When cert-manager added support for serviceAccountRef in #5502 a decision was made to set the audience to the form of "vault://[<namespace>/]<issuer>" when creating tokens for Vault. This was later extended in #6666 to allow the user to specify additional audiences.

However, this default audience pairs poorly with Vault. The JWT authentication configuration in Vault defines the bound_audiences, which is static and cannot contain dynamic entries. As of Vault 1.17, released after the serviceAccountRef support was added to cert-manager, if bound_audiences is not set, but the JWT contains audiences (which describes all requests from cert-manager), the authentication attempt is forbidden. This makes it difficult for us to use cert-manager with Vault's JWT authentication.

I'm proposing a change to add the Vault hostname (as specified in .spec.vault.server) as one of the default audiences. This retains the per-issuer audience for the use cases that require it, while giving the operators of Vault an audience that isn't dynamic to bind a generic role to. It also allows us to switch to JWT authentication in Vault without requiring changes to every issuer.

Is this a patch the cert-manager project would be interested in accepting upstream?

/kind feature