Configure the Kubernetes authentication method so that pods running on the cluster can authenticate to OpenBao using their projected service account tokens.
Prerequisites checklist
Confirm these before running steps:
1Enable the Kubernetes auth method
bao auth enable kubernetes→ Success! Enabled kubernetes auth method at: kubernetes/
2Configure Kubernetes auth with in-cluster API credentials
oc exec openbao-0 -n openbao -- sh -c 'bao write auth/kubernetes/config token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" kubernetes_host="https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT" kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt'→ Success! Data written to: auth/kubernetes/config
3Create the myapp policy
This allows read and list of secrets in the myapp/* path
bao policy write myapp - <<'EOF'
path "secret/data/myapp/*" {
capabilities = ["read", "list"]
}
path "secret/metadata/myapp/*" {
capabilities = ["list"]
}
EOF→ Success! Uploaded policy: myapp
4Create a Kubernetes auth role binding SA to policy
oc exec -it openbao-0 -n openbao -- bao write auth/kubernetes/role/myapp bound_service_account_names=myapp-sa bound_service_account_namespaces=myapp-ns policies=myapp ttl=1h→ Success! Data written to: auth/kubernetes/role/myapp
5Deploy the test client (Namespace, ServiceAccount, and Pod
manifest in Commands / YAML tab
→ Pod test-bao-client Running
6Test authentication from within the pod
Connect:
oc exec -it test-bao-client -n myapp-ns -- shThen run the login/read script in Commands / YAML tab
→ Logs in and gets a token. A JSON with password is retrieved
7Use the returned token to read secrets
→
secret/myapp/config data is returned8Negative test — different SA must be denied
Deploy a second client with SA other-sa in namespace other-ns (manifest in Commands / YAML tab)
oc exec -it test-bao-denied -n other-ns -- shThen run the login/read script in Commands / YAML tab
→ Login fails (permission denied / SA not authorised) — role only allows myapp-sa in myapp-ns
9Cleanup
oc delete namespace myapp-nsoc delete namespace other-ns