Inject license from Hashicorp Vault via pod annotations

In this knowledge base article, we set up Hashicorp Vault and injector service with the Hashicorp Vault Helm chart and store a HiveMQ License as a secret. Then we will deploy the HiveMQ broker cluster with the hivemq-operator Helm chart to demonstrate how the Hashicorp Vault injector service retrieves, decodes and writes the secret to /opt/hivemq/license/hivmq.lic file on the pod for the HiveMQ application to use.

Prerequisites

These instructions require the following tools on the local machine:

• Kubernetes command-line interface (CLI)

• Helm CLI

The kubectl context should be set to the Kubernetes cluster where the HiveMQ broker will be installed.

 Instructions

Install the Hashicorp Vault Helm Chart

1. Add the HashiCorp Helm repository.

   $ helm repo add hashicorp https://helm.releases.hashicorp.com "hashicorp" has been added to your repositories

2. Update all the repositories to ensure helm is aware of the latest versions.

   $ helm repo update hashicorp Hang tight while we grab the latest from your chart repositories... ...Successfully got an update from the "hashicorp" chart repository Update Complete. ⎈Happy Helming!⎈

3. Install the latest version of the Hashicorp Vault server running in development mode.
   Development mode: Running a Hashicorp Vault server in development is automatically initialized and unsealed. This is ideal in a learning environment but NOT recommended for a production environment.

   $ helm install Hashicorp Vault hashicorp/Hashicorp Vault --set "server.dev.enabled=true" NAME: Hashicorp Vault ## ...

   The Hashicorp Vault pod and Hashicorp Vault Agent Injector pod are deployed in the default namespace.

4. Display all the pods in the default namespace.

   The Hashicorp Vault-0 pod runs a Hashicorp Vault server in development mode. The Hashicorp Vault-agent-injector pod performs the injection based on the annotations present or patched on a deployment.
   
   

5. Wait until the Hashicorp Vault-0 pod and Hashicorp Vault-agent-injector pod are running and ready (1/1).

Set a secret in Hashicorp Vault

1. Copy the hivemq-license file to the Hashicorp Vault-0 pod.

2. Verify that the file is copied.

3. Start an interactive shell session on the Hashicorp Vault-0 pod.

   Your system prompt is replaced with a new prompt / $. Commands issued at this prompt are executed on the Hashicorp Vault-0 container.

4. Enable kv-v2 secrets at the path hivemq.

5. Create a secret at path hivemq/myenv/license with a hivemq_license_b64 key and base64-encoded /tmp/hivemq.lic file.

6. Verify that the secret is defined at the path hivemq/myenv/license.

   The secret is ready for the application.

7. Lastly, exit the Hashicorp Vault-0 pod.

Configure Kubernetes authentication

Hashicorp Vault provides a Kubernetes authentication method that enables clients to authenticate with a Kubernetes Service Account Token. This token is provided to each pod when it is created.

1. Start an interactive shell session on the Hashicorp Vault-0 pod.

   Your system prompt is replaced with a new prompt / $. Commands issued at this prompt are executed on the Hashicorp Vault-0 container.

2. Enable the Kubernetes authentication method.

   Hashicorp Vault accepts a service token from any client in the Kubernetes cluster. During authentication, Hashicorp Vault verifies that the service account token is valid by querying a token review Kubernetes endpoint.

3. Configure the Kubernetes authentication method to use the location of the Kubernetes API.

   Note: For the best compatibility with recent Kubernetes versions, ensure you are using Hashicorp Vault v1.13.3 or greater.

   Successful output from the command resembles this example:

   The environment variable KUBERNETES_PORT_443_TCP_ADDR is defined and references the internal network address of the Kubernetes host.

   For a client to read the secret data defined at hivemq/myenv/license, requires that the read capability be granted for the path hivemq/data/myenv/license. This is an example of a policy. A policy defines a set of capabilities.

4. Write out the policy named hivemq that enables the read capability for secrets at path hivemq/data/myenv/license.

5. Create a Kubernetes authentication role named hivemq.

   Successful output from the command resembles this example:

   The role connects the Kubernetes service account, hivemq-hivemq-operator-hivemq, and namespace, hivemq, with the Hashicorp Vault policy, hivemq. The tokens returned after authentication are valid for 24 hours.

6. Lastly, exit the Hashicorp Vault-0 pod.

Inject secrets into the pods

1. If you do not have values.yaml file yet, you can get the latest version from the Helm chart repository and store it as a file, for example, values-hivemq.yaml:

2. Edit the values-hivemq.yaml file. Add annotations to the hivemq pods.

3. (Re)install hivemq

4. Get all the pods in the hivemq namespace.

   Wait until the re-deployed hivemq pod reports that it is Running and ready (2/2).

   This new pod now launches two containers. The application container, named hivemq, and the Hashicorp Vault Agent container, named Hashicorp Vault-agent.
   
   

5. Display the logs of the Hashicorp Vault-agent container in the new hivemq pod.

   Hashicorp Vault Agent manages the token lifecycle and the secret retrieval. The secret is rendered in the hivemq container at the path /opt/hivemq/license/.

6. Display the secret written to the hivemq container.

   The base64-decoded secret data is present on the container

 Related articles

https://developer.hashicorp.com/vault/tutorials/kubernetes/kubernetes-sidecar?ajs_aid=f51d5b2f-f5e5-4e88-8689-d479a67a2ae8&product_intent=vault#inject-secrets-into-the-pod