hc-vault: Support for kubernetes auth
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 23.1k
- Forks
- 1.1k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 9
Description
There are code examples here: https://developer.hashicorp.com/vault/docs/auth/kubernetes#code-example
argocd-vault-plugin can already use it and it would be the best possible KMS alternative for on-premise usage
https://argocd-vault-plugin.readthedocs.io/en/stable/backends/#kubernetes-authentication
I personally prefer sops with helm-secrets than AVP as it's visible in git tree when secret changes and you can actually follow the changes later. Not talking about encrypting with spare key (eg. GPG) for some disaster case.
This allows usage of sops with helm-secrets in argocd-repo-server without providing any token to HC Vault, just using ServiceAccount.
Probably more usecases can be found, but IMO this one is major and it's actually my usecase.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the HashiCorp Vault Kubernetes auth code example and the argocd-vault-plugin Kubernetes authentication documentation linked in the issue. Then locate sops's existing secret-management and authentication entry points; done should mean a defined hc-vault Kubernetes-auth flow that uses a ServiceAccount without requiring a Vault token, with tests and configuration requirements clarified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- authentication, devops, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100