siticom/vault-webhook repository overview

⁠vaultenv

A tool to load environment variables and secret files from hashicorp Vault

⁠Kubernetes webhook

The Kubernetes webhook integrates vaultenv into a starting pod. It prepares the environment based on a given Vault secret and starts the application afterwards.

⁠Demo

1. Prepare ./helm-charts/vault-webhook/values.yaml, so that it fits your environment

2. Create a secret with the TLS certificates, start the Vault webhook and enable it

kubectl -n vault create secret generic vault-webhook-tls \
  --from-file=cert.pem=vault-webhook.pem \
  --from-file=key.pem=vault-webhook-key.pem
helm upgrade --install --namespace=kube-system vault-webhook ./helm-charts/vault-webhook --set=caBundle="$(cat ca.pem)"

NOTE: If no webhook pod is ready, Kubernetes can't start new pods in namespaces which are labeled with vaultenv=true.

1. Create the Vault secret and policies

vault kv put kv/example-app env=@demo/env_secret

cat <<EOF | vault policy write example-app -
path "sys/mounts" { capabilities = ["read"] }
path "kv/example-app" { capabilities = ["read"] }
EOF

vault write auth/kubernetes/role/example-app \
    bound_service_account_names=example-app \
    bound_service_account_namespaces=vault-test \
    policies=example-app ttl=1h

1. Create the Kubernetes namespace vault-test, the secret with the Vault CA certificate and deploy the application

kubectl create namespace vault-test
kubectl label namespace vault-test vaultenv="true"
kubectl -n vault-test create secret generic vault-ca --from-file=ca.pem=ca.pem
kubectl apply -f demo/example-app.yml

1. Validate functionality

kubectl -n vault-test logs example-app

⁠Documentation

⁠Vault entry

All variables inside the env key will be loaded before vaultenv starts the application. Moreover the tool supports handling files as well. Every other key in the vault entry will be written to /secret/<key>. If the value starts with !base64 the content will be decoded before, so it's also possilbe to save base64 encoded binary files.

Examples: