search

hashicorp / vault-plugin-auth-kubernetes

Vault authentication plugin for Kubernetes Service Accounts
https://www.vaultproject.io/docs/auth/kubernetes.html
Mozilla Public License 2.0
206 stars 62 forks source link

Support for path nesting like kv2 engine when nesting multiple kubernetes clusters configs in same path #199

Open nia-potato opened 1 year ago

nia-potato commented 1 year ago

as a operator when managing hundreds of kubernetes auth with each kubernetes cluster as a distinct auth, managing these authentication configs becomes quite a tedious job. Currently to do multiple kube auth to one vault server with path seperation we do this (correct me if im wrong):

vault auth-enable --path="/dev/kube-cluster-A" kubernetes
vault auth-enable --path="/dev/kube-cluster-B" kubernetes

vault write auth/dev/kube-cluster-A/config kubernetes_host=HOSTA:8443 ....
vault write auth/dev/kube-cluster-B/config kubernetes_host=HOSTB:8443 ...

and we will get two seperate auth paths when doing a vault auth list if we were want to further granulize the path and namespace of each kubernetes auth, we need to do something like this 

vault auth-enable --path="/dev/kube-cluster-A/default" kubernetes
vault auth-enable --path="/dev/kube-cluster-A/test" kubernetes

Is it possible to utilize what secrets engine have, where we do a auth enable to path dev/and then no need to separately enable the auth path, and can directly write configs to the kubernetes host, and that all associated policy is listed based on the root auth path specified:( dev/) instead of individually specifying each kubernetes host path and treating it as a separate auth method?