Allow mTLS between VSO and external Vault instance

[bbucko]

Is your feature request related to a problem? Please describe.
Our instance of Vault is using mTLS and we are unable to private client cert/key. All attempts end up in 'remote error: tls: bad certificate'

Describe the solution you'd like
Set of annotations that would make it possible to provide reference to a secret containing private key/cert which would be used to establish mTLS connection with external instance of Vault.

Describe alternatives you've considered
Tried adding annotations (vault.hashicorp.com/tls-secret or vault.hashicorp.com/client-cert) but they are not working.

[kschoche]

Hi @bbucko - Thanks for filing this issue,
We currently have fields defined as part of the VaultConnection custom resource under Spec.tlsServerName/caCertSecretRef here, which I think should work for this, unless I'm missing something in your request.
Can you take a look at that and see if it fits your use case?
If not, could you point out what it is missing?
Cheers,
~Kyle

[bbucko]

Hi,
caCertSecretRef seems like a way to define CA Certificate but I want to additionally define fields that would act as https://developer.hashicorp.com/vault/docs/platform/k8s/injector/annotations#vault-hashicorp-com-client-cert and https://developer.hashicorp.com/vault/docs/platform/k8s/injector/annotations#vault-hashicorp-com-client-key.
Unless there's some "secret" field I'm missing, it's not possible to configure TLS Config to pick up client cert/key.
I think that we could potentially use environment variables to define both and point them to a mounted secrets in the container but Chart does not allow to do it at the moment (I think there's a separate issue for fixing this: #287).

[nia-potato]

hey @bbucko did you get this resolved at last?

[bbucko]

Nah, we switched to a diffeent secrets management system.

[huyquanha]

Hello 👋 I'm having the same issue. As mentioned caCertSecretRef seems to only contain the CA certificate. How would we define a client key and a client certificate in the TLS config, so that we can enable mTLS on the Vault server?