From 395099b9a1daecd7a3a811598de1db8eba27e549 Mon Sep 17 00:00:00 2001
From: benvin <neotheo@gmail.com>
Date: Sat, 18 Jul 2026 16:25:30 +1000
Subject: [PATCH] cephrgw VSO: use shared default role + templated KV path

Per review, reuse the existing shared 'default' k8s auth role and its templated
policy (kv/data/kubernetes/namespace/<ns>/<sa>/*) instead of a dedicated Vault
role/policy, so no terraform-vault change is required.

- VaultAuth: role default, serviceAccount default.
- VaultStaticSecret: path kubernetes/namespace/cephrgw-system/default/cephrgw-credentials.
---
 apps/base/cephrgw-system/vaultauth.yaml         | 7 +++++--
 apps/base/cephrgw-system/vaultstaticsecret.yaml | 8 +++++++-
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/apps/base/cephrgw-system/vaultauth.yaml b/apps/base/cephrgw-system/vaultauth.yaml
index fe747e6..ceb64b7 100644
--- a/apps/base/cephrgw-system/vaultauth.yaml
+++ b/apps/base/cephrgw-system/vaultauth.yaml
@@ -11,8 +11,11 @@ spec:
   allowedNamespaces:
     - cephrgw-system
   kubernetes:
-    role: cephrgw-operator
-    serviceAccount: cephrgw-operator
+    # Shared "default" role: binds the namespace's default ServiceAccount and
+    # grants the templated kv/kubernetes/namespace/<ns>/<sa>/* read policy, so
+    # no per-app terraform-vault change is needed.
+    role: default
+    serviceAccount: default
     audiences:
       - vault
     tokenExpirationSeconds: 600
diff --git a/apps/base/cephrgw-system/vaultstaticsecret.yaml b/apps/base/cephrgw-system/vaultstaticsecret.yaml
index 6de026a..142cc74 100644
--- a/apps/base/cephrgw-system/vaultstaticsecret.yaml
+++ b/apps/base/cephrgw-system/vaultstaticsecret.yaml
@@ -3,6 +3,12 @@
 # Secret the operator Deployment consumes via envFrom. The KV secret's keys
 # (CEPH_DASHBOARD_URL/USERNAME/PASSWORD, optional CEPH_RGW_ENDPOINT/CA) are
 # copied verbatim, so they land as the matching env vars.
+#
+# The path sits under the templated default policy
+# (kv/data/kubernetes/namespace/<ns>/<sa>/*), so it needs no dedicated Vault
+# role or policy. Seed the values with:
+#   vault kv put kv/kubernetes/namespace/cephrgw-system/default/cephrgw-credentials \
+#     CEPH_DASHBOARD_URL=... CEPH_DASHBOARD_USERNAME=... CEPH_DASHBOARD_PASSWORD=...
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
 metadata:
@@ -12,7 +18,7 @@ spec:
   vaultAuthRef: default
   mount: kv
   type: kv-v2
-  path: service/cephrgw/dashboard-credentials
+  path: kubernetes/namespace/cephrgw-system/default/cephrgw-credentials
   refreshAfter: 5m
   hmacSecretData: true
   destination: