Skip to content

Latest commit

 

History

History
74 lines (46 loc) · 3.24 KB

deployment-guide.md

File metadata and controls

74 lines (46 loc) · 3.24 KB
Raw

Deployment Guide

This guide will walk you through deploying the Kubernetes Secret Manager.

Deploying

MySQL

MySQL is the backend used to demonstrate how to get user accounts dynamically from Vault.

kubectl create -f deployments/mysql.yaml

Vault

This project uses Vault from Hashicorp as it's secret backend to dynamically create secrets. A sample Vault deployment is included which should only be utilized as a proof of concept, it is not intended for a production use.

kubectl create -f deployments/vault.yaml

The sample Vault instance included in this project will be running in developer mode which will not require unsealing, however, it will still need to be configured with some policies we'll use later in the demo.

kubectl exec -it <podName> /bin/dumb-init /bin/sh
> setup-vault.sh

Running the above command (setup-vault.sh) will do a couple things. First it will create a mysql backend and write some policies to allow us to request credentials from the MySQL server. Also, it will write a sample static secret which will let us mirror that secret as a Kubernetes secret.

Vault Configuration

The setup-vault.sh script creates some default policies which are configured in the file myapp.hcl.

Custom ThirdPartyResource

A custom ThirdPartyResource is required and is automatically created by the controller.

Secret-Manager

The secret manager does all the work of talking to Vault to pull out secrets and managing the life of those secrets.

  1. Get the root token of the Vault instance: kubectl logs -f <vaultPodName>

Sample-App

Once the ThirdPartyResource is created you can create the custom object which utilized this new resource as well a the sample application:

kubectl create -f sample-app/deployments/sample-app.yaml

In the sample app yaml file outlines the following config parameters:

  • secret: Name of the secret to create in Kubernetes
  • policy: Policy to request from Vault

Test it out!

To see the sample-app webpage, find the nodeport of the service: kubectl describe svc sample-app

Accessing the sample webpage it will print out the username / password to the screen. Use that to connect to MySQL. When the max lease duration expires, the controller will rotate the token in vault and the app should automatically update.

Static Secrets

It's possible to pull secrets using the Generic backend.

  1. Export your vault token: export VAULT_TOKEN=b3b8e136-18e8-c286-5c80-e9d62f790814
  2. Post to vault a secret: curl -X POST -H "X-Vault-Token:$VAULT_TOKEN" -d '{"bar":"baz"}' http://192.168.64.25:30619/v1/secret/foo
  3. Verify: curl -X GET -H "X-Vault-Token:$VAULT_TOKEN" http://192.168.64.25:30619/v1/secret/foo | jq .
  4. Deploy app: `kubectl create -f sample-app/deployments/static-secrets.yaml
  5. Verify: kubectl exec -it <podname> cat /secrets/bar (Outputs: baz)