├── .gitignore ├── .github ├── reaction.yml └── lock.yml ├── scripts ├── 02-setup-storage.sh ├── 09-deploy-vault.sh ├── 17-run-kv-sidecar.sh ├── 19-run-db-sidecar.sh ├── 06-create-public-ip.sh ├── 16-create-kv-role.sh ├── 03-setup-kms.sh ├── 01-enable-services.sh ├── kubectl-logs.sh ├── 00-install-vault.sh ├── 10-deploy-lb.sh ├── 13-create-another-cluster.sh ├── 11-setup-comms.sh ├── 05-create-k8s-cluster.sh ├── 14-create-service-account.sh ├── 12-setup-static-kv.sh ├── 08-setup-config.sh ├── 20-cleanup.sh ├── 04-create-iam-service-account.sh ├── 07-create-certs.sh ├── 15-setup-vault-comms-k8s.sh ├── 18-setup-dynamic-creds.sh └── __helpers.sh ├── k8s ├── kv-sidecar.yaml ├── db-sidecar.yaml └── vault.yaml ├── LICENSE └── README.md /.gitignore: -------------------------------------------------------------------------------- 1 | tls/ 2 | -------------------------------------------------------------------------------- /.github/reaction.yml: -------------------------------------------------------------------------------- 1 | reactionComment: false 2 | -------------------------------------------------------------------------------- /.github/lock.yml: -------------------------------------------------------------------------------- 1 | daysUntilLock: 90 2 | lockLabel: false 3 | lockComment: false 4 | -------------------------------------------------------------------------------- /scripts/02-setup-storage.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | set -Eeuo pipefail 3 | 4 | source "$(cd "$(dirname "${0}")" &>/dev/null && pwd)/__helpers.sh" 5 | 6 | gsutil mb -p "$(google-project)" "gs://$(google-project)-vault-storage" 7 | -------------------------------------------------------------------------------- /scripts/09-deploy-vault.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | set -Eeuo pipefail 3 | 4 | source "$(cd "$(dirname "${0}")" &>/dev/null && pwd)/__helpers.sh" 5 | 6 | kubectl apply \ 7 | --cluster="$(gke-cluster-name "vault")" \ 8 | --filename="k8s/vault.yaml" 9 | -------------------------------------------------------------------------------- /scripts/17-run-kv-sidecar.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | set -Eeuo pipefail 3 | 4 | source "$(cd "$(dirname "${0}")" &>/dev/null && pwd)/__helpers.sh" 5 | 6 | kubectl apply \ 7 | --cluster="$(gke-cluster-name "my-apps")" \ 8 | --filename="k8s/kv-sidecar.yaml" 9 | -------------------------------------------------------------------------------- /scripts/19-run-db-sidecar.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | set -Eeuo pipefail 3 | 4 | source "$(cd "$(dirname "${0}")" &>/dev/null && pwd)/__helpers.sh" 5 | 6 | kubectl apply \ 7 | --cluster="$(gke-cluster-name "my-apps")" \ 8 | --filename="k8s/db-sidecar.yaml" 9 | -------------------------------------------------------------------------------- /scripts/06-create-public-ip.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | set -Eeuo pipefail 3 | 4 | source "$(cd "$(dirname "${0}")" &>/dev/null && pwd)/__helpers.sh" 5 | 6 | gcloud compute addresses create vault \ 7 | --project="$(google-project)" \ 8 | --region="$(google-region)" 9 | -------------------------------------------------------------------------------- /scripts/16-create-kv-role.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | set -Eeuo pipefail 3 | 4 | source "$(cd "$(dirname "${0}")" &>/dev/null && pwd)/__helpers.sh" 5 | 6 | vault write auth/kubernetes/role/myapp-role \ 7 | bound_service_account_names="default" \ 8 | bound_service_account_namespaces="default" \ 9 | policies="default,myapp-kv-rw" \ 10 | ttl="15m" 11 | -------------------------------------------------------------------------------- /scripts/03-setup-kms.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | set -Eeuo pipefail 3 | 4 | source "$(cd "$(dirname "${0}")" &>/dev/null && pwd)/__helpers.sh" 5 | 6 | gcloud kms keyrings create vault \ 7 | --project="$(google-project)" \ 8 | --location="$(google-region)" 9 | 10 | gcloud kms keys create vault-init \ 11 | --project="$(google-project)" \ 12 | --location="$(google-region)" \ 13 | --keyring="vault" \ 14 | --purpose="encryption" 15 | -------------------------------------------------------------------------------- /scripts/01-enable-services.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | set -Eeuo pipefail 3 | 4 | source "$(cd "$(dirname "${0}")" &>/dev/null && pwd)/__helpers.sh" 5 | 6 | gcloud services enable \ 7 | --async \ 8 | --project="$(google-project)" \ 9 | cloudapis.googleapis.com \ 10 | cloudkms.googleapis.com \ 11 | cloudresourcemanager.googleapis.com \ 12 | cloudshell.googleapis.com \ 13 | container.googleapis.com \ 14 | containerregistry.googleapis.com \ 15 | iam.googleapis.com 16 | -------------------------------------------------------------------------------- /scripts/kubectl-logs.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | set -Eeuo pipefail 3 | 4 | source "$(cd "$(dirname "${0}")" &>/dev/null && pwd)/__helpers.sh" 5 | 6 | if [ -z "${1:-}" ]; then 7 | echo "Missing pod name!" 8 | exit 1 9 | fi 10 | 11 | POD="$(kubectl get pods \ 12 | --cluster="$(gke-cluster-name "my-apps")" \ 13 | --selector="app=${1}" \ 14 | -o=jsonpath='{.items[0].metadata.name}')" 15 | 16 | kubectl logs "${POD}" -c "app" \ 17 | --context="$(gke-cluster-name "my-apps")" \ 18 | -------------------------------------------------------------------------------- /scripts/00-install-vault.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | set -Eeuo pipefail 3 | 4 | source "$(cd "$(dirname "${0}")" &>/dev/null && pwd)/__helpers.sh" 5 | 6 | echo "--> Unpacking and installing" 7 | docker run -v $HOME/bin:/software sethvargo/hashicorp-installer vault 1.1.2 8 | sudo chown $(whoami):$(whoami) $HOME/bin/vault 9 | sudo chmod +x $HOME/bin/vault 10 | 11 | echo "--> Setting PATH" 12 | export PATH="${PATH}:${HOME}/bin" 13 | 14 | echo "--> Installing completions" 15 | vault -autocomplete-install || true 16 | 17 | echo "--> Done!" 18 | exec $SHELL 19 | -------------------------------------------------------------------------------- /scripts/10-deploy-lb.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | set -Eeuo pipefail 3 | 4 | source "$(cd "$(dirname "${0}")" &>/dev/null && pwd)/__helpers.sh" 5 | 6 | kubectl apply \ 7 | --cluster="$(gke-cluster-name "vault")" \ 8 | --filename=-</dev/null && pwd)/__helpers.sh" 5 | 6 | # Create a cluster to do process namespace sharing 7 | gcloud container clusters create my-apps \ 8 | --project="$(google-project)" \ 9 | --cluster-version="$(gke-latest-master-version)" \ 10 | --enable-autorepair \ 11 | --enable-autoupgrade \ 12 | --enable-ip-alias \ 13 | --machine-type=n1-standard-2 \ 14 | --node-version="$(gke-latest-node-version)" \ 15 | --num-nodes=1 \ 16 | --region="$(google-region)" \ 17 | --scopes="cloud-platform" 18 | -------------------------------------------------------------------------------- /scripts/11-setup-comms.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | set -Eeuo pipefail 3 | 4 | source "$(cd "$(dirname "${0}")" &>/dev/null && pwd)/__helpers.sh" 5 | 6 | export VAULT_CACERT="$(pwd)/tls/ca.crt" 7 | export VAULT_ADDR="https://$(vault-lb-ip):443" 8 | export VAULT_TOKEN="$(gsutil cat "gs://$(google-project)-vault-storage/root-token.enc" | \ 9 | base64 --decode | \ 10 | gcloud kms decrypt \ 11 | --project="$(google-project)" \ 12 | --location="$(google-region)" \ 13 | --keyring="vault" \ 14 | --key="vault-init" \ 15 | --ciphertext-file - \ 16 | --plaintext-file -)" 17 | 18 | export PATH="${PATH}:${HOME}/bin" 19 | 20 | alias vualt=vault 21 | 22 | exec $SHELL 23 | -------------------------------------------------------------------------------- /scripts/05-create-k8s-cluster.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | set -Eeuo pipefail 3 | 4 | source "$(cd "$(dirname "${0}")" &>/dev/null && pwd)/__helpers.sh" 5 | 6 | SERVICE_ACCOUNT="vault-server@$(google-project).iam.gserviceaccount.com" 7 | 8 | gcloud container clusters create vault \ 9 | --project="$(google-project)" \ 10 | --cluster-version="$(gke-latest-master-version)" \ 11 | --enable-autorepair \ 12 | --enable-autoupgrade \ 13 | --enable-ip-alias \ 14 | --machine-type="n1-standard-2" \ 15 | --node-version="$(gke-latest-node-version)" \ 16 | --num-nodes="1" \ 17 | --region="$(google-region)" \ 18 | --scopes="cloud-platform" \ 19 | --service-account="${SERVICE_ACCOUNT}" 20 | -------------------------------------------------------------------------------- /scripts/14-create-service-account.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | set -Eeuo pipefail 3 | 4 | source "$(cd "$(dirname "${0}")" &>/dev/null && pwd)/__helpers.sh" 5 | 6 | kubectl create serviceaccount vault-auth \ 7 | --cluster="$(gke-cluster-name "my-apps")" 8 | 9 | kubectl apply \ 10 | --cluster="$(gke-cluster-name "my-apps")" \ 11 | --filename=-</dev/null && pwd)/__helpers.sh" 5 | 6 | # Enable kv secrets engine - this used to be enabled by default at secret/, but 7 | # that's not the case anymore. 8 | vault secrets enable kv 9 | 10 | # This creates a policy that allows reading, writing, and deleting from anything 11 | # under "myapp" in the kv secrets engine just created. This policy still must 12 | # be attached to tokens in order to receive the permission(s). 13 | vault policy write myapp-kv-rw - </dev/null && pwd)/__helpers.sh" 5 | 6 | DIR="$(pwd)/tls" 7 | 8 | kubectl create configmap vault \ 9 | --cluster="$(gke-cluster-name "vault")" \ 10 | --from-literal="load_balancer_address=$(vault-lb-ip)" \ 11 | --from-literal="gcs_bucket_name=$(google-project)-vault-storage" \ 12 | --from-literal="kms_project=$(google-project)" \ 13 | --from-literal="kms_region=$(google-region)" \ 14 | --from-literal="kms_key_ring=vault" \ 15 | --from-literal="kms_crypto_key=vault-init" \ 16 | --from-literal="kms_key_id=projects/$(google-project)/locations/$(google-region)/keyRings/vault/cryptoKeys/vault-init" 17 | 18 | kubectl create secret generic vault-tls \ 19 | --cluster="$(gke-cluster-name "vault")" \ 20 | --from-file="${DIR}/ca.crt" \ 21 | --from-file="vault.crt=${DIR}/vault-combined.crt" \ 22 | --from-file="vault.key=${DIR}/vault.key" 23 | -------------------------------------------------------------------------------- /scripts/20-cleanup.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | set -Eeuo pipefail 3 | 4 | source "$(cd "$(dirname "${0}")" &>/dev/null && pwd)/__helpers.sh" 5 | 6 | SERVICE_ACCOUNT="vault-server@$(google-project).iam.gserviceaccount.com" 7 | 8 | kubectl delete deployment kv-sidecar \ 9 | --cluster="$(gke-cluster-name "my-apps")" \ 10 | --force \ 11 | --grace-period=0 12 | 13 | kubectl delete deployment sa-sidecar \ 14 | --cluster="$(gke-cluster-name "my-apps")" \ 15 | --force \ 16 | --grace-period=0 17 | 18 | gcloud container clusters delete my-apps \ 19 | --async \ 20 | --quiet \ 21 | --project="$(google-project)" \ 22 | --region="$(google-region)" 23 | 24 | vault lease revoke -prefix gcp/ 25 | 26 | kubectl delete service vault \ 27 | --cluster="$(gke-cluster-name "vault")" 28 | 29 | kubectl delete statefulsets vault \ 30 | --cluster="$(gke-cluster-name "vault")" \ 31 | --grace-period=0 \ 32 | --force 33 | 34 | gcloud container clusters delete vault \ 35 | --async \ 36 | --quiet \ 37 | --project="$(google-project)" \ 38 | --region="$(google-region)" 39 | 40 | gcloud compute addresses delete vault \ 41 | --quiet \ 42 | --project="$(google-project)" \ 43 | --region="$(google-region)" 44 | 45 | gcloud iam service-accounts delete "${SERVICE_ACCOUNT}" \ 46 | --quiet \ 47 | --project="$(google-project)" 48 | 49 | gsutil -m rm -rf "gs://$(google-project)-vault-storage" 50 | gsutil rb -f "gs://$(google-project)-vault-storage" 51 | -------------------------------------------------------------------------------- /scripts/04-create-iam-service-account.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | set -Eeuo pipefail 3 | 4 | source "$(cd "$(dirname "${0}")" &>/dev/null && pwd)/__helpers.sh" 5 | 6 | SERVICE_ACCOUNT="vault-server@$(google-project).iam.gserviceaccount.com" 7 | 8 | # Create the service account 9 | gcloud iam service-accounts create vault-server \ 10 | --project="$(google-project)" \ 11 | --display-name="vault server" 12 | 13 | # (Optional) grant the service account the ability to generate new service 14 | # accounts. This is required to use the Vault GCP secrets engine, otherwise it 15 | # can be omitted. 16 | ROLES=( 17 | "roles/resourcemanager.projectIamAdmin" 18 | "roles/iam.serviceAccountAdmin" 19 | "roles/iam.serviceAccountKeyAdmin" 20 | "roles/iam.serviceAccountTokenCreator" 21 | "roles/iam.serviceAccountUser" 22 | "roles/viewer" 23 | ) 24 | for role in "${ROLES[@]}"; do 25 | gcloud projects add-iam-policy-binding "$(google-project)" \ 26 | --member "serviceAccount:${SERVICE_ACCOUNT}" \ 27 | --role "${role}" 28 | done 29 | 30 | # Grant the service account the ability to read and write objects in our storage 31 | # bucket 32 | gsutil iam ch \ 33 | "serviceAccount:${SERVICE_ACCOUNT}:objectAdmin" \ 34 | "serviceAccount:${SERVICE_ACCOUNT}:legacyBucketReader" \ 35 | "gs://$(google-project)-vault-storage" 36 | 37 | # Grant the service account the ability to access the Cloud KMS crypto key 38 | gcloud kms keys add-iam-policy-binding vault-init \ 39 | --project="$(google-project)" \ 40 | --location="$(google-region)" \ 41 | --keyring="vault" \ 42 | --member="serviceAccount:${SERVICE_ACCOUNT}" \ 43 | --role="roles/cloudkms.cryptoKeyEncrypterDecrypter" 44 | -------------------------------------------------------------------------------- /scripts/07-create-certs.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | set -Eeuo pipefail 3 | 4 | source "$(cd "$(dirname "${0}")" &>/dev/null && pwd)/__helpers.sh" 5 | 6 | LB_IP="$(vault-lb-ip)" 7 | 8 | DIR="$(pwd)/tls" 9 | 10 | rm -rf "${DIR}" 11 | mkdir -p "${DIR}" 12 | 13 | # Create the conf file 14 | cat > "${DIR}/openssl.cnf" << EOF 15 | [req] 16 | default_bits = 2048 17 | encrypt_key = no 18 | default_md = sha256 19 | prompt = no 20 | utf8 = yes 21 | 22 | distinguished_name = req_distinguished_name 23 | req_extensions = v3_req 24 | 25 | [req_distinguished_name] 26 | C = US 27 | ST = California 28 | L = The Cloud 29 | O = Demo 30 | CN = vault 31 | 32 | [v3_req] 33 | basicConstraints = CA:FALSE 34 | subjectKeyIdentifier = hash 35 | keyUsage = digitalSignature, keyEncipherment 36 | extendedKeyUsage = clientAuth, serverAuth 37 | subjectAltName = @alt_names 38 | 39 | [alt_names] 40 | IP.1 = ${LB_IP} 41 | DNS.1 = vault.default.svc.cluster.local 42 | EOF 43 | 44 | # Generate Vault's certificates and a CSR 45 | openssl genrsa -out "${DIR}/vault.key" 2048 46 | 47 | openssl req \ 48 | -new -key "${DIR}/vault.key" \ 49 | -out "${DIR}/vault.csr" \ 50 | -config "${DIR}/openssl.cnf" 51 | 52 | # Create our CA 53 | openssl req \ 54 | -new \ 55 | -newkey rsa:2048 \ 56 | -days 120 \ 57 | -nodes \ 58 | -x509 \ 59 | -subj "/C=US/ST=California/L=The Cloud/O=Vault CA" \ 60 | -keyout "${DIR}/ca.key" \ 61 | -out "${DIR}/ca.crt" 62 | 63 | # Sign CSR with our CA 64 | openssl x509 \ 65 | -req \ 66 | -days 120 \ 67 | -in "${DIR}/vault.csr" \ 68 | -CA "${DIR}/ca.crt" \ 69 | -CAkey "${DIR}/ca.key" \ 70 | -CAcreateserial \ 71 | -extensions v3_req \ 72 | -extfile "${DIR}/openssl.cnf" \ 73 | -out "${DIR}/vault.crt" 74 | 75 | # Export combined certs for vault 76 | cat "${DIR}/vault.crt" "${DIR}/ca.crt" > "${DIR}/vault-combined.crt" 77 | -------------------------------------------------------------------------------- /scripts/15-setup-vault-comms-k8s.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | set -Eeuo pipefail 3 | 4 | source "$(cd "$(dirname "${0}")" &>/dev/null && pwd)/__helpers.sh" 5 | 6 | DIR="$(pwd)/tls" 7 | 8 | # Get the name of the secret corresponding to the service account 9 | SECRET_NAME="$(kubectl get serviceaccount vault-auth \ 10 | --cluster="$(gke-cluster-name "my-apps")" \ 11 | -o go-template='{{ (index .secrets 0).name }}')" 12 | 13 | # Get the actual token reviewer account 14 | TR_ACCOUNT_TOKEN="$(kubectl get secret ${SECRET_NAME} \ 15 | --cluster="$(gke-cluster-name "my-apps")" \ 16 | -o go-template='{{ .data.token }}' | base64 --decode)" 17 | 18 | # Get the host for the cluster (IP address) 19 | K8S_HOST="$(kubectl config view --raw \ 20 | -o go-template="{{ range .clusters }}{{ if eq .name \"$(gke-cluster-name "my-apps")\" }}{{ index .cluster \"server\" }}{{ end }}{{ end }}")" 21 | 22 | # Get the CA for the cluster 23 | K8S_CACERT="$(kubectl config view --raw \ 24 | -o go-template="{{ range .clusters }}{{ if eq .name \"$(gke-cluster-name "my-apps")\" }}{{ index .cluster \"certificate-authority-data\" }}{{ end }}{{ end }}" | base64 --decode)" 25 | 26 | # Enable the Kubernetes auth method 27 | vault auth enable kubernetes 28 | 29 | # Configure Vault to talk to our Kubernetes host with the cluster's CA and the 30 | # correct token reviewer JWT token 31 | vault write auth/kubernetes/config \ 32 | kubernetes_host="${K8S_HOST}" \ 33 | kubernetes_ca_cert="${K8S_CACERT}" \ 34 | token_reviewer_jwt="${TR_ACCOUNT_TOKEN}" 35 | 36 | # Create a config map to store the vault address 37 | kubectl create configmap vault \ 38 | --cluster="$(gke-cluster-name "my-apps")" \ 39 | --from-literal "vault_addr=https://$(vault-lb-ip)" 40 | 41 | # Create a secret for our CA 42 | kubectl create secret generic vault-tls \ 43 | --cluster="$(gke-cluster-name "my-apps")" \ 44 | --from-file "${DIR}/ca.crt" 45 | -------------------------------------------------------------------------------- /scripts/18-setup-dynamic-creds.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | set -Eeuo pipefail 3 | 4 | source "$(cd "$(dirname "${0}")" &>/dev/null && pwd)/__helpers.sh" 5 | 6 | # Create CloudSQL instance 7 | gcloud sql instances create my-instance \ 8 | --project="$(google-project)" \ 9 | --activation-policy="always" \ 10 | --authorized-networks="0.0.0.0/0" \ 11 | --database-version="MYSQL_5_7" \ 12 | --no-backup \ 13 | --region="$(google-region)" \ 14 | --tier="db-n1-standard-1" 15 | 16 | INSTANCE_IP="$(gcloud sql instances describe my-instance --project="$(google-project)" --format='value(ipAddresses[0].ipAddress)')" 17 | 18 | # Change password 19 | gcloud sql users set-password root \ 20 | --project="$(google-project)" \ 21 | --host="%" \ 22 | --instance="my-instance" \ 23 | --password="my-password" 24 | 25 | # Enable the gcp secrets engine 26 | vault secrets enable database 27 | 28 | # Configure the database secrets engine TTLs 29 | vault write database/config/my-cloudsql-db \ 30 | plugin_name="mysql-database-plugin" \ 31 | connection_url="{{username}}:{{password}}@tcp(${INSTANCE_IP}:3306)/" \ 32 | allowed_roles="readonly" \ 33 | username="root" \ 34 | password="my-password" 35 | 36 | # Rotate the root cred 37 | vault write -f database/rotate-root/my-cloudsql-db 38 | 39 | # Create a role which will create a readonly user 40 | vault write database/roles/readonly \ 41 | db_name="my-cloudsql-db" \ 42 | creation_statements="CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}'; GRANT SELECT ON *.* TO '{{name}}'@'%';" \ 43 | default_ttl="1h" \ 44 | max_ttl="24h" 45 | 46 | # Create a new policy which allows generating these dynamic credentials 47 | vault policy write myapp-db-r -</dev/null 48 | ) 49 | } 50 | 51 | # gke-latest-node-version returns the latest GKE node version. 52 | gke-latest-node-version() { 53 | ( 54 | set -Eeuo pipefail 55 | 56 | gcloud container get-server-config \ 57 | --project="$(google-project)" \ 58 | --region="$(google-region)" \ 59 | --format='value(validNodeVersions[0])' \ 60 | 2>/dev/null 61 | ) 62 | } 63 | 64 | vault-lb-ip() { 65 | ( 66 | set -Eeuo pipefail 67 | 68 | gcloud compute addresses describe vault \ 69 | --project="$(google-project)" \ 70 | --region="$(google-region)" \ 71 | --format='value(address)' 72 | ) 73 | } 74 | -------------------------------------------------------------------------------- /k8s/kv-sidecar.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | apiVersion: apps/v1 3 | kind: Deployment 4 | metadata: 5 | name: kv-sidecar 6 | labels: 7 | app: kv-sidecar 8 | spec: 9 | replicas: 1 10 | selector: 11 | matchLabels: 12 | app: kv-sidecar 13 | template: 14 | metadata: 15 | labels: 16 | app: kv-sidecar 17 | spec: 18 | volumes: 19 | - name: secrets 20 | emptyDir: {} 21 | - name: vault-tls 22 | secret: 23 | secretName: vault-tls 24 | - name: vault-token 25 | emptyDir: 26 | medium: Memory 27 | 28 | securityContext: 29 | runAsUser: 1000 30 | runAsGroup: 1000 31 | 32 | initContainers: 33 | # The vault-authenticator container authenticates the container using the 34 | # kubernetes auth method and puts the resulting token on the filesystem. 35 | - name: vault-authenticator 36 | image: sethvargo/vault-kubernetes-authenticator:0.2.0 37 | imagePullPolicy: IfNotPresent 38 | volumeMounts: 39 | - name: vault-token 40 | mountPath: /var/run/secrets/vaultproject.io 41 | - name: vault-tls 42 | mountPath: /etc/vault/tls 43 | env: 44 | - name: VAULT_ADDR 45 | valueFrom: 46 | configMapKeyRef: 47 | name: vault 48 | key: vault_addr 49 | - name: VAULT_CACERT 50 | value: /etc/vault/tls/ca.crt 51 | - name: VAULT_ROLE 52 | value: myapp-role 53 | 54 | containers: 55 | # The consul-template container will pull secrets from Vault and expose 56 | # them as files on disk. 57 | - name: consul-template 58 | image: hashicorp/consul-template:0.20.0-light 59 | imagePullPolicy: IfNotPresent 60 | volumeMounts: 61 | - name: secrets 62 | mountPath: /etc/secrets 63 | - name: vault-tls 64 | mountPath: /etc/vault/tls 65 | - name: vault-token 66 | mountPath: /var/run/secrets/vaultproject.io 67 | env: 68 | - name: VAULT_ADDR 69 | valueFrom: 70 | configMapKeyRef: 71 | name: vault 72 | key: vault_addr 73 | - name: VAULT_CACERT 74 | value: /etc/vault/tls/ca.crt 75 | - name: CT_LOCAL_CONFIG 76 | value: | 77 | vault { 78 | vault_agent_token_file = "/var/run/secrets/vaultproject.io/.vault-token" 79 | 80 | ssl { 81 | ca_cert = "/etc/vault/tls/ca.crt" 82 | } 83 | 84 | retry { 85 | backoff = "1s" 86 | } 87 | } 88 | 89 | template { 90 | contents = <