[I] [Feature Request]: Support Kubernetes authentication for HashiCorp Vault variable resolver (hop)

["monwolf (via GitHub)" <gi...@apache.org>]

monwolf opened a new issue, #8302:
URL: https://github.com/apache/hop/issues/8302

   ### What would you like to happen?
   
   ### Problem
   
   Apache Hop's HashiCorp Vault variable resolver currently supports authentication using long-lived Vault tokens.
   
   While this works, using long-lived tokens is not ideal in Kubernetes environments, where workloads can authenticate using short-lived, automatically managed credentials.
   
   We are currently implementing the HashiCorp Vault variable resolver in a Kubernetes-based environment, and would like to avoid having to provision and manage long-lived Vault tokens for Hop.
   
   ### Proposed solution
   
   Add support for the Kubernetes authentication method to the HashiCorp Vault variable resolver.
   
   The resolver should be able to authenticate against Vault using a Kubernetes ServiceAccount token, allowing Vault to validate the workload identity through its Kubernetes authentication backend.
   
   The expected flow would be roughly:
   
   - Apache Hop is running inside a Kubernetes pod.
   - The pod has a Kubernetes ServiceAccount assigned to it.
   - Hop reads the ServiceAccount JWT/token available inside the pod.
   - Hop authenticates against Vault using the Kubernetes auth method.
   - Vault returns a short-lived Vault token.
   - The resolver uses that token to retrieve the requested secrets.
   - The Vault token can be renewed or re-authenticated as appropriate, without requiring a long-lived token to be configured in Hop.
   - 
   ### Motivation
   
   Using Kubernetes authentication would provide several advantages:
   
   - Avoids storing long-lived Vault tokens in Hop configuration.
   - Uses short-lived credentials managed by Kubernetes.
   - Better aligns with Vault's recommended authentication mechanisms for workloads running in Kubernetes.
   - Reduces the risk associated with leaked or compromised long-lived Vault tokens.
   - Makes the HashiCorp Vault variable resolver easier to deploy in cloud-native environments.
   
   ### Issue Priority
   
   Priority: 2
   
   ### Issue Component
   
   Component: Hop Server


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@hop.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Feature Request]: Support Kubernetes authentication for HashiCorp Vault variable resolver (hop)

["mattcasters (via GitHub)" <gi...@apache.org>]

mattcasters closed issue #8302: [Feature Request]: Support Kubernetes authentication for HashiCorp Vault variable resolver
URL: https://github.com/apache/hop/issues/8302


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@hop.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Feature Request]: Support Kubernetes authentication for HashiCorp Vault variable resolver (hop)

["mattcasters (via GitHub)" <gi...@apache.org>]

mattcasters commented on issue #8302:
URL: https://github.com/apache/hop/issues/8302#issuecomment-5605595095

   Great idea @monwolf


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@hop.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org