Skip to content

Hashicorp Vault provider: support GCP authentication method #5325

@bkonicek-calm

Description

@bkonicek-calm

Is your feature request related to a problem? Please describe.
No

Describe the solution you'd like
Based on the documentation for the provider, it does not appear to support GCP authentication to Vault, using workload identity/a GCP service account. This would greatly help streamline setup when ESO and Vault are both running in GKE clusters.

We had no problem getting it working using the Kubernetes auth method, when ESO and Vault were running in the same GKE cluster, but once we deploy ESO in other clusters, or when an HA configured Vault cluster fails over to another cluster, Kubernetes authentication fails because Vault cannot reach the api-server of remote clusters attempting to authenticate to validate their JWT tokens.

Describe alternatives you've considered
We're currently getting around this by using the Vault agent injector, to inject a vault agent sidecar in all ESO pods, and configure it as a proxy with GCP auth, using use_auto_auth_token = force to override a dummy token passed by the secret store. We can then point secret stores using Vault at http://127.0.0.1:8200 instead of the Vault server itself to handle authentication.

Additional context
N/A

Metadata

Metadata

Assignees

No one assigned

    Labels

    good first issueGood for newcomerskind/featureCategorizes issue or PR as related to a new feature.track/providerscapture issues related to providers

    Type

    No type

    Projects

    Status

    Done

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions