FSA: Various Vault Authentication processes: App-role

[Co1Mars]

---

Summary: Certificate Manager / FTA — Vault authentication via AppRole

Type: Story
Component: Certificate Manager / FTA
Labels: federation, vault, authentication, approle, m2m

---

Description

The Certificate Manager / FTA authenticates to Vault/OpenBao to perform certificate lifecycle operations (CSR submission, rotation, revocation). To support automated, M2M-appropriate authentication across deployment environments, the Certificate Manager must support Vault's AppRole auth method. AppRole is well-suited to this component as it requires no human interaction and integrates cleanly with secret injection at deployment time.

---

Acceptance Criteria

• Certificate Manager authenticates to Vault using role_id and secret_id via the AppRole auth method
• role_id and secret_id are injected via environment or secret store — never hardcoded
• Vault token is renewed before expiry; AppRole re-authentication is triggered if renewal fails
• secret_id rotation is supported — Certificate Manager re-authenticates cleanly when a new secret_id is issued
• Auth method is selectable via deployment profile (e.g. vault.auth.method=approle)
• Authentication failure blocks dependent PKI operations and logs a structured error
• AppRole implementation conforms to the VaultAuthProvider abstraction shared with Management Node auth stories

---

Technical Notes

• Vault AppRole login endpoint: POST /v1/auth/approle/login with role_id and secret_id
• Spring @Profile-activated AppRoleVaultAuthProvider — consistent with the pluggable auth pattern established in the Management Node JWT story
• Token lifecycle: schedule renewal using lease_duration; fallback to full re-authentication on renewal failure
• secret_id has its own TTL in Vault — monitor and handle expiry gracefully; log a clear warning when secret_id is within a configurable threshold of expiry
• Configurable properties: vault.auth.method, vault.auth.approle.role-id, vault.auth.approle.secret-id-source, vault.auth.approle.mount-path
• secret_id source should support both environment variable injection and retrieval from a local secret store backend (e.g. OpenBao KV)

---

Out of Scope

• JWT/OIDC and Token auth methods (separate stories)
• Management Node Vault auth (separate component)
• AppRole policy scoping in Vault (infrastructure/ops concern)

---

Dependencies

• Vault/OpenBao AppRole auth method enabled and configured at the node-local Vault instance
• VaultAuthProvider abstraction in place (shared with Management Node auth series)
• Deployment pipeline capable of injecting role_id and secret_id securely

---

Definition of Done

• AppRole authentication to Vault verified in integration test
• Token renewal and re-authentication fallback confirmed
• secret_id expiry warning behaviour verified
• Profile-based auth method selection verified
• Auth failure blocks PKI operations — confirmed in test
• PR reviewed and merged