Why we should authenticate vault with Kubenetes
When wer ar running our application in Kubenetes pods then we can directly connect vault and pod which will create a token inside the pod at specific location.
So to access the data from vault we need to generate the token with Kubernetes token.
Benefit: The main benefit of this method is that we don't need the static token for vault.
Example
package main import ( "context" "encoding/json" "fmt" "github.com/go-resty/resty/v2" "github.com/hashicorp/go-hclog" "github.com/hashicorp/vault/command/agent/auth" vaultKube "github.com/hashicorp/vault/command/agent/auth/kubernetes" ) // const can be created for these variables var kubeTokenVaulPath = "{{your kubernetes vault token file path}}" var KubeTokenRole = "{{your kube token role}}" var vaultAddr = "{{your vault address}}" var mountPath = "/v1/auth/{{path for Kv}}" type VaultAuth struct { ClientToken string `json:"client_token"` Accessor string `json:"accessor"` } type CredOutput struct { Auth VaultAuth `json:"auth"` } func main() { appLogger := hclog.New(&hclog.LoggerOptions{ Name: "my-app", Level: hclog.LevelFromString("DEBUG"), }) auth, err := vaultKube.NewKubernetesAuthMethod(&auth.AuthConfig{ Logger: appLogger, MountPath: vaultAddr + mountPath, Config: map[string]interface{}{ "role": KubeTokenRole, "token_path": kubeTokenVaulPath, }, }) if err != nil { panic(err) } // this functions returns // path which is the url where we need to request // header it will generate the headers required for the request // body - it will generated the body token request path, header, body, err := auth.Authenticate(context.Background(), nil) if err != nil { panic(err) } fmt.Println(path, header, body) // I am using Resty because direct vault request client was not working client := resty.New() resp, err := client.R(). SetBody(body). Post(path) if err != nil { panic(err) } fmt.Println("output", string(resp.Body())) // creds will be the object where we will get // the token generated for vault to access data creds := CredOutput{} json.Unmarshal(resp.Body(), &creds) fmt.Println("final obj", creds) } We need to define these 4 params in order to generate the token for vault from Kubernetes pods token.
var kubeTokenVaulPath = "{{your kubernetes vault token file path}}" var KubeTokenRole = "{{your kube token role}}" var vaultAddr = "{{your vault address}}" var mountPath = "/v1/auth/{{path for KV}}" mountPath: will be used to generate the token path.
Vault have default path with the name secrets for KV path
I am using Resty client because vault's NewRequest was not working.
Look at how we can use vault's inbuild rawRequest method but wasn't working for me.
Not Recommended As of Now
req := client.NewRequest("POST", path) req.SetJSONBody(output) resp, err := client.RawRequest(req) 
Top comments (0)