[DevOps] Vault Sidecar: 對 Pod 注入 Vault 變數 (EKS 環境)

$ git clone https://github.com/hashicorp/vault-helm
$ helm install vault --set='server.dev.enabled=true' ./vault-helm

$ kubectl exec -ti vault-0 /bin/sh 

# prepare the policy.hcl
$ vault policy write app app-policy.hcl
# allow vault to communicate with kubernetes
$ vault auth enable kubernetes
$ vault write auth/kubernetes/config \
   token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
   kubernetes_host=https://${KUBERNETES_PORT_443_TCP_ADDR}:443 \
   kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
$ vault write auth/kubernetes/role/myapp \
   bound_service_account_names=app \
   bound_service_account_namespaces=demo \
   policies=app \
   ttl=1h

path "secret*" {
  capabilities = ["read"]
}

$ kubectl port-forward vault-0 8200:8200
$ export VAULT_ADDR="http://127.0.0.1:8200"
$ export VAULT_TOKEN="root" # default token
$ vault kv put secret/helloworld username=foobaruser password=foobarbazpass

apiVersion: apps/v1
kind: Deployment
metadata:
  name: app
  labels:
    app: vault-agent-demo
spec:
  selector:
    matchLabels:
      app: vault-agent-demo
  replicas: 1
  template:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/agent-inject-status: "update"
        vault.hashicorp.com/agent-inject-secret-helloworld: "secret/helloworld"
        vault.hashicorp.com/agent-inject-template-helloworld: |
          {{- with secret "secret/helloworld" -}}
          postgresql://{{ .Data.data.username }}:{{ .Data.data.password }}@postgres:5432/wizard
          {{- end }}          
        vault.hashicorp.com/role: "myapp"
      labels:
        app: vault-agent-demo
    spec:
      serviceAccountName: app
      containers:
      - name: app
        image: jweissig/app:0.0.1
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: app
  labels:
    app: vault-agent-demo

# patch-template-annotations.yaml
spec:
  template:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/agent-inject-status: "update"
        vault.hashicorp.com/agent-inject-secret-helloworld: "secret/helloworld"
        vault.hashicorp.com/agent-inject-template-helloworld: |
          {{- with secret "secret/helloworld" -}}
          postgresql://{{ .Data.data.username }}:{{ .Data.data.password }}@postgres:5432/wizard
          {{- end }}          
        vault.hashicorp.com/role: "myapp"

$ kubectl apply -f app.yaml
$ kubectl patch deployment app --patch "$(cat patch-template-annotations.yaml)"
$ kubectl exec -ti app-XXXXXXXXX -c app -- cat /vault/secrets/helloworld 
# 輸出:postgresql://foobaruser:foobarbazpass@postgres:5432/wizard