-
Notifications
You must be signed in to change notification settings - Fork 875
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
No direct method to mount the Vault CA inside init/sidecar #518
Comments
Any updated to this? A year later with noone else reporting the issue seems odd to me. I'm also hitting this problem, how are people working around this? |
Hi, Best Regards, |
Hi, |
This is a bizarre hole in the helm chart... presumably many people run vault within (secure) internal networks, w/internal CAs, so it's surprising there's no option to tell the k8s vault agent what the CA bundle is. |
Same here, it is 2024 and still the same problem. |
Describe the bug
I've created an HA Vault with a cert signed by the Kube Root CA with the Helm chart. When I annotate a deployment, I get the following error from the init container:
There are some related issues about external Vaults, but this also affect the sidecar for an in-cluster Vault.
To Reproduce
Steps to reproduce the behavior:
Related to #243 #339
I think this would be addressed in either of these examples:
Expected behavior
The injector would provide a way to mount the CA cert of the Vault server CA as a trusted CA in the init container. There is no support for extraVolumes or volumes. There is at best
vault.hashicorp.com/agent-copy-volume-mounts
as an annotation, but that now also means you have to mount a volume in a workload container and the value of the injector is the container can be unaware of Vault.Environment
Chart values:
Additional context
Add any other context about the problem here.
The text was updated successfully, but these errors were encountered: