Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

document Vault authentication via cross-namespace service accounts #1521

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

document Vault authentication via cross-namespace service accounts #1521

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4119927
document Vault authentication via cross-namespace service accounts
BojanZelic Jan 10, 2025
2fd3b69
document Vault authentication via cross-namespace service accounts
BojanZelic Jan 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions content/docs/2.17/authentication-providers/hashicorp-vault.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ title = "Hashicorp Vault secret"


You can pull one or more Hashicorp Vault secrets into the trigger by defining the authentication metadata such as Vault `address` and the `authentication` method (token | kubernetes). If you choose kubernetes auth method you should provide `role` and `mount` as well.
`credential` defines the Hashicorp Vault credentials depending on the authentication method, for kubernetes you should provide path to service account token (/var/run/secrets/kubernetes.io/serviceaccount/token) and for token auth method provide the token.
`credential` defines the Hashicorp Vault credentials depending on the authentication method. There's multiple methods for authentication; For kubernetes you should provide path to service account token (/var/run/secrets/kubernetes.io/serviceaccount/token) or provide the serviceAccountName that can authenticate to kubernetes in the namespace of the ScaledObject/ScaledJob resource (usually `default`). If using serviceAccountName make sure to grant Keda Operator `create serviceaccounts/token` permissions. This is set in the helm chart via `permissions.operator.restrict.saTokens=true` For token auth method provide the token.
`secrets` list defines the mapping between the path and the key of the secret in Vault to the parameter.
`namespace` may be used to target a given Vault Enterprise namespace.

Expand All @@ -19,8 +19,9 @@ hashiCorpVault: # Optional.
role: {hashicorp-vault-role} # Optional.
mount: {hashicorp-vault-mount} # Optional.
credential: # Optional.
token: {hashicorp-vault-token} # Optional.
serviceAccount: {path-to-service-account-file} # Optional.
token: {hashicorp-vault-token} # Optional. Authenticate to vault via a supplied token
serviceAccount: {path-to-service-account-file} # Optional. Authenticate to vault via JWT token in keda operator pod
serviceAccountName: {service-account-name-for-auth} # Optional. Requires serviceaccounts/token create permissions. Authenticate to vault via JWT token from service account in ScaledObject/ScaledJob's namespace
secrets: # Required.
- parameter: {scaledObject-parameter-name} # Required.
key: {hashicorp-vault-secret-key-name} # Required.
Expand Down
Loading