Dynamic vault policies per instance

[simonswine]

Is this a BUG REPORT or FEATURE REQUEST?:

Uncomment only one, leave it on its own line:

/kind bug
/kind feature

What happened:

Currently every instance of a role has exactly the same permissions in vault. That means every node can request any node name / ip address

What you expected to happen:

Instance should only get their real IP addresses/node names certified

I think we need a vault-controller, that is watching AWS for instance creation and the we can have custom policies per instance. The instance auth should be done using the now existing ec2 auth.

Dynamic policy in vault is sadly enterprise only 💵💵💵💵