Setting up integration with Vault in a deployed cluster

Post-deployment setup of HashiCorp Vault integration in the client cluster and on the Vault side.

When to use #

Use this instruction when the client cluster has already been created with a profile from Setting up integration with HashiCorp Vault in the cluster profile, and the vault-secrets-operator service is already deployed in the vault-operator namespace.

General scheme #

Setting up integration consists of the following steps:

• Step 1. Make sure the service is deployed and get the token and CA-certificate from Secret.
• Step 2. Set up integration on the Vault side
• Step 3: Create VaultAuth and test integration.

Step 1. Make sure the service is deployed #

In the deployed client cluster, check that the vault-secrets-operator service has been successfully installed and the necessary resources have been created in the vault-operator namespace.

Step 1.1. Get the token and CA certificate from Secret #

After verifying the created resources, get data from Secret to configure the Kubernetes authentication method on the Vault side in the CLI or GUI.

kubectl get secret -n vault-operator <secret-name> -o jsonpath='{.data.token}' | base64 --decode
kubectl get secret -n vault-operator <secret-name> -o jsonpath="{.data.ca\.crt}" | base64 --decode

Step 2. Set up integration on the Vault side #

Once you have your Kubernetes token and CA certificate, move on to setting up your Vault server-side integration. The following describes the setup scenario in the GUI. For instructions on setting up the Kubernetes authentication method via the command line interface, see the HashiCorp Vault documentation: Kubernetes auth method.

Step 2.1. Create a Kubernetes Authentication Method #

Create a new Kubernetes type authentication method that allows authentication using the ServiceAccount token.

In the Vault interface:

1. Open the Access → Auth Methods section.
2. Click Enable new method and select the type Kubernetes.
3. Specify the path in the Path field and click Enable method.

1. When the method is created, on the Configuration tab, specify the parameters for connecting to the Kubernetes API:

Step 2.2. Set up Secrets Engine #

Create a Secrets Engine of type KV or use an existing one.

To configure the Secrets Engine in the Vault interface, go to the Secrets Engines section and click Enable new engine. Select the KV type and specify the path where the secret storage will be accessible, for example kv.

Step 2.3. Create an access policy #

Create an access policy (policy) or use an existing one that allows secrets to be read in the required Secrets Engine.

To create an access policy in the Vault interface, go to the Policies section and click Create ACL policy. Provide a policy name and add Secrets Engine access rules.

Example policy for KV v2:

path "kv/data/*" { capabilities = ["read", "list"] }

Step 2.4. Create a role #

For the Kubernetes authentication method you created, add a role. In the Vault interface:

1. Go to the Access → Auth Methods section.
2. Open the Kubernetes authentication method you created.
3. On the Roles tab, click Create role. For the role, be sure to fill out:

Step 3: Create VaultAuth and basic integration testing #

You can perform the creation of VaultAuth and basic integration testing via VaultStaticSecret manually or in one run using a Bash script.

apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
  name: vault-auth-name
  namespace: vault-operator
spec:
  kubernetes:
    role: role-name
    serviceAccount: name-service-account
    tokenExpirationSeconds: 600
  method: kubernetes
  mount: path-name
  vaultConnectionRef: vault-connection-name

apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: vault-static-secret
  namespace: vault-operator
spec:
  destination:
    create: true
    name: secret-kubernetes-name
    overwrite: true
  mount: kv
  path: secret-name
  refreshAfter: 10s
  type: kv-v2
  vaultAuthRef: vault-auth-name

kubectl get secret -n vault-operator

bash /dev/stdin <<'EOF'
set -euo pipefail

VSO_NAMESPACE="${VSO_NAMESPACE:-vault-operator}"
VAULTAUTH_NAME="${VAULTAUTH_NAME:-vault-auth-name}"
VAULTCONNECTION_REF="${VAULTCONNECTION_REF:-vault-connection-name}"
K8S_TOKEN_EXPIRATION_SECONDS="${K8S_TOKEN_EXPIRATION_SECONDS:-600}"
CHECK_DELAY_SECONDS="${CHECK_DELAY_SECONDS:-10}"
VSO_SERVICEACCOUNT="${VSO_SERVICEACCOUNT:-vault-secrets-operator-controller-manager}"

: "${VAULT_ROLE:?Set VAULT_ROLE, for example vault-role-name}"
: "${VAULT_AUTH_MOUNT:?Set VAULT_AUTH_MOUNT, for example cluster-name}"

CREATE_VAULTSTATICSECRET="${CREATE_VAULTSTATICSECRET:-false}"
VAULTSTATICSECRET_NAME="${VAULTSTATICSECRET_NAME:-vault-static-secret}"
DESTINATION_SECRET_NAME="${DESTINATION_SECRET_NAME:-secret-kubernetes-name}"
DESTINATION_OVERWRITE="${DESTINATION_OVERWRITE:-true}"
KV_MOUNT="${KV_MOUNT:-kv}"
KV_PATH="${KV_PATH:-secret-name}"
REFRESH_AFTER="${REFRESH_AFTER:-10s}"
SECRET_ENGINE_TYPE="${SECRET_ENGINE_TYPE:-kv-v2}"

kubectl apply -f - <<EOF2
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
  name: ${VAULTAUTH_NAME}
  namespace: ${VSO_NAMESPACE}
spec:
  kubernetes:
    role: ${VAULT_ROLE}
    serviceAccount: ${VSO_SERVICEACCOUNT}
    tokenExpirationSeconds: ${K8S_TOKEN_EXPIRATION_SECONDS}
  method: kubernetes
  mount: ${VAULT_AUTH_MOUNT}
  vaultConnectionRef: ${VAULTCONNECTION_REF}
EOF2

sleep "${CHECK_DELAY_SECONDS}"

echo "Checking VaultConnection status"
kubectl get vaultconnection -n "${VSO_NAMESPACE}" "${VAULTCONNECTION_REF}" -o yaml

echo "Checking VaultAuth status"
kubectl get vaultauth -n "${VSO_NAMESPACE}" "${VAULTAUTH_NAME}" -o yaml

if [ "${CREATE_VAULTSTATICSECRET}" = "true" ]; then
  kubectl apply -f - <<EOF2
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: ${VAULTSTATICSECRET_NAME}
  namespace: ${VSO_NAMESPACE}
spec:
  destination:
    create: true
    name: ${DESTINATION_SECRET_NAME}
    overwrite: ${DESTINATION_OVERWRITE}
  mount: ${KV_MOUNT}
  path: ${KV_PATH}
  refreshAfter: ${REFRESH_AFTER}
  type: ${SECRET_ENGINE_TYPE}
  vaultAuthRef: ${VAULTAUTH_NAME}
EOF2

  sleep "${CHECK_DELAY_SECONDS}"

  echo "Checking the created Kubernetes Secret"
  kubectl get secret -n "${VSO_NAMESPACE}" "${DESTINATION_SECRET_NAME}"
fi
EOF