<p>Is it possible to share a ServiceAccount between namespaces or somehow start a pod with a ServiceAccount from a different namespace?  </p>

<p>We are looking to use vault to store common secret data between dynamic development environments.  Following the very good walk though <a href="https://medium.com/@gmaliar/dynamic-secrets-on-kubernetes-pods-using-vault-35d9094d169" rel="noreferrer">HERE</a> we were able to authenticate and pull secrets for a single namespace.  However in our use case we will be creating a new namespace for each development environment during it's lifetime.  </p>

<p>If possible we would like to avoid having to also configure vault with a new auth backend for each namespace.</p>

Andy Snowden
<p>When you create the Vault role, you can <a href="https://www.vaultproject.io/api/auth/kubernetes/index.html#bound_service_account_namespaces" rel="noreferrer">configure <code>bound_service_account_namespaces</code> to be the special value <code>*</code></a>, and allow a fixed service account name from any namespace.  To adapt the "create role" <a href="https://www.vaultproject.io/docs/auth/kubernetes.html#configuration" rel="noreferrer">example from the documentation</a>:</p>

<pre><code>vault write auth/kubernetes/role/demo \
    bound_service_account_names=vault-auth \
    bound_service_account_namespaces='*' \
    policies=default \
    ttl=1h
</code></pre>

<p>You have to recreate the Kubernetes service account in every namespace, and it must have the exact name specified in the role.  However, the Kubernetes service account is a single k8s object and it's not any harder than the Deployments, Services, ConfigMaps, and Secrets you already have; this pattern doesn't require any Vault reconfiguration.</p>

<p>(If you're using a templating tool like Helm, the service account can't follow a naming convention like <code>{{ .Release.Name }}-{{ .Chart.Name }}</code>: Vault doesn't appear to have any sort of pattern matching on this name.)</p>
