<p>I was trying to implement a generic rule that will allow each Kubernetes service to access it’s own path. This is what I tried:</p>

<pre><code>path "secret/services/k8s/{{identity.entity.metadata.metadata.service_account_namespace}}/{{identity.entity.metadata.metadata.service_account_name}}/*" {
  capabilities = ["read"]
}
</code></pre>

<p>But this does not work - anyone managed to write such a generic policy that works?</p>

<p>What I tried so far?</p>

<ul>
<li>Using both entity metadata and the Kubernetes accessor</li>
<li>Ensure I am using the right service account by inspecting it's token</li>
<li>Check with static path (replace the template with the actual values) - worked</li>
</ul>

<p>After spending some time, I was able to find the answer:</p>
<pre><code>path &quot;kv-v2/data/kubernetes/{{identity.entity.aliases.&lt;kubernetes auth accessor&gt;.metadata.service_account_namespace}}/{{identity.entity.aliases.&lt;kubernetes auth accessor&gt;.metadata.service_account_name}}&quot; {
  capabilities = [&quot;read&quot;]
}
</code></pre>
<p>To find the accessor, use <code>vault auth list -detailed</code></p>
