Configure the auth method with the cluster API server and CA cert: 'vault write auth/kubernetes/config kubernetes_host=https://<K8S_API_HOST>:443 kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt token_reviewer_jwt=<REVIEWER_SA_TOKEN>'
Create a Vault role bound to a specific service account and namespace: 'vault write auth/kubernetes/role/myapp bound_service_account_names=myapp-sa bound_service_account_namespaces=production token_policies=myapp-policy token_ttl=1h'
In the pod spec, mount a projected service account token with a specific audience: set 'serviceAccountToken.audience=vault' in the projected volume
From the pod, login using the projected token: 'vault write auth/kubernetes/login role=myapp jwt=$(cat /var/run/secrets/tokens/vault-token)'
Use Vault Agent in the pod sidecar with the 'kubernetes' auto-auth method pointing at the projected token path to automate login and renewal
Known gotchas
The default service account token at '/var/run/secrets/kubernetes.io/serviceaccount/token' does not have an audience claim for Vault; always use a projected token with the correct audience
token_reviewer_jwt must belong to a service account with 'system:auth-delegator' ClusterRole; using a regular SA token causes 403 on TokenReview API calls
Kubernetes 1.24+ no longer auto-creates long-lived SA token secrets; the token_reviewer_jwt must come from a manually created Secret of type kubernetes.io/service-account-token
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp