No examples for Oracle Cloud Vault integration with Workload Identity #3521
Description
Describe the bug
I am trying to implement it in my OKE using workload identity but the Oracle Vault provider documentation ( see Oracle Vault) haven't really been updated to reflect that Principal use case.
I only see the user principal steps but not those for Workload Identity.
- Can we have that updated to reflect that case too? I could help if needed and once I understand the right syntax in the manifest?
Thank you !
To Reproduce
Steps to reproduce the behavior:
- So far I only see the below without serviceAccountRef:
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
name: example-workload-identity
spec:
provider:
oracle:
vault: # The vault OCID
region: # The vault region
principalType: Workload
Expected behavior
- Do you confirm that the right WI definition should rather be as below ?
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
name: example-workload-identity
spec:
provider:
oracle:
vault: # The vault OCID
region: # The vault region
principalType: Workload
auth:
# jwt:
serviceAccountRef:
name: my-serviceaccount
Additional context
I know @anders-swanson worked to implement this part in #2771 (Fixed by #2781 and #2817) but the documentation could be improved. Here's what we could add for the policy part (see oci doc
Allow any-user to use keys and secret-family in compartment finance where all {
request.principal.type = 'workload',
request.principal.namespace = 'finance',
request.principal.service_account = 'financeserviceaccount',
request.principal.cluster_id = 'ocid1.cluster.oc1.iad.aaaaaaaaaf______jrd',
request.resource.vault.id = 'ocid1.vault.oc1.iad.aaaaaaaaaf______jrd'
}