use deployment service account token for HashiCorpVault triggerAuthentication

[nfrappart]

Hi,
I've been playing with keda on AKS, with external vault cluster, and had a hard time with the HashiCorp vault authentication.
I thought /var/run/secrets/kubernetes.io/serviceaccount/token would refer to the auto mounted token in deployment pods, but it appears it uses keda-operator service account token instead.
As a result, I had to create a separate role with policy on vault (as I don't want keda to have unnecessary authorisations).

Do you think it would be possible (does it make sense ?) to specify a containerName for the hashiCorpVault spec in the TriggerAuthentication? Just like we can retrieve a environment variable?
Below is my configuration to make it clearer

apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
metadata:
  name: devopsagent-trigger-auth
  namespace: devopsagent
spec:
  env:
  - parameter: organizationURL
    name: "AZP_URL"
    containerName: devopsagent    
  hashiCorpVault:
    address: https://vault.mydomain.extension:8200
    authentication: kubernetes
    role: keda
    mount: hubk8s
    credential:
      serviceAccount: /var/run/secrets/kubernetes.io/serviceaccount/token
    secrets:
    - parameter: personalAccessToken
      key: pat
      path: secret/data/devops

Just like we get the env from the specified container here:

  env:
  - parameter: organizationURL
    name: "AZP_URL"
    containerName: devopsagent    

could we do the same like so ?
So that the trigger authentication know where to get the token with the provided path.

    address: https://vault.mydomain.extension:8200
    authentication: kubernetes
    role: devopsagent
    mount: hubk8s
    credential:
      serviceAccount: /var/run/secrets/kubernetes.io/serviceaccount/token
      containerName: devopsagent
    secrets:
    - parameter: personalAccessToken
      key: pat
      path: secret/data/devops

Or maybe replace the serviceAccount path by a serviceAccountName altogether making it even more straightforward?

What do you think?

Thanks

PS: keda is awesome btw :)

[Adriks976]

hello @nfrappart did you figure how to make it work? I try to use my app role for vault to authenticate but still got a permission denied. I don't know if it's possible or we have to create a specific keda role.

[nfrappart]

hey sorry @Adriks976
I saw your mail while I was away and didn't find the time to answer you before. So in the end I just used keda service account token. That was a PoC to use ephemeral Devops Agents in pods instead of VMs so it was not worth taking too much time on it.

One question, why do you use app role authentication when you can leverage kubernetes auth? That's what I used. And so yes, I created a keda role for this auth method to specify what permissions Keda has on my secret engines.