invalid "bound_service_account_namespace_selector" configured

[yushiqie]

Vault v1.20.1 (b403b1a), built 2025-07-24T13:33:51Z

I follow these steps:

1. vault login $ROOT_TOKEN

2. vault auth enable kubernetes

3. vault secrets enable -path=secret kv

4. vault policy write test-policy - <<EOF
   path "secret/data/test/*" {
   capabilities = ["create", "read", "update", "delete", "list"]
   }
   EOF

5. vault write auth/kubernetes/config
   kubernetes_host="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}"
   kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt

6. vault write auth/kubernetes/role/test
   bound_service_account_names=default
   bound_service_account_namespace_selector='kubernetes.io/metadata.name=test'
   policies=test-policy
   ttl=24h

[heatherezell]

Hello! According to the documentation, bound_service_namespace_selector accepts either a JSON or a YAML object. If you want to use a specific namespace, try using simply bound_service_namespaces.

Let me know if that helps. Thanks! :)

[heatherezell]

Hello! I wanted to check in with you on this. Do you still need assistance? Let me know if this issue can be closed. Thanks!