Vault: document serviceAccountRef with an external Vault #1455
Conversation
jetstack-bot
added
dco-signoff: yes
✅ Deploy Preview for cert-manager-website ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
There was a problem hiding this comment.
Nice this looks good, probably means we can close this and not confuse most cert-manager users!
| mountPath: /v1/auth/kubernetes | ||
| serviceAccountRef: | ||
| name: vault-issuer | ||
| audiences: [https://kubernetes.default.svc.cluster.local] |
There was a problem hiding this comment.
Shouldn't the audiences also include something like vault to tighten the integration?
There was a problem hiding this comment.
The default "computed" audience (e.g., vault://namespace/issuer-name) is still added to the audiences by default, so I'd say it would be redundant to add vault there? Of course, that's only useful if folks are also using audience in their vault role, otherwise the audience isn't checked by vault.
There was a problem hiding this comment.
Ah yeah, perhaps I would add a sentence to say that the default behavior will also include vault://namespace/issuer-name which you can use in the vault role if one wishes (and that it works by default).
jetstack-bot
added
size/XL
I made sure to explain that the vault:// audience is still there. Signed-off-by: Maël Valais <mael@vls.dev>
maelvls
force-pushed
the
docs-external-vault
branch
from
d57a68e to
8de9069
Compare
jetstack-bot
added
size/M
maelvls
added
the
approved
| <a name="static-service-account-token"></a> | ||
|
|
||
| #### Secretless Authentication with a Service Account (External Vault) | ||
|
|
There was a problem hiding this comment.
@maelvls I just realized we need to add a little footnote to say this feature is available starting cert-manager 1.15 (just like it says for the above paragraph line 366
|
/hold I need to add a mention that the external Vault with service account ref requires 1.15 |
jetstack-bot
added
the
do-not-merge/hold
Signed-off-by: Maël Valais <mael@vls.dev>
|
/unhold Done! |
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: SpectralHiss The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/lgtm |
maelvls
removed
the
do-not-merge/hold
cert-manager-prow
bot
merged commit b9aa1e9
into
cert-manager:release-next
We forgot to document this feature after cert-manager/cert-manager#6666 was merged.