Merge pull request #12793 from hashicorp/jm/vault-ns-auth

Set vault namespaces on vault client prior to logging in

.changelog/12793.txt

@@ -0,0 +1,5 @@
+```release-note:bug
+The Connect CA Vault system now sets the Namespace (if present) prior
+to attempting to login to Vault. This means the AuthMethod needs to
+be in the specified namespace. Previously the AuthMethod needed to be
+in the root namespace to work.

agent/connect/ca/provider_vault.go

@@ -103,6 +103,14 @@ func (v *VaultProvider) Configure(cfg ProviderConfig) error {
 		return err
 	}
 
+	// We don't want to set the namespace if it's empty to prevent potential
+	// unknown behavior (what does Vault do with an empty namespace). The Vault
+	// client also makes sure the inputs are not empty strings so let's do the
+	// same.
+	if config.Namespace != "" {
+		client.SetNamespace(config.Namespace)
+	}
+
 	if config.AuthMethod != nil {
 		loginResp, err := vaultLogin(client, config.AuthMethod)
 		if err != nil {
@@ -112,13 +120,6 @@ func (v *VaultProvider) Configure(cfg ProviderConfig) error {
 	}
 	client.SetToken(config.Token)
 
-	// We don't want to set the namespace if it's empty to prevent potential
-	// unknown behavior (what does Vault do with an empty namespace). The Vault
-	// client also makes sure the inputs are not empty strings so let's do the
-	// same.
-	if config.Namespace != "" {
-		client.SetNamespace(config.Namespace)
-	}
 	v.config = config
 	v.client = client
 	v.isPrimary = cfg.IsPrimary