-
Notifications
You must be signed in to change notification settings - Fork 63
Description
as a operator when managing hundreds of kubernetes auth with each kubernetes cluster as a distinct auth, managing these authentication configs becomes quite a tedious job. Currently to do multiple kube auth to one vault server with path seperation we do this (correct me if im wrong):
vault auth-enable --path="/dev/kube-cluster-A" kubernetes
vault auth-enable --path="/dev/kube-cluster-B" kubernetes
vault write auth/dev/kube-cluster-A/config kubernetes_host=HOSTA:8443 ....
vault write auth/dev/kube-cluster-B/config kubernetes_host=HOSTB:8443 ...
and we will get two seperate auth paths when doing a vault auth list
if we were want to further granulize the path and namespace of each kubernetes auth, we need to do something like this
vault auth-enable --path="/dev/kube-cluster-A/default" kubernetes
vault auth-enable --path="/dev/kube-cluster-A/test" kubernetes
Is it possible to utilize what secrets engine have, where we do a auth enable to path dev/
and then no need to separately enable the auth path, and can directly write configs to the kubernetes host, and that all associated policy is listed based on the root auth path specified:( dev/
) instead of individually specifying each kubernetes host path and treating it as a separate auth method?