hashicorp / hashicorp/vault-secrets-operator

when using defaultAuthMethod, the serviceaccount is looked up in the namespace where vaultstaticsecret is deployed

Open
#827 1 comment 6 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
601
Forks
145
Avg merge
3d 8h
Merged PRs (30d)
6

Description

**Describe the bug**
defaultAuthMethod is looking for the serviceaccount in the namespace where vaultstaticsecret is deployed. I guess since vaultAuth is reused for defaultAuthMethod, it ends up looking for serviceaccount in the namespace of vaultstaticsecret instead of operator namespace.

**To Reproduce**
Steps to reproduce the behavior:
1. Configure defaultAuthMethod while deploying VSO in a namespace "vso-namespace", this will result in VaultAuth named "default" to be created in vso-namespace.
2. We also create a serviceaccount named "vso-sa" in same namespace i.e. "vso-namespace"

```
defaultAuthMethod:
enabled: true
namespace: ""
allowedNamespaces: []
method: jwt
mount: jwt
jwt:
role: vso-role
secretRef: ""
serviceAccount: vso-sa
tokenAudiences: ["vault"]
```
hashicorp vault configurations

vault secrets enable -path=kvv2 kv-v2
vault kv put kvv2/fed-grafana/admin-cred user="admin" password="admin123"

vault auth enable jwt

vault write auth/jwt/config \
jwt_validation_pubkeys="-----BEGIN PUBLIC KEY-----

-----END PUBLIC KEY-----"

Configure vault and create the needed policy and jwt role
vault policy write dev - <

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing how defaultAuthMethod is reused through VaultAuth when a VaultStaticSecret is reconciled across namespaces. Reproduce the configuration with vso-namespace, app-namespace, and service account vso-sa, then inspect the related reconciliation entry points. Done means the default auth method finds vso-sa in the operator namespace and the VaultStaticSecret syncs successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.