Kubernetes Service Registration error

[andresilva97]

Describe the bug
I am using service resgistration on Vault config : service_registration "kubernetes" {} and on my manifest using Downward API:

  - name: VAULT_K8S_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: VAULT_K8S_POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name

To Reproduce
Steps to reproduce the behavior:

1. Run kubectl apply -f .
2. Vault logs:
   2020-11-05T12:13:22.494Z [WARN] service_registration.kubernetes: unable to set initial state due to bad status code: req method: GET, req url: https://x.x.x.x:443/api/v1/namespaces/vault/pods/vault-deployment-5bcf69d947-jd9jj, resp statuscode: 403, will retry

Expected behavior
Get this information :

apiVersion: v1
kind: Pod
metadata:
  name: vault
  labels:
    vault-active: "false"
    vault-initialized: "true"
    vault-perf-standby: "false"
    vault-sealed: "false"
    vault-version: 1.3.0

Environment:

• Vault Server Version (retrieve with vault status):

Key                      Value
---                      -----
Recovery Seal Type       shamir
Initialized              true
Sealed                   false
Total Recovery Shares    1
Threshold                1
Version                  1.5.5
Cluster Name             vault-cluster-c9b1f457
Cluster ID               c33a4edb-20ec-d9d7-c94d-376bfc42e8fb
HA Enabled               true
HA Cluster               https://x.x.x.x:8201
HA Mode                  active

• Vault CLI Version (retrieve with vault version): Vault v1.5.5
• Server Operating System/Architecture:
  Kubernetes

[candrii]

same problem, how did you fix that?

[hixichen]

@notariuss

I hit the same issue, fixed by:

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: default  # make sure to use `default` which can be auto replaced by kustomize
  name: hashicorp-vault-role
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "update", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: hashicorp-vault-role-binding
  namespace: default  # make sure to use `default` which can be auto replaced by kustomize
  labels:
    app: hashicorp-vault
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: hashicorp-vault-role
subjects:
- kind: ServiceAccount
  name: hashicorp-vault
  namespace: default  # make sure to use `default` which can be auto replaced by kustomize