hashicorp / hashicorp/vault-helm
auto_join with k8s as provider can auto apply to current namespace
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 1.3k
- Forks
- 897
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 1
Description
Is your feature request related to a problem? Please describe.
Ideally, we expect use helm chart with model:
helm install ./vault-helm --namespace MY_NS
everytime, when we switch namespaces, expect MY_NS as only parameter we need to modify.
However, if set auto_join with k8s as provider, the config is like:
storage "raft" {
path = "/vault/data"
retry_join {
auto_join = "provider=k8s label_selector=\"app.kubernetes.io/name=vault,component=server\" namespace=\"MY_NS\" "
auto_join_port = 8200
leader_tls_servername = "vault"
auto_join_scheme = "https"
leader_ca_cert_file = "/vault/cert/vault.ca"
leader_client_key_file = "/vault/cert/vault.key"
leader_client_cert_file = "/vault/cert/vault.crt"
}
}
We have to manually define the namespace here if we expect Vault only discover PODs within same namespace.
the root cause is that go-discover need explicitly argus input.
https://github.com/hashicorp/go-discover/blob/master/provider/k8s/k8s_discover.go#L103
Describe the solution you'd like
Maybe something like:
let k8s_discover.go accept environment variable.
helm chart feeds .Release.Namespace to this environment variable with configuration flag.
Eg:
below this line:https://github.com/hashicorp/vault-helm/blob/main/values.yaml#L788
# Set the setDiscoverNamespace to current deploy namespace
setDiscoverNamespace: true
Describe alternatives you've considered
N/A
Additional context
N/A
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading go-discover's k8s_discover.go around the referenced argument handling, then inspect vault-helm's values.yaml near the setDiscoverNamespace setting. Trace how the chart can expose .Release.Namespace to discovery without requiring a manually edited namespace. Done means auto_join discovers pods in the current namespace when enabled, while explicit namespace configuration remains usable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, helm, kubernetes
- Domain
- devops, infrastructure
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100