VAULT-21474 Run oidcPeriodicFunc for each namespace id store

[bosouza]

Description

This PR makes the identity store rotate only the OIDC keys for its own namespace. This allows the enterprise version, which supports namespaces, to scale to a larger number of namespaces without hitting timeouts on this oidcPeriodicFunc by dividing the work between multiple executions. For CE this shouldn't change anything.

ent PR: vault-enterprise#7164
Jira: VAULT-21474

TODO only if you're a HashiCorp employee

• Backport Labels: If this fix needs to be backported, use the appropriate backport/ label that matches the desired release branch. Note that in the CE repo, the latest release branch will look like backport/x.x.x, but older release branches will be backport/ent/x.x.x+ent.
  • LTS: If this fixes a critical security vulnerability or severity 1 bug, it will also need to be backported to the current LTS versions of Vault. To ensure this, use all available enterprise labels.
• ENT Breakage: If this PR either 1) removes a public function OR 2) changes the signature
  of a public function, even if that change is in a CE file, double check that
  applying the patch for this PR to the ENT repo and running tests doesn't
  break any tests. Sometimes ENT only tests rely on public functions in CE
  files.
• Jira: If this change has an associated Jira, it's referenced either
  in the PR description, commit message, or branch name.
• RFC: If this change has an associated RFC, please link it in the description.
• ENT PR: If this change has an associated ENT PR, please link it in the
  description. Also, make sure the changelog is in this PR, not in your ENT PR.

[github-actions]

CI Results:
All Go tests succeeded! ✅

[github-actions]

Build Results:
All builds succeeded! ✅

[miagilepner]

Code itself looks great!

[miagilepner]

Can we also add a change release note to say that the cache control header returned from OIDC queries will only be for the queried namespace?

[miagilepner]

It might be good to connect with @austingebauer and @fairclothjm, since I know they've done worth with OIDC before, to try to see whether this change in behavior is problematic

[bosouza]

I think I was planning on adding a separate changelog on the ent PR but that doesn't make much sense... yeah I'll update this entry with more details regarding what this means for enterprise

[bosouza]

@miagilepner John took a look at the enterprise PR here. He also asked me to run a quick smoke test for upgrade which I did and didn't see anything weird

[miagilepner]

LGTM, thank you!

[bosouza]

in merging these changes I want to avoid the normal path of 1) merge CE PR, 2) wait for changes to be merged into ENT then 3) merge the ENT PR because during the period between 1) and 3) the ENT repo would build successfully but yield a binary with a bug where OIDC keys are not rotated for any namespaces except for the root one.

So instead of the normal path I'll follow this other guide instead and merge both CE and ENT PRs at the same time.

I've ran the following command to ensure compatibility between the PRs: diff <(gh pr diff https://github.com/hashicorp/vault-enterprise/pull/7164) <(gh pr diff https://github.com/hashicorp/vault/pull/29312). It shows that the only differences between the 2 PRs are changelog/29312.txt (only exists in the CE PR), identity_store_oidc_ent_test.go, vault/logical_namespace_identity_ent.go (both only exist in ENT). I'll go ahead and merge both CE and ENT PRs at the same time.

[digivava]

reapproved after docs change