KEDA Hashicorp vault service account token request #6446
Conversation
Signed-off-by: Bojan Zelic <[email protected]>
…ce-account-token-request
Signed-off-by: Bojan Zelic <[email protected]>
![semgrep-app[bot]](https://avatars.githubusercontent.com/in/60555?s=60&v=4){kind=small}
| }, | ||
| } | ||
|
|
||
| if err := vh.k8sClient.SubResource("token").Create(context.TODO(), sa, tokenRequest); err != nil { |
There was a problem hiding this comment.
Signed-off-by: Bojan Zelic <[email protected]>
Signed-off-by: Bojan Zelic <[email protected]>
|
Could you also add some e2e tests? |
| if err = vh.k8sClient.Get(context.Background(), saName, sa); err != nil { | ||
| if apierrors.IsNotFound(err) { | ||
| return token, errors.New(fmt.Sprintf("Failed to retreive service account name: %s namespace: %s", saName.Name, saName.Namespace)) | ||
| } |
There was a problem hiding this comment.
Here should return other errs as well.
| if err = vh.k8sClient.Get(context.Background(), secretName, secret); err != nil { | ||
| if apierrors.IsNotFound(err) { | ||
| return token, errors.New(fmt.Sprintf("Failed to retreive secret for service account name: %s namespace: %s", secretName.Name, secretName.Namespace)) | ||
| } |
There was a problem hiding this comment.
Here should return other errs as well.
BojanZelic
force-pushed
the
keda-vault-service-account-token-request
branch
from
a8b484a to
a5afafe
Compare
Signed-off-by: Bojan Zelic <[email protected]>
BojanZelic
force-pushed
the
keda-vault-service-account-token-request
branch
from
a5afafe to
bfa2613
Compare
|
@SpiritZhou I fixed the PR from your comments and updated the helmchart & documentation 🙏 please take a look whenever you get a chance. |
|
/run-e2e hashicorp |
zroubalik
changed the title
| if err != nil { | ||
| return token, err | ||
| if vh.vault.Credential.ServiceAccountName != "" { | ||
| // generate token from namespace |
There was a problem hiding this comment.
I think that this code is quite related with this other PR adding the same support in other part. Maybe we should merge one of them and rebase the other, unifying the code. @wozniakjan @zroubalik ?
There was a problem hiding this comment.
I'm assuming this is the PR you guys are talking about? #6272 - it's somewhat different usage from what I see; This PR exposes service account JWT to scalers, vs my PR exposes service account JWT to hashicorp vault.
Is the ask here to make it compatible with that API? Just thinking what would be a good way to expose this to users.
ex... instead of:
apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
spec:
hashiCorpVault:
address: {hashicorp-vault-address}
credential:
serviceAccountName: default
do something like:
apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
spec:
boundServiceAccountToken:
- serviceAccountName: default
parameter: null
credential:
useBoundServiceAccountToken: true
Allows users to authenticate to vault via a service account in the scaledObject's namespace;
ex:
would use the JWT token from the
defaultservice account in themynamespacenamespaceThis allows users to set more fine-grained permissions in vault.
Checklist
Fixes # #6153
Relates to #