#4043·openbao

auth/kuberentes: Make kubernetes_ca_cert optional

Author: dm3chCreated Sep 22, 2026Updated Sep 22, 2026
Labelsfeature

Is your feature request related to a problem? Please describe. GKE clusters uses google public CA when you are connecting outside of project VPC for DNS endpoint mode clusters with VPC. This leads to the problem with connecting remote k8s clusters to k8s openbao auth, as CA reported by GKE is wrong (as for this traffic path Google public CA used), so you've to store write Google CA into vault settings.

Describe the solution you'd like Allow ommiting kubernetes_ca_cert for remote clusters resulting in validation with system ca certs.

Describe alternatives you've considered

Explain any additional use-cases

Additional context Implementation in Vault: https://github.com/hashicorp/vault-plugin-auth-kubernetes/pull/238