unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Add kubernetes auth role for logging/vlogs #159

Closed
unkin-agent wants to merge 1 commits from benvin/vlogs-serviceaccount-auth into master
pull from: benvin/vlogs-serviceaccount-auth
merge into: unkin:master
Conversation 1 Commits 1 Files Changed 2
+8
unkin-agent commented 2026-09-28 22:37:35 +10:00
Member
Copy Link
Copy Source

The vlogs pod in the logging namespace has no way to authenticate to Vault: the blanket k8s role only binds the default service account, so a pod running as vlogs cannot log in or read its own KV secrets.

  • Add the logging_vlogs kubernetes auth role, bound to service account vlogs in namespace logging only, with the pod-side vault audience and 600s ttls.
  • Bind the shared templated kv/kubernetes policy to the new role, scoping its reads to its own namespace/service-account subtree.
The vlogs pod in the logging namespace has no way to authenticate to Vault: the blanket k8s role only binds the `default` service account, so a pod running as `vlogs` cannot log in or read its own KV secrets. - Add the `logging_vlogs` kubernetes auth role, bound to service account `vlogs` in namespace `logging` only, with the pod-side `vault` audience and 600s ttls. - Bind the shared templated `kv/kubernetes` policy to the new role, scoping its reads to its own namespace/service-account subtree.
unkin-agent added 1 commit 2026-09-28 22:37:35 +10:00
Add logging/vlogs kubernetes auth role
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
dc18f2e556 
Bind the templated kv/kubernetes policy to it
unkin-agent commented 2026-09-28 22:39:50 +10:00
Author
Member
Copy Link
Copy Source
  • nit: PR body says the grant is kv/data/kubernetes/namespace/logging/vlogs/* "and nothing wider" — attaching to policies/kv/kubernetes/default.yaml also grants the templated cluster-scoped rule (kv/data/kubernetes/cluster/au/syd1/logging/vlogs/*); body should mention both rules the role actually gets.
- nit: PR body says the grant is `kv/data/kubernetes/namespace/logging/vlogs/*` "and nothing wider" — attaching to `policies/kv/kubernetes/default.yaml` also grants the templated cluster-scoped rule (`kv/data/kubernetes/cluster/au/syd1/logging/vlogs/*`); body should mention both rules the role actually gets.
unkin-agent closed this pull request 2026-09-28 22:43:06 +10:00
All checks were successful
ci/woodpecker/pr/plan Pipeline was successful
Required
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Required
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#159
Delete Branch "benvin/vlogs-serviceaccount-auth"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?