<p>I am new to vault, and trying to secure data according to the k8s namespace a pod is in.  I have the authentication part sorted, but I can't make an ACL that lets a client read secrets without giving away <em>all</em> secrets</p>
<p>The structure i am using is <code>secret/k8s/&lt;k8s-namespace&gt;/&lt;appname&gt;</code></p>
<p>e.g. <code>secret/k8s/bex/app1</code></p>
<p><a href="https://i.stack.imgur.com/eYsSS.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/eYsSS.png" alt="enter image description here" /></a></p>
<p>I have tried an ACL policy like this, but without <code>secret/*</code> I am denied access, and with <code>secret/*</code> clients can see everything, event paths adjacent to <code>bex</code>.</p>
<p>What am I doing wrong?</p>
<pre class="lang-bsh prettyprint-override"><code># Without this, I cannot access anything
#path &quot;secret/*&quot; { capabilities = [ &quot;read&quot;, &quot;list&quot; ]}

path &quot;secret/k8s/bex*&quot; { capabilities = [ &quot;read&quot;, &quot;list&quot; ]}
path &quot;secret/k8s/bex/*&quot; { capabilities = [ &quot;read&quot;, &quot;list&quot; ]}
path &quot;secret/k8s/bex/app1&quot; { capabilities = [ &quot;read&quot;, &quot;list&quot; ]}
path &quot;secret/k8s/bex/app1/*&quot; { capabilities = [ &quot;read&quot;, &quot;list&quot; ]}
path &quot;secret/k8s/bex/app1*&quot; { capabilities = [ &quot;read&quot;, &quot;list&quot; ]}
</code></pre>

<p>TL;DR:</p>
<p>This is because when you are granting <em>access</em> to secrets you need to use the <code>data</code> path after the secret backend. In your case: <code>secret/data/k8s/bex/app1</code></p>
<p>Long version:</p>
<p>If you are using the older (deprecated) KV1 version then your policy looks like this:</p>
<pre><code>path &quot;secret/dev/team-1/*&quot; {
  capabilities = [&quot;create&quot;, &quot;update&quot;, &quot;read&quot;]
}
</code></pre>
<p>If (I assume) you are using the new KV2 secret engine (default), then the reading versions are prefixed with the <code>data/</code> path.</p>
<pre><code>path &quot;secret/data/dev/team-1/*&quot; {
  capabilities = [&quot;create&quot;, &quot;update&quot;, &quot;read&quot;]
}
</code></pre>
<p>More in the <a href="https://www.vaultproject.io/docs/secrets/kv/kv-v2#acl-rules" rel="nofollow noreferrer">Official Docs</a>.</p>
