Skip to content

Integration of OpenShift, PostgresSQL, HashiCorps Vault and Spring Cloud

License

Notifications You must be signed in to change notification settings

natronq/openshift-vault

Repository files navigation

Vault integration with OpenShift and Spring Cloud

This repository demonstrates how to deploy HashiCorps Vault on OpenShift and leverage service accounts with Spring Cloud to claim database credentials dynamically from the Vault.

Getting started

  1. Create a project

    $ oc new-project secret-management
  2. Deploy a database and HashiCorp's Vault

    $ ./deploy-vault.sh
    
    Deploying PostgreSQL...
    --> Deploying template "openshift/postgresql-persistent" to project secret-management
    [....]
    Deploying Vault...
    scc "anyuid" added to: ["system:serviceaccount:secret-management:default"]
    configmap "vault-config" created
    service "vault" created
    deploymentconfig "vault" created
    persistentvolumeclaim "vault-file-backend" created
    route "vault" created
  3. Initialize and unseal vault

    $ export VAULT_ADDR="https://$(oc get route vault -o jsonpath={.spec.host})"
    $ vault operator init -tls-skip-verify -key-shares=1 -key-threshold=1
    
    Unseal Key 1: t7grHZRi8dLcNDe04X8KcuixjEdzR5xXmpXE1N2TUo4=
    
    Initial Root Token: f4949362-6e88-0980-c604-51ce7d62c4eb
    
    Vault initialized with 1 key shares and a key threshold of 1. Please securely
    distribute the key shares printed above. When the Vault is re-sealed,
    restarted, or stopped, you must supply at least 1 of these keys to unseal it
    before it can start servicing requests.
    
    Vault does not store the generated master key. Without at least 1 key to
    reconstruct the master key, Vault will remain permanently sealed!
    
    It is possible to generate new unseal keys, provided you have a quorum of
    existing unseal keys shares. See "vault rekey" for more information.

    Take not of the generated key and root token and export them as environment variables to unseal the vault.

    $ export KEYS=t7grHZRi8dLcNDe04X8KcuixjEdzR5xXmpXE1N2TUo4=
    $ export ROOT_TOKEN=f4949362-6e88-0980-c604-51ce7d62c4eb
    $ vault operator unseal -tls-skip-verify $KEYS
    
    Key             Value
    ---             -----
    Seal Type       shamir
    Sealed          false
    Total Shares    1
    Threshold       1
    Version         0.9.5
    Cluster Name    vault-cluster-e566d4ca
    Cluster ID      369a2073-8480-f8e1-cb30-a059fcc7e650
    HA Enabled      false
  4. Configure vault

    $ vault login -tls-skip-verify $ROOT_TOKEN 
    $ ./init-vault.sh
    
    Creating service account for Vault...
    serviceaccount "vault-auth" created
    cluster role "system:auth-delegator" added: "vault-auth"
    Enabling kubernetes auth backend...
    Success! Enabled kubernetes auth method at: kubernetes/
    Success! Data written to: auth/kubernetes/config
    Creating sample policy with name 'backend'
    WARNING! The "vault policy-write" command is deprecated. Please use "vault
    policy write" instead. This command will be removed in Vault 0.11 (or later).
    
    Success! Uploaded policy: backend
    Creating sample role with name 'backend' bound to namespace 'secret-management'
    Success! Data written to: auth/kubernetes/role/backend
    Enabling postgres backend...
    Success! Enabled the database secrets engine at: database/
    WARNING! The following warnings were returned from Vault:
    
    * Read access to this endpoint should be controlled via ACLs as it will
    return the connection details as is, including passwords, if any.
    
    Success! Data written to: database/roles/backend
    Writing sample secret...
    Success! Data written to: secret/backend
  5. Deploy sample application

    ./deploy-app.sh
    
    Deploying sample application...
    service "spring-sample-app" created
    deploymentconfig "spring-sample-app" created
    route "spring-sample-app" exposed
  6. Test the integration

    $ ./test.sh
    
    Testing vault integration...
    Key                                       Value
    ---                                       -----
    token                                     a476fa24-bebd-7b38-c9c2-4483e6722958
    token_accessor                            898921e3-1081-b353-5c34-824ef7bea809
    token_duration                            2h
    token_renewable                           true
    token_policies                            [backend default]
    token_meta_role                           backend
    token_meta_service_account_name           default
    token_meta_service_account_namespace      secret-management
    token_meta_service_account_secret_name    default-token-mqknc
    token_meta_service_account_uid            d88455df-2779-11e8-9d97-06f99210ef0e
    {"status":"UP"}my secret ispwd{"id":null,"value":"40","respText":"Success"}%

About

Integration of OpenShift, PostgresSQL, HashiCorps Vault and Spring Cloud

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published