monwolf opened a new issue, #8302: URL: https://github.com/apache/hop/issues/8302
### What would you like to happen? ### Problem Apache Hop's HashiCorp Vault variable resolver currently supports authentication using long-lived Vault tokens. While this works, using long-lived tokens is not ideal in Kubernetes environments, where workloads can authenticate using short-lived, automatically managed credentials. We are currently implementing the HashiCorp Vault variable resolver in a Kubernetes-based environment, and would like to avoid having to provision and manage long-lived Vault tokens for Hop. ### Proposed solution Add support for the Kubernetes authentication method to the HashiCorp Vault variable resolver. The resolver should be able to authenticate against Vault using a Kubernetes ServiceAccount token, allowing Vault to validate the workload identity through its Kubernetes authentication backend. The expected flow would be roughly: - Apache Hop is running inside a Kubernetes pod. - The pod has a Kubernetes ServiceAccount assigned to it. - Hop reads the ServiceAccount JWT/token available inside the pod. - Hop authenticates against Vault using the Kubernetes auth method. - Vault returns a short-lived Vault token. - The resolver uses that token to retrieve the requested secrets. - The Vault token can be renewed or re-authenticated as appropriate, without requiring a long-lived token to be configured in Hop. - ### Motivation Using Kubernetes authentication would provide several advantages: - Avoids storing long-lived Vault tokens in Hop configuration. - Uses short-lived credentials managed by Kubernetes. - Better aligns with Vault's recommended authentication mechanisms for workloads running in Kubernetes. - Reduces the risk associated with leaked or compromised long-lived Vault tokens. - Makes the HashiCorp Vault variable resolver easier to deploy in cloud-native environments. ### Issue Priority Priority: 2 ### Issue Component Component: Hop Server -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
