Why does vault-configurer use root token?

[Ais8Ooz8]

If you try to revoke your root token and remove it from vault-unseal-keys, the following errors appear:

"error configuring vault: unable to get key vault-root: key vault-root is not present in secret: vault-unseal-keys"

[johnny990]

it uses root token to configure vault. I have similar security concerns about it, but didn't find proper solution

[Ais8Ooz8]

There is an option storeRootToken to disable root token storage

https://github.com/bank-vaults/vault-operator/blob/main/pkg/apis/vault/v1alpha1/vault_types.go

https://github.com/bank-vaults/vault-operator/blob/main/deploy/examples/cr-disabled-root-token-storage.yaml