HashiCorp Vault AppRole for External Secrets Operator

# Enable AppRole auth method
vault auth enable approle

# Set long default TTLs for the AppRole mount
vault auth tune -default-lease-ttl=999999999 -max-lease-ttl=999999999 approle

# Create the role with appropriate token settings
vault write auth/approle/role/external-secrets-operator \
  secret_id_ttl=999999999 \
  secret_id_num_uses=999999999

vault write auth/approle/role/external-secrets-operator \
  token_num_uses=20 \
  token_ttl=20m \
  token_max_ttl=30m \
  token_explicit_max_ttl=30m

# Generate the secret ID
vault write -f auth/approle/role/external-secrets-operator/secret-id

# Get the role ID
vault read auth/approle/role/external-secrets-operator/role-id

# Assign policies
vault write -f auth/approle/role/external-secrets-operator policies=admin

vault write auth/approle/login \
  role_id=<your-role-id> \
  secret_id=<your-secret-id>

apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: vault-secret-store
spec:
  provider:
    vault:
      server: "https://vault.example.com"
      path: "secret"
      version: "v2"
      auth:
        appRole:
          path: "approle"
          roleRef:
            name: vault-approle
            key: role-id
            namespace: external-secrets
          secretRef:
            name: vault-approle
            key: secret-id
            namespace: external-secrets