I have configured the Vault agent injector in my K8s cluster. We have deployed Vault using Helm. In a sandbox, I have created a K8s service account and then have a Vault role which binds my Vault policy to the K8s service account. In my pods, I am using that service account in the pod annotation (vault.hashicorp.com/role:
) and it is working well.
While setting this up, I found that the default Kubernetes authentication was not configured. We instead have many different Kubernetes auth methods set up for each application, even though all of those applications live within a single K8s cluster. The content of each Kubernetes auth method is basically the same.
In the Helm chart details, I found that I can specify the injector.authPath
value if I want to use something other than the default. Is there any advantage from a security perspective to use a custom Kubernetes auth method instead of the default one?