Vault: document the new field "serviceAccountRef" #1081

maelvls · 2022-09-30T12:11:37Z

Preview: https://deploy-preview-1081--cert-manager-website.netlify.app/docs/configuration/vault/#authenticating-with-a-kubernetes-service-account-without-a-secret

The feature itself is being developed in ~~cert-manager/cert-manager#4524~~ cert-manager/cert-manager#5502.

netlify · 2022-09-30T12:22:00Z

✅ Deploy Preview for cert-manager-website ready!

Name	Link
🔨 Latest commit	`32a3e8b`
🔍 Latest deploy log	https://app.netlify.com/sites/cert-manager-website/deploys/640704f952a90e0008e13c09
😎 Deploy Preview	https://deploy-preview-1081--cert-manager-website.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site settings.

content/docs/configuration/vault.md

wallrj

Nice start to the documentation for this feature, but please add some narrative and some links to Hashicorp Vault documentation explaining how this style of authentication works.

Shouldn't we also explain how to configure vault for this authentication (both for in-cluster vault and out-of-cluster vault installations) or is that explained elsewhere in this document?

Also please rebase this onto the release-next branch, adding a release note to go with it.

content/docs/configuration/vault.md

wallrj · 2023-02-10T12:23:12Z

content/docs/configuration/vault.md

+Using the field `serviceAccountRef` instead of `secretRef`, you can let
+cert-manager request ephemeral tokens.


I think you should elaborate more on what it means to "request ephemeral tokens".
For example: https://cert-manager.io/docs/configuration/acme/dns01/azuredns/#managed-identity-using-aad-workload-identity

I added a paragraph on "request ephemeral tokens". Hopefully it makes more sense now.

content/docs/configuration/vault.md

wallrj · 2023-02-10T12:30:09Z

content/docs/configuration/vault.md

+        mountPath: /v1/auth/kubernetes
+        serviceAccountRef:
+          name: vault-issuer
+```


Add a note about Issuer vs ClusterIssuer and how Issuer can only refer to a ServiceAccount in the same namespace while ClusterIssuer must refer to a ServiceAccount in the --cluster-scoped namespace.

Thanks. I added the following:

Issuer vs. ClusterIssuer: With an Issuer resource, you can only refer to a
service account located in the same namespace as the Issuer. With a
ClusterIssuer, the service account must be located in the namespace that is
configured by the flag --cluster-resource-namespace.

Signed-off-by: Maël Valais <mael@vls.dev>

maelvls · 2023-02-21T17:53:57Z

Shouldn't we also explain how to configure vault for this authentication (both for in-cluster vault and out-of-cluster vault installations)

The only documentation that exists in the page is the vault write auth... command that I added. It only focuses on in-cluster installations.

content/docs/configuration/vault.md

content/docs/contributing/release-process.md

Signed-off-by: Maël Valais <mael@vls.dev>

Co-authored-by: Richard Wall <wallrj@users.noreply.github.com> Signed-off-by: Maël Valais <mael@vls.dev>

maelvls · 2023-02-27T16:02:04Z

I addressed the comments and have added a paragraph to the release-notes-1.12.md page. Please take another look.

Signed-off-by: Maël Valais <mael@vls.dev>

wallrj · 2023-02-28T09:54:33Z

package.json

@@ -22,7 +22,7 @@
    "generate:sitemap": "next-sitemap",
    "export": "next export",
    "start": "next start",
-    "check": "concurrently --group --timings npm:check:* # Run all the npm check:* scripts in parallel",
+    "check": "npm exec concurrently -y -- --group --timings npm:check:* # Run all the npm check:* scripts in parallel",


What's the reason for this change?
All the npm installed executables are installed in .node_modules/.bin by npm ci and are in PATH when these npm run scripts are run, so why do you add the npm exec ... -y here?

If the documentation in https://github.com/cert-manager/website#website-development-tooling is wrong, we should fix that.

…ool" This reverts commit c399aae. I mistakenly forgot to run "npm i" before running ./scripts/verify. Signed-off-by: Maël Valais <mael@vls.dev>

wallrj

Thanks!

/lgtm

jetstack-bot · 2023-03-07T10:45:22Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: maelvls, wallrj

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [maelvls,wallrj]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

jetstack-bot added dco-signoff: yes Indicates that all commits in the pull request have the valid DCO sign-off message. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Sep 30, 2022

maelvls mentioned this pull request Sep 30, 2022

The Vault issuer can now be given a serviceAccountRef cert-manager/cert-manager#4524

Closed

3 tasks

maelvls marked this pull request as draft October 3, 2022 13:42

jetstack-bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 3, 2022

maelvls mentioned this pull request Oct 11, 2022

The vault issuer can now be given a serviceAccountRef instead of relying on static service account tokens cert-manager/cert-manager#5502

Merged

6 tasks

maelvls force-pushed the document-vault-bound-serviceaccount branch 2 times, most recently from f48cf84 to 072fbe5 Compare February 9, 2023 14:10

maelvls marked this pull request as ready for review February 9, 2023 14:17

jetstack-bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Feb 9, 2023

maelvls commented Feb 10, 2023

View reviewed changes

content/docs/configuration/vault.md Outdated Show resolved Hide resolved

wallrj requested changes Feb 10, 2023

View reviewed changes

maelvls changed the base branch from master to release-next February 20, 2023 17:39

vault: document the new field "serviceAccountRef"

1d838a8

Signed-off-by: Maël Valais <mael@vls.dev>

maelvls force-pushed the document-vault-bound-serviceaccount branch from f405ed8 to 56fd5f0 Compare February 21, 2023 11:36

maelvls force-pushed the document-vault-bound-serviceaccount branch from 9b482ae to c2748dd Compare February 21, 2023 17:48

wallrj requested changes Feb 22, 2023

View reviewed changes

maelvls mentioned this pull request Feb 27, 2023

release-process: explain how and when to merge master into release-next #1192

Merged

serviceAccountRef: address Richard's comments

ab117a7

Signed-off-by: Maël Valais <mael@vls.dev>

maelvls force-pushed the document-vault-bound-serviceaccount branch from c2748dd to ab117a7 Compare February 27, 2023 15:26

maelvls and others added 2 commits February 27, 2023 16:41

serviceAccoutRef: PR review suggestions

803891f

Co-authored-by: Richard Wall <wallrj@users.noreply.github.com> Signed-off-by: Maël Valais <mael@vls.dev>

serviceAccoutRef: PR review suggestions

46cdf9c

Co-authored-by: Richard Wall <wallrj@users.noreply.github.com> Signed-off-by: Maël Valais <mael@vls.dev>

maelvls added 2 commits February 27, 2023 17:13

serviceAccountRef: add a release-note page for v1.12

dcef301

Signed-off-by: Maël Valais <mael@vls.dev>

package.json: use "npm exec" for running the "concurrently" tool

c399aae

Signed-off-by: Maël Valais <mael@vls.dev>

maelvls force-pushed the document-vault-bound-serviceaccount branch from 5224b0e to c399aae Compare February 27, 2023 16:14

fix dead link

fe91700

Signed-off-by: Maël Valais <mael@vls.dev>

wallrj requested changes Feb 28, 2023

View reviewed changes

Revert "package.json: use "npm exec" for running the "concurrently" t…

32a3e8b

…ool" This reverts commit c399aae. I mistakenly forgot to run "npm i" before running ./scripts/verify. Signed-off-by: Maël Valais <mael@vls.dev>

wallrj approved these changes Mar 7, 2023

View reviewed changes

jetstack-bot assigned wallrj Mar 7, 2023

jetstack-bot added the lgtm Indicates that a PR is ready to be merged. label Mar 7, 2023

jetstack-bot merged commit d3c9fc6 into cert-manager:release-next Mar 7, 2023

jetstack-bot mentioned this pull request Mar 7, 2023

Document the ingressClassName field #1196

Merged

This was referenced May 23, 2023

[Post-Release] Merge release-next into master #1230

Closed

[Release 1.12] Merge release-next into master #1231

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Vault: document the new field "serviceAccountRef" #1081

Vault: document the new field "serviceAccountRef" #1081

maelvls commented Sep 30, 2022 •

edited

Loading

netlify bot commented Sep 30, 2022 •

edited

Loading

wallrj left a comment

wallrj Feb 10, 2023

maelvls Feb 21, 2023

wallrj Feb 10, 2023

maelvls Feb 21, 2023

maelvls commented Feb 21, 2023 •

edited

Loading

maelvls commented Feb 27, 2023

wallrj Feb 28, 2023

wallrj Feb 28, 2023

wallrj left a comment

jetstack-bot commented Mar 7, 2023

		Using the field `serviceAccountRef` instead of `secretRef`, you can let
		cert-manager request ephemeral tokens.

Vault: document the new field "serviceAccountRef" #1081

Vault: document the new field "serviceAccountRef" #1081

Conversation

maelvls commented Sep 30, 2022 • edited Loading

netlify bot commented Sep 30, 2022 • edited Loading

✅ Deploy Preview for cert-manager-website ready!

wallrj left a comment

Choose a reason for hiding this comment

wallrj Feb 10, 2023

Choose a reason for hiding this comment

maelvls Feb 21, 2023

Choose a reason for hiding this comment

wallrj Feb 10, 2023

Choose a reason for hiding this comment

maelvls Feb 21, 2023

Choose a reason for hiding this comment

maelvls commented Feb 21, 2023 • edited Loading

maelvls commented Feb 27, 2023

wallrj Feb 28, 2023

Choose a reason for hiding this comment

wallrj Feb 28, 2023

Choose a reason for hiding this comment

wallrj left a comment

Choose a reason for hiding this comment

jetstack-bot commented Mar 7, 2023

maelvls commented Sep 30, 2022 •

edited

Loading

netlify bot commented Sep 30, 2022 •

edited

Loading

maelvls commented Feb 21, 2023 •

edited

Loading