Configure

In this part, you will

• Create a secret in Vault
• Configure Kubernetes Authentication
• Create a policy and a service account. You will then create a role that binds the policy with the service account so that pods have the necessary get and describe permissions to access the secret

Step 1: Create Secret

When Vault is run in development mode, a KV secret engine is enabled at the path /secret.

• Start an interactive shell session on the vault-0 pod

kubectl exec -it vault-0 -- /bin/sh

• Commands issued at this prompt are executed on the vault-0 container

• Create a secret at the path secret/db-pass with a password

vault kv put secret/db-pass password="db-secret-password"

• Verify that the secret is readable at the path secret/db-pass

vault kv get secret/db-pass

Step 2: Configure Kubernetes Authentication

Vault provides a Kubernetes authentication method that enables clients to authenticate with a Kubernetes Service Account Token. The Kubernetes resources that access the secret and create the volume authenticate through this method through a role.

• Enable the Kubernetes authentication method

vault auth enable kubernetes

• Configure the Kubernetes authentication method with the Kubernetes API address. It will automatically use the Vault pod's own service account token. The environment variable KUBERNETES_PORT_443_TCP_ADDR references the internal network address of the Kubernetes host

vault write auth/kubernetes/config \
    kubernetes_host="https://$KUBERNETES_PORT_443_TCP_ADDR:443"

Step 3: Create a policy, role and service account

• Create a policy named "internal-app". This will be used to give the "webapp-sa" service account permission to read the kv secret created earlier

vault policy write internal-app - <<EOF
path "secret/data/db-pass" {
  capabilities = ["read"]
}
EOF

• Create a Kubernetes authentication role named "database" that binds this policy with a Kubernetes service account named webapp-sa

vault write auth/kubernetes/role/database \
    bound_service_account_names=webapp-sa \
    bound_service_account_namespaces=web-app \
    policies=internal-app \
    ttl=20m

The role connects the Kubernetes service account "webapp-sa" in the namespace "web-app" with the Vault policy "internal-app".

Exit the vault-0 pod.

exit

• Create a namespace where the test pod will be deployed (e.g. web-app), create a service account named "webapp-sa" in that namespace

kubectl create serviceaccount webapp-sa -n web-app

Next Steps

You are now ready to move on to the next part of the recipe where you will create a workload and access the secrets.