hashicorp / hashicorp/vault-secrets-operator
when using defaultAuthMethod, the serviceaccount is looked up in the namespace where vaultstaticsecret is deployed
- Dominant language
- Go
- Stars
- 601
- Forks
- 145
- Avg merge
- 3d 8h
- Merged PRs (30d)
- 6
Description
**Describe the bug**
defaultAuthMethod is looking for the serviceaccount in the namespace where vaultstaticsecret is deployed. I guess since vaultAuth is reused for defaultAuthMethod, it ends up looking for serviceaccount in the namespace of vaultstaticsecret instead of operator namespace.
**To Reproduce**
Steps to reproduce the behavior:
1. Configure defaultAuthMethod while deploying VSO in a namespace "vso-namespace", this will result in VaultAuth named "default" to be created in vso-namespace.
2. We also create a serviceaccount named "vso-sa" in same namespace i.e. "vso-namespace"
```
defaultAuthMethod:
enabled: true
namespace: ""
allowedNamespaces: []
method: jwt
mount: jwt
jwt:
role: vso-role
secretRef: ""
serviceAccount: vso-sa
tokenAudiences: ["vault"]
```
hashicorp vault configurations
vault secrets enable -path=kvv2 kv-v2
vault kv put kvv2/fed-grafana/admin-cred user="admin" password="admin123"
vault auth enable jwt
vault write auth/jwt/config \
jwt_validation_pubkeys="-----BEGIN PUBLIC KEY-----
-----END PUBLIC KEY-----"
Configure vault and create the needed policy and jwt role
vault policy write dev - <
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing how defaultAuthMethod is reused through VaultAuth when a VaultStaticSecret is reconciled across namespaces. Reproduce the configuration with vso-namespace, app-namespace, and service account vso-sa, then inspect the related reconciliation entry points. Done means the default auth method finds vso-sa in the operator namespace and the VaultStaticSecret syncs successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100