Automatic Hashicorp Vault Agent installation, configuration and Kubernetes - Hashicorp Vault integration

[erzetpe]

This is integration of Hashicorp Vault with Kubernetes according to design doc: This is installation of Hashicorp Vault, to provide Vault according to design doc: https://github.com/epiphany-platform/epiphany/blob/develop/docs/design-docs/k8s-vault-integration/k8s-vault-integration.md

Test scenario:

1. Build new cluster from scratch
2. Login to Vault using root token from /opt/vault/init.txt:

vault login

3. Add secret to path secret/devwebapp/config:

vault kv put secret/devwebapp/config username='giraffe' password='salsa'

4. Apply test deployment created base on busybox:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: devwebapp
  labels:
    app: devwebapp
spec:
  replicas: 1
  selector:
    matchLabels:
      app: devwebapp
  template:
    metadata:
      labels:
        app: devwebapp
      annotations:
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/role: "devweb-app"
        vault.hashicorp.com/agent-inject-secret-credentials.txt: "secret/data/devwebapp/config"
        vault.hashicorp.com/tls-skip-verify: "true"
    spec:
      serviceAccountName: internal-app
      containers:
      - name: app
        image: busybox
        command:
        - sleep
        - "3600"
        imagePullPolicy: IfNotPresent

5. Check if init container has finished it's work with command:

kubectl logs -f $(kubectl get pods | grep devwebapp | awk '{ print $1 }') -c vault-agent-init

and look for output similar to the one below:

2020/06/25 09:24:49.417623 [INFO] (runner) rendered "(dynamic)" => "/vault/secrets/credentials.txt"
2020/06/25 09:24:49.417657 [INFO] (runner) stopping
2020-06-25T09:24:49.417Z [INFO]  template.server: template server stopped
2020/06/25 09:24:49.417729 [INFO] (runner) received finish

6. Check existence of file /vault/secrets/credentials.txt in container with command:

kubectl exec -ti $(kubectl get pods | grep devwebapp | awk '{ print $1 }') -c app -- cat /vault/secrets/credentials.txt