Vault-CRD
  • Introduction
  • How does Vault-CRD work?
  • Supported Secret Types
    • Secret Type - KEYVALUE
    • Secret Type - KEYVALUEV2
    • Secret Type - PKI
    • Secret Type - PKIJKS
    • Secret Type - CERT
    • Secret Type - CERTJKS
    • Secret Type - DOCKERCFG
    • Secret Type - PROPERTIES
  • Change Detection
  • Install Vault-CRD
    • Self Signed Certificates
    • Enable Admission Webhook
Powered by GitBook
On this page
  • How To
  • Supported Values in pkiConfiguration
  • Change Adjustment Callback
  1. Supported Secret Types

Secret Type - PKI

PreviousSecret Type - KEYVALUEV2NextSecret Type - PKIJKS

Last updated 4 years ago

The PKI-Type is made to connect to the PKI - Secrets Engine of . It generates certificates X.509 Certificates and refreshes them if they are near the expiration date.

How To

First generate a PKI in Vault and create a rule to issue new certificates:

This is only a test pki, for info how to generate a more secure pki please read the manual of HashiCorp Vault!

$ vault secrets enable -path=testpki -description=testpki pki
$ vault secrets tune -max-lease-ttl=8760h testpki
$ vault write testpki/root/generate/internal \
      common_name=koudingspawn.de \
      ttl=500h
$ vault write testpki/roles/testrole \
      allowed_domains=*.koudingspawn.de \
      max_ttl=8760h

After this create the following Vault-Resource and apply it to Kubernetes:

apiVersion: "koudingspawn.de/v1"
kind: Vault
metadata:
  name: test-pki
spec:
  path: "testpki/issue/testrole"
  type: "PKI"
  pkiConfiguration:
    commonName: "vault.koudingspawn.de"
    ttl: "8h"
$ kubectl get vault test-pki
NAME       AGE
test-pki   8d
$ kubectl get secret test-pki
NAME       TYPE      DATA      AGE
test-pki   Opaque    2         8d
$ kubectl get secret test-pki -o yaml
apiVersion: v1
data:
  tls.crt: <certificate>
  tls.key: <key>
kind: Secret
metadata:
  annotations:
    vault.koudingspawn.de/compare: 2018-04-13T22:38Z
    vault.koudingspawn.de/lastUpdated: 2018-04-14T00:31:42.889
  creationTimestamp: 2018-04-13T22:16:03Z
  name: test-pki
  namespace: default
  resourceVersion: "1791800"
  selfLink: /api/v1/namespaces/default/secrets/test-pki
  uid: 40eaddf8-3f68-11e8-8433-b2b7401505d0
type: Opaque

Supported Values in pkiConfiguration

pkiConfiguration:
  commonName: "vault.koudingspawn.de"
  altNames: ""
  ipSans: ""
  ttl: "8h"

Change Adjustment Callback

This issues a new certificate that is available in your Kubernetes secret resource. It's saved in the format that Ingress can use to read them as certificates. For more details on ingress configuration please see:

For more information about the described fields please see the of Vault.

For more details please see !

HashiCorp Vault
https://koudingspawn.de/advanced-ingress/
API documentation
Change Detection