GroupAlias.spec.name pattern too restrictive for real-world IdP group/role names (blocks uppercase & underscores)

[sgoetsch]

Problem

GroupAlias.spec.name (and the fallback metadata.name) is validated against the pattern [a-z0-9]([-a-z0-9]*[a-z0-9])? (lowercase alphanumeric + hyphens only). This value is sent verbatim to Vault's /identity/group-alias API as the name field, which Vault uses to match against the external IdP's group/role claim value during OIDC/JWT login (Vault itself has no such restriction on alias names).

Many real-world identity providers use group/role names containing uppercase letters and underscores (e.g. Keycloak groups like Dev_Finances). Because metadata.name follows standard Kubernetes DNS-1123 label rules and spec.name inherits the same restrictive pattern, there is no way to create a GroupAlias whose Vault-side name matches such a claim value — this blocks Vault's External Groups feature entirely for such IdPs.

Suggested fix:

relax spec.name's pattern (it's just an opaque string sent to Vault's API, not a Kubernetes object identity when overridden), or add a separate unconstrained field (e.g. aliasName) for the Vault-side value.

Workaround

currently required: managing affected GroupAlias objects manually via vault/bao CLI outside of GitOps.

Version:

confirmed present in v0.8.50 (Helm chart)