hashicorp / hashicorp/vault-helm

auto_join with k8s as provider can auto apply to current namespace

Open
#847 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Shell
Stars
1.3k
Forks
897
Avg merge
3d 1h
Merged PRs (30d)
1

Description

Is your feature request related to a problem? Please describe.

Ideally, we expect use helm chart with model:

helm install ./vault-helm --namespace MY_NS

everytime, when we switch namespaces, expect MY_NS as only parameter we need to modify.

However, if set auto_join with k8s as provider, the config is like:

      storage "raft" {
          path = "/vault/data"
          retry_join {
            auto_join = "provider=k8s label_selector=\"app.kubernetes.io/name=vault,component=server\" namespace=\"MY_NS\" "
            auto_join_port = 8200
            leader_tls_servername = "vault"
            auto_join_scheme = "https"
            leader_ca_cert_file = "/vault/cert/vault.ca"
            leader_client_key_file = "/vault/cert/vault.key"
            leader_client_cert_file = "/vault/cert/vault.crt"
          }
        }

We have to manually define the namespace here if we expect Vault only discover PODs within same namespace.

the root cause is that go-discover need explicitly argus input.
https://github.com/hashicorp/go-discover/blob/master/provider/k8s/k8s_discover.go#L103

Describe the solution you'd like

Maybe something like:

let k8s_discover.go accept environment variable.

helm chart feeds .Release.Namespace to this environment variable with configuration flag.

Eg:
below this line:https://github.com/hashicorp/vault-helm/blob/main/values.yaml#L788

      # Set the setDiscoverNamespace to current deploy namespace
      setDiscoverNamespace: true

Describe alternatives you've considered
N/A

Additional context
N/A

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading go-discover's k8s_discover.go around the referenced argument handling, then inspect vault-helm's values.yaml near the setDiscoverNamespace setting. Trace how the chart can expose .Release.Namespace to discovery without requiring a manually edited namespace. Done means auto_join discovers pods in the current namespace when enabled, while explicit namespace configuration remains usable.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, helm, kubernetes
Domain
devops, infrastructure
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.