-
-
Notifications
You must be signed in to change notification settings - Fork 1.2k
Hashicorp Vault provider: support GCP authentication method #5325
Description
Is your feature request related to a problem? Please describe.
No
Describe the solution you'd like
Based on the documentation for the provider, it does not appear to support GCP authentication to Vault, using workload identity/a GCP service account. This would greatly help streamline setup when ESO and Vault are both running in GKE clusters.
We had no problem getting it working using the Kubernetes auth method, when ESO and Vault were running in the same GKE cluster, but once we deploy ESO in other clusters, or when an HA configured Vault cluster fails over to another cluster, Kubernetes authentication fails because Vault cannot reach the api-server of remote clusters attempting to authenticate to validate their JWT tokens.
Describe alternatives you've considered
We're currently getting around this by using the Vault agent injector, to inject a vault agent sidecar in all ESO pods, and configure it as a proxy with GCP auth, using use_auto_auth_token = force to override a dummy token passed by the secret store. We can then point secret stores using Vault at http://127.0.0.1:8200 instead of the Vault server itself to handle authentication.
Additional context
N/A
Metadata
Metadata
Assignees
Labels
Type
Projects
Status