mirrors/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2026-05-04 20:06:27 +02:00
Code Issues Projects Releases Wiki Activity

docs/k8s: updated helm doc for short-lived SA tokens (#15675)

Browse Source 
Signed-off-by: Tero Saarni <tero.saarni@est.tech>
This commit is contained in:
Tero Saarni 2023-02-21 14:09:27 +02:00 committed by GitHub
parent 4c11d090cd
commit d189ebf710
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
website/content/docs/platform/k8s/helm/examples/kubernetes-auth.mdx
View File

@ -14,33 +14,19 @@ In this example, we will walk through how to set up the [Kubernetes Auth Method]
This assumes the following commands will be run inside a Vault pod running in Kubernetes.
You will optionally need the following variables:
```bash
# JWT is a service account token that has access to the Kubernetes TokenReview API
# You can retrieve this from inside a pod at: /var/run/secrets/kubernetes.io/serviceaccount/token
JWT=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
# Address of Kubernetes itself as viewed from inside a running pod
KUBERNETES_HOST=https://${KUBERNETES_PORT_443_TCP_ADDR}:443
# Kubernetes internal CA
KUBERNETES_CA_CERT=$(cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt)
```
Exec into the Vault pod:
```bash
kubectl exec -it vault-0 /bin/sh
kubectl exec -it vault-0 -- /bin/sh
```
Then run the following command to configure the Kubernetes Auth Method:
If you didn't set `server.dev.enabled=true`, you'll need to log in to Vault first using `vault login`.
Then run the following commands to configure the Kubernetes Auth Method:
```bash
vault auth enable kubernetes
vault write auth/kubernetes/config \
token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
kubernetes_host=https://${KUBERNETES_PORT_443_TCP_ADDR}:443 \
kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
kubernetes_host=https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT
```
From here you can continue to configure Vault from the [Kubernetes Auth Method](/vault/docs/auth/kubernetes) documentation.