Add new role parameter to specify the k8s role ref type #49
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Overview
What is the change?
Role / ClusterRole
) of the role reference used in the finalRoleBinding / ClusterRoleBinding
Why is the change needed?
The reasons are explained in this issue hashicorp/vault/issues/25579
As a summary, if I want to use a k8s
ClusterRole
in thekubernetes_role_name
but the vault secrets role has the parameterkubernetes_role_type
set toRole
, then the finalRoleBinding
is using aRole
in the ref, therefore the binding is incorrectDesign of Change
How was this change implemented?
kubernetes_role_ref_type
with possible valuesRole
orClusterRole
kubernetes_role_type
kubernetes_role_name
is specified, theRoleRef
used in the binding take the new parameter (kubernetes_role_ref_type
) to populate the typeRelated Issues/Pull Requests
[x] hashicorp/vault Issue #25579
[x] hashicorp/vault-plugin-secrets-kubernetes Issue #48
Contributor Checklist
[x] Add relevant docs to upstream Vault repository, or sufficient reasoning why docs won’t be added yet
Vault Docs PR
[ ] Add output for any tests not ran in CI to the PR description (eg, acceptance tests)
[x] Backwards compatible