Inappropriate role binding created by helm chart when rbac.namespaced is true about vault-secrets-operator HOT 9 CLOSED

I just wanted to follow up and confirm everything works on our end. Thanks so much for making this change!

from vault-secrets-operator.

Unless I'm mistaken I think a ClusterRoleBinding should always be created. I'm happy to submit an MR.

from vault-secrets-operator.

I added this namespaced config to allow a vault operator instance per namespace. This instance "namespaced" instance can then have limited access to a subset of the vault instance, with it's own ACL rules in Vault. For this reason, a RoleBinding is used, allowing the service account only access to the current namespace, instead of a global ClusterRoleBinding.

from vault-secrets-operator.

We are attempting to run a vault operator instance in each namespace. The issue we're having is that vault cannot create TokenReview resources when the service account JWT it is using only has aRoleBinding.

As I understand it, the reason for this is that TokenReview resources are not namespaced in kubernetes. Your service account needs a ClusterRoleBinding in order to create them.

from vault-secrets-operator.

Hi @acornax, I didn't find the time to verify this, but after reading the following blog post https://wanwenli.com/kubernetes/2019/08/28/k8s-tokenreview-api-vault.html, I think you are right and we have to create a ClusterRoleBinding, which binds the system:auth-delegator ClusterRole to the ServiceAccount, when the Kubernetes authentication method is used.

I will check this out as soon as possible, but I think we can:

• Remove the {{ include "vault-secrets-operator.kubernetesAuthRules" . | indent 2 }} rules
• Use a Role instead of a ClusterRole for namespaced deployments
• Create an additional ClusterRole when the Kubernetes auth method is used, which binds the system:auth-delegator ClusterRole to the ServiceAccount of the operator

@bartmeuris are you using the Kubernetes auth method or token based authentication?

from vault-secrets-operator.

@bartmeuris are you using the Kubernetes auth method or token based authentication?

At the moment token-based, k8s based was limited to one cluster last time I checked, and I'm dealing with quite a few more (and only one vault instance)

from vault-secrets-operator.

Thanks @bartmeuris, thats it. The described problem is "only" relevant, when the operator uses the Kubernetes auth method.

I created an PR, which should fix the problem, by creating an additional ClusterRole and ClusterRoleBinding, when the Kubernetes auth method is used. This should allow namespaced deployments using the Kubernetes auth method now.

@acornax if you want, you can test #83, before we are merging this to master.

from vault-secrets-operator.

Thanks! I'll test it out tomorrow.

from vault-secrets-operator.

Thanks for reporting and your feedback.

from vault-secrets-operator.