Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

auto_join with k8s as provider can auto apply to current namespace #847

Open
hixichen opened this issue Feb 17, 2023 · 1 comment
Open
Labels
enhancement New feature or request

Comments

@hixichen
Copy link

Is your feature request related to a problem? Please describe.

Ideally, we expect use helm chart with model:

helm install ./vault-helm --namespace MY_NS

everytime, when we switch namespaces, expect MY_NS as only parameter we need to modify.

However, if set auto_join with k8s as provider, the config is like:

      storage "raft" {
          path = "/vault/data"
          retry_join {
            auto_join = "provider=k8s label_selector=\"app.kubernetes.io/name=vault,component=server\" namespace=\"MY_NS\" "
            auto_join_port = 8200
            leader_tls_servername = "vault"
            auto_join_scheme = "https"
            leader_ca_cert_file = "/vault/cert/vault.ca"
            leader_client_key_file = "/vault/cert/vault.key"
            leader_client_cert_file = "/vault/cert/vault.crt"
          }
        }

We have to manually define the namespace here if we expect Vault only discover PODs within same namespace.

the root cause is that go-discover need explicitly argus input.
https://github.com/hashicorp/go-discover/blob/master/provider/k8s/k8s_discover.go#L103

Describe the solution you'd like

Maybe something like:

let k8s_discover.go accept environment variable.

helm chart feeds .Release.Namespace to this environment variable with configuration flag.

Eg:
below this line:https://github.com/hashicorp/vault-helm/blob/main/values.yaml#L788

      # Set the setDiscoverNamespace to current deploy namespace
      setDiscoverNamespace: true

Describe alternatives you've considered
N/A

Additional context
N/A

@hixichen hixichen added the enhancement New feature or request label Feb 17, 2023
@hixichen hixichen changed the title auto_join with k8s as provider can auto applied namespace auto_join with k8s as provider can auto apply to current namespace Feb 17, 2023
@w33dw0r7d
Copy link

You can use .Release.Namespace inside config.
This line is work:

 auto_join = "provider=k8s label_selector=\"app.kubernetes.io/name=vault,component=server\" namespace=\"{{ .Release.Namespace }}\""

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants