vault: use dedicated service account for k8s auth

services/vault/kustomization.yaml

@@ -4,6 +4,8 @@ kind: Kustomization
 namespace: vault
 resources:
   - namespace.yaml
+  - serviceaccount.yaml
+  - rbac.yaml
   - configmap.yaml
   - statefulset.yaml
   - service.yaml

services/vault/rbac.yaml

@@ -0,0 +1,13 @@
+# services/vault/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: vault-auth-delegator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+  - kind: ServiceAccount
+    name: vault
+    namespace: vault

services/vault/serviceaccount.yaml

@@ -0,0 +1,6 @@
+# services/vault/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: vault
+  namespace: vault

services/vault/statefulset.yaml

@@ -17,6 +17,7 @@ spec:
       labels:
         app: vault
     spec:
+      serviceAccountName: vault
       nodeSelector:
         node-role.kubernetes.io/worker: "true"
         kubernetes.io/arch: arm64