Secret Type - PKI
The PKI-Type is made to connect to the PKI - Secrets Engine of HashiCorp Vault. It generates certificates X.509 Certificates and refreshes them if they are near the expiration date.
How To
First generate a PKI in Vault and create a rule to issue new certificates:
This is only a test pki, for info how to generate a more secure pki please read the manual of HashiCorp Vault!
1
$ vault secrets enable -path=testpki -description=testpki pki
2
$ vault secrets tune -max-lease-ttl=8760h testpki
3
$ vault write testpki/root/generate/internal \
4
common_name=koudingspawn.de \
5
ttl=500h
6
$ vault write testpki/roles/testrole \
7
allowed_domains=*.koudingspawn.de \
8
max_ttl=8760h
Copied!
After this create the following Vault-Resource and apply it to Kubernetes:
1
apiVersion: "koudingspawn.de/v1"
2
kind: Vault
3
metadata:
4
name: test-pki
5
spec:
6
path: "testpki/issue/testrole"
7
type: "PKI"
8
pkiConfiguration:
9
commonName: "vault.koudingspawn.de"
10
ttl: "8h"
11
​
Copied!
This issues a new certificate that is available in your Kubernetes secret resource. It's saved in the format that Ingress can use to read them as certificates. For more details on ingress configuration please see: https://koudingspawn.de/advanced-ingress/​
1
$ kubectl get vault test-pki
2
NAME AGE
3
test-pki 8d
Copied!
1
$ kubectl get secret test-pki
2
NAME TYPE DATA AGE
3
test-pki Opaque 2 8d
Copied!
1
$ kubectl get secret test-pki -o yaml
2
apiVersion: v1
3
data:
4
tls.crt: <certificate>
5
tls.key: <key>
6
kind: Secret
7
metadata:
8
annotations:
9
vault.koudingspawn.de/compare: 2018-04-13T22:38Z
10
vault.koudingspawn.de/lastUpdated: 2018-04-14T00:31:42.889
11
creationTimestamp: 2018-04-13T22:16:03Z
12
name: test-pki
13
namespace: default
14
resourceVersion: "1791800"
15
selfLink: /api/v1/namespaces/default/secrets/test-pki
16
uid: 40eaddf8-3f68-11e8-8433-b2b7401505d0
17
type: Opaque
Copied!
Supported Values in pkiConfiguration
1
pkiConfiguration:
2
commonName: "vault.koudingspawn.de"
3
altNames: ""
4
ipSans: ""
5
ttl: "8h"
Copied!
Change Adjustment Callback
Last modified 1yr ago
Copy link