Hashicorp Approle authentication is challenging to manage across so many clusters.

Client certificates can be much more easily managed because of cert-manager integration.

We can automatically generate vault client certificates using cert-manager and use them to authenticate to vaults.

Like approle this requires vault configuration within each namespace to set up the tls cert authentication and associated roles.

Ideally the vaultclient certificate issuer will be setup to point to a shared PKE certificate authority, like hashicorp vault PKI, to make it even easier to manage.

Don't confuse the two roles of the vault described above.

The vault use for PKI is distinct from the vault use for secrets which gets authenticated via these client certs.