Skip to content

Commit 978e140

Browse files
chris-rockclaude
chris-rock
and
claude
committed
feat: replace VaultAuth init container with operator-side vault-client-go
Instead of running a hashicorp/vault init container with shell scripts, the operator now fetches credentials from Vault during reconciliation using vault-client-go and writes a kubeconfig Secret that the CronJob mounts directly. This removes the need for the Vault image, init containers, and a separate ServiceAccount for Vault auth. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 6048aab commit 978e140

File tree

13 files changed

+919
-9
lines changed

13 files changed

+919
-9
lines changed

‎api/v1alpha2/mondooauditconfig_types.go‎

Lines changed: 59 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -169,10 +169,17 @@ type ExternalCluster struct {
169169
WorkloadIdentity *WorkloadIdentityConfig `json:"workloadIdentity,omitempty"`
170170

171171
// SPIFFEAuth configures SPIFFE/SPIRE-based authentication using X.509 SVIDs.
172-
// Mutually exclusive with KubeconfigSecretRef, ServiceAccountAuth, and WorkloadIdentity.
172+
// Mutually exclusive with KubeconfigSecretRef, ServiceAccountAuth, WorkloadIdentity, and VaultAuth.
173173
// +optional
174174
SPIFFEAuth *SPIFFEAuthConfig `json:"spiffeAuth,omitempty"`
175175

176+
// VaultAuth configures HashiCorp Vault Kubernetes secrets engine for dynamic credential generation.
177+
// The operator authenticates to Vault during reconciliation using its own service account token,
178+
// fetches short-lived credentials, and writes a kubeconfig Secret that the CronJob mounts.
179+
// Mutually exclusive with KubeconfigSecretRef, ServiceAccountAuth, WorkloadIdentity, and SPIFFEAuth.
180+
// +optional
181+
VaultAuth *VaultAuthConfig `json:"vaultAuth,omitempty"`
182+
176183
// Schedule overrides the default schedule for this cluster (optional).
177184
// If not specified, uses the schedule from KubernetesResources.Schedule.
178185
// +optional
@@ -329,6 +336,57 @@ type SPIFFEAuthConfig struct {
329336
Audience string `json:"audience,omitempty"`
330337
}
331338

339+
// VaultAuthConfig configures HashiCorp Vault's Kubernetes secrets engine
340+
// for dynamically generating short-lived service account tokens to scan external clusters.
341+
type VaultAuthConfig struct {
342+
// Server is the URL of the target Kubernetes API server.
343+
// Example: "https://target-cluster.example.com:6443"
344+
// +kubebuilder:validation:Required
345+
// +kubebuilder:validation:Pattern=`^https://.*`
346+
Server string `json:"server"`
347+
348+
// VaultAddr is the address of the Vault server.
349+
// Example: "https://vault.example.com:8200"
350+
// +kubebuilder:validation:Required
351+
VaultAddr string `json:"vaultAddr"`
352+
353+
// AuthPath is the Vault Kubernetes auth method mount path.
354+
// +optional
355+
// +kubebuilder:default="auth/kubernetes"
356+
AuthPath string `json:"authPath,omitempty"`
357+
358+
// AuthRole is the Vault role for authenticating the pod's service account.
359+
// +kubebuilder:validation:Required
360+
AuthRole string `json:"authRole"`
361+
362+
// SecretsPath is the Vault Kubernetes secrets engine mount path.
363+
// +optional
364+
// +kubebuilder:default="kubernetes"
365+
SecretsPath string `json:"secretsPath,omitempty"`
366+
367+
// CredsRole is the Vault role for generating target cluster credentials.
368+
// +kubebuilder:validation:Required
369+
CredsRole string `json:"credsRole"`
370+
371+
// KubernetesNamespace is the target namespace for the generated service account token.
372+
// +optional
373+
KubernetesNamespace string `json:"kubernetesNamespace,omitempty"`
374+
375+
// TTL is the requested TTL for the generated credentials (e.g. "1h", "30m").
376+
// +optional
377+
TTL string `json:"ttl,omitempty"`
378+
379+
// CACertSecretRef references a Secret containing Vault's CA certificate
380+
// for TLS verification. The Secret must have a key "ca.crt".
381+
// +optional
382+
CACertSecretRef *corev1.LocalObjectReference `json:"caCertSecretRef,omitempty"`
383+
384+
// TargetCACertSecretRef references a Secret containing the target cluster's
385+
// CA certificate for TLS verification. The Secret must have a key "ca.crt".
386+
// +optional
387+
TargetCACertSecretRef *corev1.LocalObjectReference `json:"targetCACertSecretRef,omitempty"`
388+
}
389+
332390
// NodeScanStyle specifies the scan style for nodes
333391
type NodeScanStyle string
334392

‎api/v1alpha2/zz_generated.deepcopy.go‎

Lines changed: 30 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/k8s.mondoo.com_mondooauditconfigs.yaml‎

Lines changed: 83 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -473,7 +473,7 @@ spec:
473473
spiffeAuth:
474474
description: |-
475475
SPIFFEAuth configures SPIFFE/SPIRE-based authentication using X.509 SVIDs.
476-
Mutually exclusive with KubeconfigSecretRef, ServiceAccountAuth, and WorkloadIdentity.
476+
Mutually exclusive with KubeconfigSecretRef, ServiceAccountAuth, WorkloadIdentity, and VaultAuth.
477477
properties:
478478
audience:
479479
description: |-
@@ -512,6 +512,88 @@ spec:
512512
- server
513513
- trustBundleSecretRef
514514
type: object
515+
vaultAuth:
516+
description: |-
517+
VaultAuth configures HashiCorp Vault Kubernetes secrets engine for dynamic credential generation.
518+
The operator authenticates to Vault during reconciliation using its own service account token,
519+
fetches short-lived credentials, and writes a kubeconfig Secret that the CronJob mounts.
520+
Mutually exclusive with KubeconfigSecretRef, ServiceAccountAuth, WorkloadIdentity, and SPIFFEAuth.
521+
properties:
522+
authPath:
523+
default: auth/kubernetes
524+
description: AuthPath is the Vault Kubernetes auth method
525+
mount path.
526+
type: string
527+
authRole:
528+
description: AuthRole is the Vault role for authenticating
529+
the pod's service account.
530+
type: string
531+
caCertSecretRef:
532+
description: |-
533+
CACertSecretRef references a Secret containing Vault's CA certificate
534+
for TLS verification. The Secret must have a key "ca.crt".
535+
properties:
536+
name:
537+
default: ""
538+
description: |-
539+
Name of the referent.
540+
This field is effectively required, but due to backwards compatibility is
541+
allowed to be empty. Instances of this type with an empty value here are
542+
almost certainly wrong.
543+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
544+
type: string
545+
type: object
546+
x-kubernetes-map-type: atomic
547+
credsRole:
548+
description: CredsRole is the Vault role for generating
549+
target cluster credentials.
550+
type: string
551+
kubernetesNamespace:
552+
description: KubernetesNamespace is the target namespace
553+
for the generated service account token.
554+
type: string
555+
secretsPath:
556+
default: kubernetes
557+
description: SecretsPath is the Vault Kubernetes secrets
558+
engine mount path.
559+
type: string
560+
server:
561+
description: |-
562+
Server is the URL of the target Kubernetes API server.
563+
Example: "https://target-cluster.example.com:6443"
564+
pattern: ^https://.*
565+
type: string
566+
targetCACertSecretRef:
567+
description: |-
568+
TargetCACertSecretRef references a Secret containing the target cluster's
569+
CA certificate for TLS verification. The Secret must have a key "ca.crt".
570+
properties:
571+
name:
572+
default: ""
573+
description: |-
574+
Name of the referent.
575+
This field is effectively required, but due to backwards compatibility is
576+
allowed to be empty. Instances of this type with an empty value here are
577+
almost certainly wrong.
578+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
579+
type: string
580+
type: object
581+
x-kubernetes-map-type: atomic
582+
ttl:
583+
description: TTL is the requested TTL for the generated
584+
credentials (e.g. "1h", "30m").
585+
type: string
586+
vaultAddr:
587+
description: |-
588+
VaultAddr is the address of the Vault server.
589+
Example: "https://vault.example.com:8200"
590+
type: string
591+
required:
592+
- authRole
593+
- credsRole
594+
- server
595+
- vaultAddr
596+
type: object
515597
workloadIdentity:
516598
description: |-
517599
WorkloadIdentity configures cloud-native Workload Identity Federation authentication.

‎config/rbac/role.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ rules:
3535
- create
3636
- delete
3737
- get
38+
- update
3839
- apiGroups:
3940
- ""
4041
resources:

0 commit comments

Comments
 (0)