Support for external vault

[hashicorp]

Support for external vault

[Crazyigor1987]

Hi @monty16597 ,

we're currently testing with external access like you do. We're facing the problem, that the CSI Vault Provider is currently not able to support multiple k8s cluster, because it is missing the auth path option. #111

[tomhjp]

Hi both, thanks for raising the question. The way to do this is to create one Kubernetes auth mount in Vault per Kubernetes cluster. Each will be under a different path, and you can then set vaultKubernetesMountPath in the CRD to target a non-default Kubernetes auth mount path. For example, based on your CRD:

vault auth enable -path=my-k8s-cluster kubernetes

apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
kind: SecretProviderClass
metadata:
  name: vault-database
spec:
  provider: vault
  parameters:
    vaultAddress: "http://vault:8200"
    vaultKubernetesMountPath: "my-k8s-cluster"
    roleName: ""
    objects: |
      - objectName: ""
        secretPath: ""
        secretKey: ""