-role-name",
    bound_subject : "repo:organization-name/repo-name:ref:refs/heads/main",
    vault_policies : [
      "vault-policy-name"
    ]
  }
]

验证修改 #

更新Vault配置后，重新运行带environment: production的GitHub Actions作业，即可正常完成JWT认证并获取密钥。

内容的提问来源于stack exchange，提问作者steoleary