Comment 2 for bug 1721003

Hello Rob,

Here's some context:
I'm coding a script that will allow to get a let's encrypt certificate and share it between the controllers for CloudDomain domain.

Thus, it would be good if the overcloud nodes could access Vault service using the keytab they get when registered in IPA using the novajoin on the undercloud.

That way, my script will be able to:
- securely access the secret storage containing private key, certificate and chain
- ensure accesses are authenticated (with the keytab)
- ensure the authenticated principal is allowed to access the vault

Plus, doing so would prevent the need to get a standalone custodia running somewhere.

Does it make sense?

Cheers,

C.