Comments (9)
I just wanted to follow up and confirm everything works on our end. Thanks so much for making this change!
from vault-secrets-operator.
Unless I'm mistaken I think a ClusterRoleBinding
should always be created. I'm happy to submit an MR.
from vault-secrets-operator.
I added this namespaced
config to allow a vault operator instance per namespace. This instance "namespaced" instance can then have limited access to a subset of the vault instance, with it's own ACL rules in Vault. For this reason, a RoleBinding
is used, allowing the service account only access to the current namespace, instead of a global ClusterRoleBinding
.
from vault-secrets-operator.
We are attempting to run a vault operator instance in each namespace. The issue we're having is that vault cannot create TokenReview
resources when the service account JWT it is using only has aRoleBinding
.
As I understand it, the reason for this is that TokenReview
resources are not namespaced in kubernetes. Your service account needs a ClusterRoleBinding
in order to create them.
from vault-secrets-operator.
Hi @acornax, I didn't find the time to verify this, but after reading the following blog post https://wanwenli.com/kubernetes/2019/08/28/k8s-tokenreview-api-vault.html, I think you are right and we have to create a ClusterRoleBinding, which binds the system:auth-delegator
ClusterRole to the ServiceAccount, when the Kubernetes authentication method is used.
I will check this out as soon as possible, but I think we can:
- Remove the
{{ include "vault-secrets-operator.kubernetesAuthRules" . | indent 2 }}
rules - Use a
Role
instead of aClusterRole
for namespaced deployments - Create an additional ClusterRole when the Kubernetes auth method is used, which binds the
system:auth-delegator
ClusterRole to the ServiceAccount of the operator
@bartmeuris are you using the Kubernetes auth method or token based authentication?
from vault-secrets-operator.
@bartmeuris are you using the Kubernetes auth method or token based authentication?
At the moment token-based, k8s based was limited to one cluster last time I checked, and I'm dealing with quite a few more (and only one vault instance)
from vault-secrets-operator.
Thanks @bartmeuris, thats it. The described problem is "only" relevant, when the operator uses the Kubernetes auth method.
I created an PR, which should fix the problem, by creating an additional ClusterRole and ClusterRoleBinding, when the Kubernetes auth method is used. This should allow namespaced deployments using the Kubernetes auth method now.
@acornax if you want, you can test #83, before we are merging this to master.
from vault-secrets-operator.
Thanks! I'll test it out tomorrow.
from vault-secrets-operator.
Thanks for reporting and your feedback.
from vault-secrets-operator.
Related Issues (20)
- Adding support for more `SecretEngine`s? HOT 1
- Add multi-cluster k8s support? HOT 1
- Install via GitOps way (FluxCD)? HOT 2
- Vault operator init command error with new vault image 1.12.1 HOT 1
- kubernetes auth not working HOT 8
- Recovering from an invalid key in Vault by vault-secrets-operator in VaultSecret object HOT 3
- Future of the project HOT 2
- Image/Release version mismatch HOT 2
- Error in time start pod 'unsupported protocol scheme' HOT 1
- no azure identity found for request clientID HOT 4
- Throw the error that could not update status when delete VaultSecret via foreground cascading deletion HOT 1
- Add support for RabbitMQ secret engine HOT 1
- Security question - bind vaultRole to k8s namespace HOT 1
- Exclude given VaultSecrets HOT 9
- How to force update the generated Secret when the value is changed in Vault? HOT 2
- Metrics not cleaned up after secret removal HOT 1
- error: leader election lost HOT 4
- TLS failed to verify certificate HOT 4
- AWS IAM Authentication - Experiencing issues because VSO is not renewing IAM Role Token inside Kuberenetes Pod (IRSA) HOT 1
- Check secret resource is changed before updating it
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from vault-secrets-operator.