PKI Certs Injection to K8s Pods with Vault Agent Injector

Inject PKI Certs Dynamically to Kubernetes Pods using Vault Agent Injector

We will install the official helm chart for the vault and unseal it manually. However, this is not the Ideal way for running a vault in Production. You may want to unseal the vault using a KMS Key ( If being installed in AWS ) or a Google KMS key ( If being installed in GCP ).

Once the helm chart is installed, you should find a Stateful set created with the name vault and also a pod named vault-0 created. However the pod is not in a ready state, it is because the vault is not unsealed yet. Let us now unseal the vault by exec-ing into the Pod.

Let us understand what the init command does

Vault PKI backend can generate its own self-signed CA. But let us create our own CA and then upload it to the vault PKI backed for signing our certificates.

We now have our certificates generated, let us now configure our vault PKI backend to add these certificates as the CA. We will also have to create the vault roles and the vault issuing and CRL URLs.

Let us understand the commands one by one

Now we have our PKI certificate uploaded to the vault. Let us now create a Vault PKI role. The role definition sets the conditions under which a certificate can be generated.

Once we have the role created, we should configure the endpoints from which the certificates can be issued and revoked.

Let us now create a vault policy for the corresponding vault PKI role.

Using Vault Injector with PKI Certificates.

You should now see the certificates and keys present inside the pod. This is how the PKI Certs can be injected automatically without the need for any sidecar or init containers or any other additional changes. So whenever the pod is restarted the certs are automatically regenerated and injected into the Pod.

Cleanup

Related posts:

At great personal cost, doctors of this Nation are demonstrating extraordinary commitment to our wellbeing. This #NationalDoctorsDay, we salute your services & your dedication towards a phenomenal…

HP Pavilion 14 12th Gen Intel Core i7 16GB SDRAM/1TB SSD 14 inch(35.6cm) FHD,IPS,Micro-Edge Display/Intel UHD Graphics/B&O/Win 11 HP Pavilion 14 12th Gen Intel Core i7 16GB SDRAM/1TB SSD 14…

Zinnia is a purpose-built public blockchain protocol, enabling smart contracts, hybrid POW/POS, managed by its participants via Decentralized Autonomous Organizations (DAOs). maybe that’s all because…