Vault-Secrets-Webhook

Inject secrets into pods using BanzaiCloud's Vault-Secrets-Webhook

⚠️ Important:

We do not officially support the vault-secrets-webhook. This guide is a best-effort to help our customers who are not yet ready to transition to the external secrets operator.

# Installation

Install the vault-secrets-webhook using your preferred method, we recommend using the helm chart.

# Configure OpenBao

  1. As an admin, login to your OpenBao instance at https://secrets.<customer-id>.truefullstaq.cloud
  2. In the left-hand menu, click Access
  3. At Authentication methods, click <cluster-name>-k8s
  4. Click Create Role +
  5. Fill in these details:
    • Name: vault-secrets-webhook-role
    • Bound service account names: *
      • This will allow all service accounts to request a token, if desired you can restrict this to specific service accounts
    • Bound service account namespaces: *
      • This will allow service accounts from all namespaces to request a token, if desired you can restrict this to specific namespaces
    • Click
      ⌄
      Tokens       to expand the Token settings
      • Enable Strictly bind to the source IP address
      • Set Generated Token’s Policies to <cluster-name>-k8s-read-policy
        • This will set the policy that is used for the vault-secrets-webhook, you can set this to a different, or multiple policies if desired.
    • Click Save

Do not make changes to the settings of the <cluster-name>-k8s authentication method, nor edit the eso-role role; these are automatically provisioned and changes will get overwritten.

OpenBao is now configured to authorize requests from vault-secrets-webhook.

# Configure annotations

In your workload, make sure to configure these annotations:

metadata:
  annotations:
    vault.security.banzaicloud.io/vault-addr: "https://secrets.<customer-id>.truefullstaq.cloud" # The URL of OpenBao
    vault.security.banzaicloud.io/vault-path: "<cluster-name>-k8s" # This should be the name of the authentication method in OpenBao
    vault.security.banzaicloud.io/vault-role: "vault-secrets-webhook-role" # This should be the same name as the role we created in OpenBao

To inject a secret into an environment variable configure the path like this:

env:
  - name: MY_VARIABLE
    value: "vault:secret/data/clusters/<cluster-name>/my-app/my-secret#my-key"

This will target the KV2 secret engine named secret. Note that the KV2 engine requires to have /data/ in the path of the secret.