fix(vault): authenticate auth-api and agents-api with Kubernetes auth

platform/cluster/flux/apps/stateless/agents-api/deployment-enschede-ws.yaml

@@ -35,7 +35,6 @@ spec:
         app.kubernetes.io/name: agents-api-ws
       annotations:
         vault.hashicorp.com/agent-inject: 'true'
-        vault.hashicorp.com/agent-inject-token: 'true'
         vault.hashicorp.com/agent-pre-populate-only: 'true'
         vault.hashicorp.com/role: agents-api
         vault.hashicorp.com/agent-inject-secret-agents-api.env: rabbitmq/creds/app-consumer
@@ -77,7 +76,6 @@ spec:
             - /bin/sh
             - -ec
             - |
-              export SPRING_CLOUD_VAULT_TOKEN="$(cat /vault/secrets/token)"
               set -a
               . /vault/secrets/agents-api.env
               set +a
@@ -98,6 +96,13 @@ spec:
               value: 'true'
             - name: VAULT_ADDR
               value: http://vault.data-system.svc.cluster.local:8200
+            # Canonical Spring property names: agents-api's application.yml
+            # lives in the agents-api repo, so bind these directly rather than
+            # through a placeholder this repo does not own.
+            - name: SPRING_CLOUD_VAULT_AUTHENTICATION
+              value: KUBERNETES
+            - name: SPRING_CLOUD_VAULT_KUBERNETES_ROLE
+              value: agents-api
             - name: VAULT_DB_ENABLED
               value: 'true'
             - name: DB_HOST

platform/cluster/flux/apps/stateless/agents-api/deployment.yaml

@@ -41,7 +41,6 @@ spec:
         app.kubernetes.io/name: agents-api
       annotations:
         vault.hashicorp.com/agent-inject: 'true'
-        vault.hashicorp.com/agent-inject-token: 'true'
         vault.hashicorp.com/agent-pre-populate-only: 'true'
         vault.hashicorp.com/role: agents-api
         vault.hashicorp.com/agent-inject-secret-agents-api.env: rabbitmq/creds/app-consumer
@@ -84,7 +83,6 @@ spec:
             - /bin/sh
             - -ec
             - |
-              export SPRING_CLOUD_VAULT_TOKEN="$(cat /vault/secrets/token)"
               set -a
               . /vault/secrets/agents-api.env
               set +a
@@ -111,6 +109,13 @@ spec:
               value: 'true'
             - name: VAULT_ADDR
               value: http://vault.data-system.svc.cluster.local:8200
+            # Canonical Spring property names: agents-api's application.yml
+            # lives in the agents-api repo, so bind these directly rather than
+            # through a placeholder this repo does not own.
+            - name: SPRING_CLOUD_VAULT_AUTHENTICATION
+              value: KUBERNETES
+            - name: SPRING_CLOUD_VAULT_KUBERNETES_ROLE
+              value: agents-api
             - name: VAULT_DB_ENABLED
               value: 'true'
             - name: DB_HOST

platform/cluster/flux/apps/stateless/auth-api/deployment.yaml

@@ -56,7 +56,6 @@ spec:
         app.kubernetes.io/name: auth-api
       annotations:
         vault.hashicorp.com/agent-inject: 'true'
-        vault.hashicorp.com/agent-inject-token: 'true'
         vault.hashicorp.com/agent-pre-populate-only: 'true'
         vault.hashicorp.com/role: auth-api
         vault.hashicorp.com/agent-inject-secret-auth-api.env: secret/data/auth-api
@@ -119,7 +118,6 @@ spec:
             - /bin/sh
             - -ec
             - |
-              export SPRING_CLOUD_VAULT_TOKEN="$(cat /vault/secrets/token)"
               set -a
               . /vault/secrets/auth-api.env
               set +a
@@ -158,6 +156,10 @@ spec:
               value: 'true'
             - name: VAULT_ADDR
               value: http://vault.data-system.svc.cluster.local:8200
+            - name: VAULT_AUTHENTICATION
+              value: KUBERNETES
+            - name: VAULT_KUBERNETES_ROLE
+              value: auth-api
             - name: VAULT_DB_ENABLED
               value: 'true'
             - name: DB_HOST

services/auth-api/src/main/resources/application.yml

@@ -15,6 +15,17 @@ spring:
       enabled: ${VAULT_ENABLED:false}
       uri: ${VAULT_ADDR:http://localhost:8200}
       authentication: ${VAULT_AUTHENTICATION:TOKEN}
+      # KUBERNETES auth lets the session manager re-login once a token can no
+      # longer be renewed. A static token cannot: Vault's kubernetes mount caps
+      # renewal at max_lease_ttl (32d), after which every call 403s for the
+      # remaining life of the pod.
+      kubernetes:
+        role: ${VAULT_KUBERNETES_ROLE:auth-api}
+        kubernetes-path: kubernetes
+        service-account-token-file: /var/run/secrets/kubernetes.io/serviceaccount/token
+      session:
+        lifecycle:
+          enabled: true
       config:
         lifecycle:
           enabled: true