feat: make cert auth mount path configurable (#5400)

* feat: vault auth cert path

Signed-off-by: Zbigniew Mandziejewicz <shaxbee@gmail.com>

* chore: mark VaultCertAuth.Path as optional

Signed-off-by: Zbigniew Mandziejewicz <shaxbee@gmail.com>

* chore: set default VaultCertAuth path if not specified

Signed-off-by: Zbigniew Mandziejewicz <shaxbee@gmail.com>

---------

Signed-off-by: Zbigniew Mandziejewicz <shaxbee@gmail.com>
Co-authored-by: Gergely Brautigam <skarlso777@gmail.com>

apis/externalsecrets/v1/secretstore_vault_types.go

@@ -324,6 +324,12 @@ type VaultJwtAuth struct {
 // VaultCertAuth authenticates with Vault using the JWT/OIDC authentication
 // method, with the role name and token stored in a Kubernetes Secret resource.
 type VaultCertAuth struct {
+	// Path where the Certificate authentication backend is mounted
+	// in Vault, e.g: "cert"
+	// +kubebuilder:default=cert
+	// +optional
+	Path string `json:"path"`
+
 	// ClientCert is a certificate to authenticate using the Cert Vault
 	// authentication method
 	// +optional

config/crds/bases/external-secrets.io_clustersecretstores.yaml

@@ -4394,6 +4394,12 @@ spec:
                                     pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                                     type: string
                                 type: object
+                              path:
+                                default: cert
+                                description: |-
+                                  Path where the Certificate authentication backend is mounted
+                                  in Vault, e.g: "cert"
+                                type: string
                               secretRef:
                                 description: |-
                                   SecretRef to a key in a Secret resource containing client private key to

config/crds/bases/external-secrets.io_secretstores.yaml

@@ -4394,6 +4394,12 @@ spec:
                                     pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                                     type: string
                                 type: object
+                              path:
+                                default: cert
+                                description: |-
+                                  Path where the Certificate authentication backend is mounted
+                                  in Vault, e.g: "cert"
+                                type: string
                               secretRef:
                                 description: |-
                                   SecretRef to a key in a Secret resource containing client private key to

config/crds/bases/generators.external-secrets.io_clustergenerators.yaml

@@ -1253,6 +1253,12 @@ spec:
                                         pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                                         type: string
                                     type: object
+                                  path:
+                                    default: cert
+                                    description: |-
+                                      Path where the Certificate authentication backend is mounted
+                                      in Vault, e.g: "cert"
+                                    type: string
                                   secretRef:
                                     description: |-
                                       SecretRef to a key in a Secret resource containing client private key to

config/crds/bases/generators.external-secrets.io_vaultdynamicsecrets.yaml

@@ -183,6 +183,12 @@ spec:
                                 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                                 type: string
                             type: object
+                          path:
+                            default: cert
+                            description: |-
+                              Path where the Certificate authentication backend is mounted
+                              in Vault, e.g: "cert"
+                            type: string
                           secretRef:
                             description: |-
                               SecretRef to a key in a Secret resource containing client private key to

deploy/crds/bundle.yaml

@@ -6137,6 +6137,12 @@ spec:
                                       pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                                       type: string
                                   type: object
+                                path:
+                                  default: cert
+                                  description: |-
+                                    Path where the Certificate authentication backend is mounted
+                                    in Vault, e.g: "cert"
+                                  type: string
                                 secretRef:
                                   description: |-
                                     SecretRef to a key in a Secret resource containing client private key to
@@ -17337,6 +17343,12 @@ spec:
                                       pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                                       type: string
                                   type: object
+                                path:
+                                  default: cert
+                                  description: |-
+                                    Path where the Certificate authentication backend is mounted
+                                    in Vault, e.g: "cert"
+                                  type: string
                                 secretRef:
                                   description: |-
                                     SecretRef to a key in a Secret resource containing client private key to
@@ -24165,6 +24177,12 @@ spec:
                                           pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                                           type: string
                                       type: object
+                                    path:
+                                      default: cert
+                                      description: |-
+                                        Path where the Certificate authentication backend is mounted
+                                        in Vault, e.g: "cert"
+                                      type: string
                                     secretRef:
                                       description: |-
                                         SecretRef to a key in a Secret resource containing client private key to
@@ -26673,6 +26691,12 @@ spec:
                                   pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                                   type: string
                               type: object
+                            path:
+                              default: cert
+                              description: |-
+                                Path where the Certificate authentication backend is mounted
+                                in Vault, e.g: "cert"
+                              type: string
                             secretRef:
                               description: |-
                                 SecretRef to a key in a Secret resource containing client private key to

docs/api/spec.md

@@ -10455,6 +10455,19 @@ method, with the role name and token stored in a Kubernetes Secret resource.</p>
 <tbody>
 <tr>
 <td>
+<code>path</code></br>
+<em>
+string
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>Path where the Certificate authentication backend is mounted
+in Vault, e.g: &ldquo;cert&rdquo;</p>
+</td>
+</tr>
+<tr>
+<td>
 <code>clientCert</code></br>
 <em>
 <a href="https://pkg.go.dev/github.com/external-secrets/external-secrets/apis/meta/v1#SecretKeySelector">

pkg/provider/vault/auth_cert.go

@@ -67,7 +67,11 @@ func (c *client) requestTokenWithCertAuth(ctx context.Context, certAuth *esv1.Va
 		transport.TLSClientConfig.Certificates = []tls.Certificate{cert}
 	}
 
-	url := strings.Join([]string{"auth", "cert", "login"}, "/")
+	path := certAuth.Path
+	if path == "" {
+		path = "cert"
+	}
+	url := strings.Join([]string{"auth", path, "login"}, "/")
 	vaultResult, err := c.logical.WriteWithContext(ctx, url, nil)
 	metrics.ObserveAPICall(constants.ProviderHCVault, constants.CallHCVaultWriteSecretData, err)
 	if err != nil {