<p>I have a Vault deployment in my cluster that I use to store secrets. Additionally, I have created <code>roles</code>, <code>policies</code>, and a <code>ServiceAccount</code>. My applications will retrieve secrets from Vault using this service account. However, I am concerned that another application could use the service account meant for a different application. What measures can I take to prevent this from happening?</p>
<p>Say, I have assigned different policies to <code>application A</code> and <code>application B</code>, so I need a way to ensure that <code>application B</code> cannot use the <code>ServiceAccount</code> meant for <code>application A</code>.</p>

Anirudh Ramesh
<p>Using the <code>kubernetes</code> auth method, this is how it works. You don't need to do anything else. Assuming you are using the default behavior of kubernetes where it creates a service account per app, you're good.</p>
<p>When an app logins to Vault using a ServiceAccount, it provides its token and authenticates for a specific role, e.g</p>
<pre><code>curl \
    --request POST \
    --data '{&quot;jwt&quot;: &quot;&lt;your service account jwt&gt;&quot;, &quot;role&quot;: &quot;demo&quot;}' \
    http://127.0.0.1:8200/v1/auth/kubernetes/login
</code></pre>
<p>The SA token is available only to your service. Kubernetes creates a SA for each app. It means AppA doesn't have the access for AppB ServiceAccount token (unless you explicitly specify that).</p>
<p>The way to integrate that with Vault is to config a <strong>named role</strong> with a <strong>bounded service account and namespace</strong></p>
<pre><code>vault write auth/kubernetes/role/demo \
    bound_service_account_names=myapp \
    bound_service_account_namespaces=default \
    policies=default \
    ttl=1h
</code></pre>
<p>The above role can be used to authenticate only for <code>myapp</code> from the <code>default</code> namespace. No other app can login using this role.</p>
<p>To address your question, you would need a <strong>different Vault role</strong> for each app, with <strong>different bounded service account and namespace</strong>.</p>
<p>Check out Vault documentation on <a href="https://developer.hashicorp.com/vault/docs/auth/kubernetes" rel="noreferrer">kubernetes auth method</a> for full example</p>
