'GitLab CI/CD Pipeline - Setting VAULT_NAMESPACE to Root for OIDC
I am implementing single sign-on for HashiCorp Vault (Enterprise) and Azure AD, using OIDC as the auth method and Terraform for my IaC. The entire solution runs off a GitLab CI/CD Pipeline.
The OIDC auth method is required to be enabled in the Vault root namespace. I initially implemented and tested the solution successfully using a dedicated namespace issued by our Vault Admin, with the VAULT_ADDRESS and VAULT_NAMESPACE variables in my .gitlab-ci.yml set in the below format:
VAULT_ADDRESS = "https://my-company-domain.org/"
VAULT_NAMESPACE = "/nnn/nnn"
To reiterate, the OIDC single sign-on authentication works perfectly with my VAULT_NAMESPACE set as depicted above.
However, to enable me set it to the Root namespace, I have implemented two changes in my .gitlab-ci.yml file which I expected to provide the desired result, but neither has been successful. By that I mean after the GitLab pipeline has successfully provisioned my GitLab project code, at the Vault login prompt (depicted below) no login redirection occurs, as per the expected and previous behaviour.
The two changes I have tried out are:
- Commenting out the VAULT_NAMESPACE line entirely, i.e.
# VAULT_NAMESPACE = "/nnn/nnn" - Setting the VAULT_NAMESPACE variable to an empty string, i.e.
VAULT_NAMESPACE = ""
What could I be doing wrong, or how do I achieve the desired result? Is this a change required in my project code........or perhaps by the Vault Admin?
Meanwhile, a GitLab documentation page on GitLab.com describes the VAULT_NAMESPACE as:
VAULT_NAMESPACE - Optional. The Vault Enterprise namespace to use for reading secrets and authentication.
If no namespace is specified, Vault uses the root ("/") namespace.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|

