Enforce tenant-scoped authentication for namespaced SecretStores

🤖 Generated by the Agentic Engineer

Problem

Tenant-managed namespaced SecretStores can currently select authentication that is broader than the tenant boundary or fall back to the platform controller identity. That weakens the isolation promised by the self-service tenant model.

Expected outcome

Admission enforcement requires tenant-scoped authentication for tenant-authored Vault SecretStores while preserving the platform controller path for trusted registration resources.

Acceptance criteria

Tenant-authored SecretStores cannot reuse the shared controller role.
Vault Kubernetes authentication requires an explicit ServiceAccount in the tenant namespace.
Cross-namespace ServiceAccount references are rejected.
The platform controller can still apply trusted SecretStores in managed tenant namespaces.
Tests execute the policy under tenant and platform identities and fail if the deny rule disappears.
Both local and production overlays pass static validation.

Part of #2653.

🔗 Related PRs

#2343 - fix(openbao): grant external-secrets role write/read on apps/actual-budget path [merged]
#2345 - fix(openbao): grant actual-budget the missing vault ACL paths [merged]
#2377 - feat(vault-config): seed the AWS bootstrap credential path (placeholder + policy + tenant role) [merged]
#2412 - feat(aws): aws tenant credential plumbing (SecretStore + ProviderConfig) [merged]
#2519 - docs(tenant): record KRO as the chosen Tenant abstraction (ADR) [merged]

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

Create Plan

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

Navigation Menu

Repository navigation

Enforce tenant-scoped authentication for namespaced SecretStores #2868

Problem

Expected outcome

Acceptance criteria

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Enforce tenant-scoped authentication for namespaced SecretStores #2868

Description

Problem

Expected outcome

Acceptance criteria

Activity

coderabbitai commented on Aug 1, 2026

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions