Add explicit Vault role and ServiceAccount configuration

[colek42]

Add explicit Vault role and ServiceAccount configuration

Problem

The Helm charts are missing explicit Vault role configuration needed for External Secrets Operator to authenticate with Vault.

Current State

• Basic Vault configuration exists in secretstores.yaml
• Missing explicit role definitions in values.yaml
• Missing ServiceAccount configuration with proper annotations
• No documentation of Vault role requirements

Desired State

# In values.yaml

kratos:
  vault:
    enabled: false  # Using ESO instead of Vault Agent injection
    role: "kratos"  # Vault Kubernetes auth role name
  serviceAccount:
    create: true
    name: "kratos"
    annotations:
      eks.amazonaws.com/role-arn: ""  # Optional: IRSA role ARN

judge-api:
  vault:
    enabled: false
    role: "judge-api"
  serviceAccount:
    create: true
    name: "judge-api"
    annotations:
      eks.amazonaws.com/role-arn: ""

archivista:
  vault:
    enabled: false
    role: "archivista"
  serviceAccount:
    create: true
    name: "archivista"
    annotations:
      eks.amazonaws.com/role-arn: ""

Why This Matters

1. Vault Authentication: ESO needs correct role names to authenticate
2. Kubernetes Auth: Each role must be configured in Vault with proper policies
3. IRSA Support: ServiceAccount annotations enable IAM Roles for Service Accounts
4. Configuration as Code: Users understand what Vault setup is required

Files to Update

• charts/judge/values.yaml - Add vault and serviceAccount sections
• charts/judge/templates/secretstores.yaml - Reference the configured roles
• charts/kratos/templates/serviceaccount.yaml - Ensure annotations propagate
• charts/judge-api/templates/serviceaccount.yaml
• charts/archivista/templates/serviceaccount.yaml

Terraform Prerequisite

Users must configure these Vault roles in Terraform:

# Each role must be created with Kubernetes auth policy
vault write auth/kubernetes/role/kratos \
  bound_service_account_names=kratos \
  bound_service_account_namespaces=judge \
  policies=kratos-policy

Documentation Updates

• Document the required Vault roles and policies
• Document IRSA configuration (if using AWS)
• Provide troubleshooting steps

Impact

• High Priority: ESO cannot work without proper role configuration
• Required for Vault integration to function
• Clarifies deployment requirements

Labels

• enhancement
• helm-charts
• required
• vault-integration

Fix Location

Helm Charts - Add missing Vault role and ServiceAccount configuration