specify vault auth ServiceAccount name

Author: rafaeltuelho

ansible-automation/playbooks/vault-setup/files/vault-cluster-role-binding-role-token-review.yml

@@ -1,13 +1,13 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: role-tokenreview-binding
+  name: vault-role-token-review
   namespace: vault-admin
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: system:auth-delegator
 subjects:
 - kind: ServiceAccount
-  name: vault-auth
+  name: default
   namespace: vault-admin

ansible-automation/playbooks/vault-setup/files/vault-git-secret-engine-mount.yml

@@ -32,9 +32,9 @@
     state: present
     definition: "{{ lookup('file', item) | from_yaml }}"
   loop:
-    - vault-auth-service-account.yml
+    #- vault-auth-service-account.yml
     - vault-cluster-role-binding-role-token-review.yml
-    - vault-auth-secret.yml
+    #- vault-auth-secret.yml
 
 - name: Create vault-admin policy
   ansible.builtin.shell: |
@@ -49,7 +49,7 @@
 - name: Enable kubernetes auth for the Dev Cluster
   ansible.builtin.shell: |
     export SA_SECRET_NAME=$(oc get secrets -n vault-admin --output=json \
-    | jq -r '.items[].metadata | select(.name|startswith("vault-auth-token")).name')
+    | jq -r '.items[].metadata | select(.name|startswith("default-token")).name')
     export SA_JWT_TOKEN=$(oc get secret $SA_SECRET_NAME -n vault-admin \
     --output 'go-template={{ "{{" }} .data.token {{ "}}" }}' | base64 --decode)
     export SA_CA_CRT=$(oc config view --raw --minify --flatten \
@@ -67,21 +67,21 @@
     kubernetes_ca_cert="$SA_CA_CRT" \
     issuer="https://kubernetes.default.svc.cluster.local"
 
-- name: Create role and service account authentication
+- name: Create vault-admin Role for Kubernetes authentication
   ansible.builtin.shell: |
     oc exec vault-0 -c vault -n {{ vault_namespace
       }} -- vault write -address https://vault.vault.svc:8200 auth/{{ vault_cluster_name }}-admin/role/vault-admin \
-    bound_service_account_names=vault-auth \
+    bound_service_account_names=default \
     bound_service_account_namespaces=vault-admin \
     token_policies=vault-admin \
     ttl=160h
 
     export SA_SECRET_NAME=$(oc get secrets -n vault-admin --output=json \
-    | jq -r '.items[].metadata | select(.name|startswith("vault-auth-token")).name')
+    | jq -r '.items[].metadata | select(.name|startswith("default-token")).name')
     export SA_JWT_TOKEN=$(oc get secret $SA_SECRET_NAME -n vault-admin \
     --output 'go-template={{ "{{" }} .data.token {{ "}}" }}' | base64 --decode)
 
-    #try to login into Vault using the Kubernetes auth endpoint and the vault-auth Service Account...
+    #try to login into Vault using the Kubernetes auth endpoint and the default Service Account...
     oc exec vault-0 -c vault -n vault -- \
     vault write -address https://vault.vault.svc:8200 auth/{{ vault_cluster_name }}-admin/login role=vault-admin jwt=$SA_JWT_TOKEN
 

ansible-automation/playbooks/vault-setup/files/vault-kv-secret-engine-mount.yml

@@ -6,7 +6,9 @@ metadata:
 spec:
   authentication: 
     path: kubernetes
-    role: policy-admin  
+    role: policy-admin
+    serviceAccount:
+      name: default
   passwordPolicy: |
       length = 8
       rule "charset" {

ansible-automation/playbooks/vault-setup/files/vault-quay-secret-engine-mount.yml

@@ -7,6 +7,8 @@ spec:
   authentication: 
     path: kubernetes
     role: policy-admin
+    serviceAccount:
+      name: default
   sSHKeyReference:
     vaultSecret:
       path: "kv/secrets/{{ idp_instance_name }}/github-plugin"

ansible-automation/playbooks/vault-setup/setup_vault.yml

@@ -7,6 +7,8 @@ spec:
   authentication: 
     path: kubernetes
     role: policy-admin
+    serviceAccount:
+      name: default
   path: github
   organizationName: {{ github_org }}
   repositories: []

ansible-automation/playbooks/vault-setup/templates/vault-git-webhook-password-policy.yml.j2

@@ -7,6 +7,8 @@ spec:
   authentication: 
     path: kubernetes
     role: policy-admin
+    serviceAccount:
+      name: default
   disableSslVerification: true
   rootCredentials:
     vaultSecret:

ansible-automation/playbooks/vault-setup/templates/vault-github-secret-engine-config.yml.j2

@@ -7,6 +7,8 @@ spec:
   authentication: 
     path: kubernetes
     role: policy-admin
+    serviceAccount:
+      name: default
   path: quay
   namespaceName: {{ quay_org }}
   createRepositories: true