Vault secret management on Kubernetes with Go
This repository showcases installing a Hashicorp Vault server on Kubernetes for centralized secret management and encryption. It demonstrates how to retrieve a secret from Vault KV v2 secret engine in a Go application that accesses Vault using approle auth. This setup provides a secure method for managing, versioning, and encrypting sensitive data across all applications, with fine-grained access control, all centralized in a Vault server & UI.
Install Vault server on Kubernetes
install Hashicorp Vault helm chart on Kubernetes
helm -n vault install vault hashicorp/vault \
--set "server.resources.requests.memory=256Mi" \
--set "server.resources.requests.cpu=250m" \
--set "server.resources.limits.memory=256Mi" \
--set "server.resources.limits.cpu=250m" \
--set "server.readinessProbe.enabled=true" \
--set "server.readinessProbe.path='/v1/sys/health?standbyok=true&sealedcode=204&uninitcode=204'" \
--set "server.livenessProbe.enabled=true" \
--set "server.livenessProbe.path='/v1/sys/health? standbyok=true'" \
--set "server.livenessProbe.initialDelaySeconds=60" \
--set "ui.enabled=true"
# output
NAME: vault
LAST DEPLOYED: Sat Aug 10 13:11:39 2024
NAMESPACE: vault
STATUS: deployed
REVISION: 1
NOTES:
Thank you for installing HashiCorp Vault!
# pull helm chart locally
helm pull hashicorp/vault --untardir="."
list deployed Vault resources
kubectl -n vault get all
NAME READY STATUS RESTARTS AGE
pod/vault-0 1/1 Running 0 3m50s
pod/vault-agent-injector-ff58f5d77-4n6rh 1/1 Running 0 3m51s
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/vault ClusterIP 10.106.251.84 <none> 8200/TCP,8201/TCP 3m51s
service/vault-agent-injector-svc ClusterIP 10.109.200.74 <none> 443/TCP 3m51s
service/vault-internal ClusterIP None <none> 8200/TCP,8201/TCP 3m51s
service/vault-ui ClusterIP 10.97.149.224 <none> 8200/TCP 3m51s
NAME READY UP-TO-DATE AVAILABLE AGE
deployment.apps/vault-agent-injector 1/1 1 1 3m51s
NAME DESIRED CURRENT READY AGE
replicaset.apps/vault-agent-injector-ff58f5d77 1 1 1 3m51s
NAME READY AGE
statefulset.apps/vault 1/1 3m51s
create an approle auth and a go-app access policy
kubectl -n vault exec -it vault-0 -- sh
/ $ vault auth enable approle
Success! Enabled approle auth method at: approle/
/ $ vault write auth/approle/role/go-app token_policies="go-app" token_ttl=24h token_max_ttl=48h
Success! Data written to: auth/approle/role/go-app
vault policy write go-app - <<EOF
path "go-app/secret/*" {
capabilities = ["read", "list"]
}
EOF
Success! Uploaded policy: go-app
port-forward vault-ui service, and login to access the UI
kubectl -n vault port-forward svc/vault-ui 8200
We can access various secret engines in Vault. I used the KV (Key-Value) engine at the path go-app/secret, other secret engines, such as the Transit engine provides encryption as a service. This can be useful for tasks like encrypting database entries and decrypting them in applications, or even encrypting Kubernetes secrets
Auth methods such as JWT, Kubernetes, username & password, ..., we're using approle for go-app to access Vault
deploy go-app to Kubernetes
apply go-app Kubernetes manifests in kubernetes-manifests/go-app.yaml
kubectl apply -f kubernetes-manifests/go-app.yaml
namespace/apps unchanged
serviceaccount/go-app created
secret/go-app-svca-token created
deployment.apps/go-app created
kubectl -n apps get all
NAME READY STATUS RESTARTS AGE
pod/go-app-868c97f47c-cf64v 1/1 Running 0 7m34s
pod/go-app-868c97f47c-jfvs8 1/1 Running 0 7m34s
pod/go-app-868c97f47c-z4xjm 1/1 Running 0 7m34s
NAME READY UP-TO-DATE AVAILABLE AGE
deployment.apps/go-app 3/3 3 0 7m34s
NAME DESIRED CURRENT READY AGE
replicaset.apps/go-app-868c97f47c 3 3 0 7m34s
kubectl -n apps logs pod/go-app-868c97f47c-cf64v
# username is babbili