<p>I have my own hosted Kubernetes cluster where I store my secrets in vault. To give my microservices access to the secrets managed by vault, I want to authenticate my microservices via their service accounts. The problem I'm facing is that vault rejects the service accounts (JWTs) with the following error:</p>
<pre><code>apis/authentication.k8s.io/v1/tokenreviews: x509: certificate signed by unknown authority
</code></pre>
<p>The service accounts are signed with Kubernetes own CA. I did not replace this with Vault's <code>pki</code> solution. Is it possible to configure Vault to trust my Kubernetes CA certificate and therefore the JWTs?</p>

<p>This kind of error can be caused by a recent change to <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-issuer-discovery" rel="nofollow noreferrer">Service Account Issuer Discovery</a> in Kubernetes 1.21.</p>
<p>In order to mitigate this issue, there are a couple of options that you can choose from based on your expectations:</p>
<ol>
<li>Manually create a service account, secret and mount it in the pod as mentioned <a href="https://github.com/external-secrets/kubernetes-external-secrets/issues/721#issuecomment-979883828" rel="nofollow noreferrer">on this github post</a>.</li>
<li>Disable issuer validation as mentioned <a href="https://github.com/external-secrets/kubernetes-external-secrets/issues/721#issue-868030068" rel="nofollow noreferrer">on another github post</a>.</li>
<li>Downgrade the cluster to version 1.20.</li>
</ol>
<p>There are also a couple of external blog articles about this on <a href="https://banzaicloud.com/blog/kubernetes-oidc/" rel="nofollow noreferrer">banzaicloud.com</a> and <a href="https://particule.io/en/blog/vault-1.21/" rel="nofollow noreferrer">particule.io</a>.</p>
