Vault secretstore: AWS IAM (IRSA) authentication

[itscontained]

Vault secretstore: AWS IAM (IRSA) authentication

[mcavoyk]

Just to clarify this is for vault secret backend but with AWS authentication?

If so that is for something we are interested in. In terms of IRSA, we should be able to support either a secretSelector or serviceAcccountSelector, or using the serviceAccount of the controller pod.

In terms of implementation looks like there is an example in vault cli and API docs

[sbaier1]

Just to clarify this is for vault secret backend but with AWS authentication?

yes, exactly. Judging from the CRD specification, SecretsManager + IRSA should be supported already, right? haven't gotten around to testing it with this operator yet (only used the "original" node.js based secrets manager before)

i have also looked at the vault agent/CLI code and api docs but unfortunately i'm not that proficient at Go yet so i haven't really tried implementing it myself so far.

(did figure out it cannot really work with the current auth mechanisms as far as i can tell)