README
¶
Package vaultk8s
Package vaultk8s provides authentication with Vault on Kubernetes
Replaces package
github.com/postfinance/vault/k8s
Authentication is done either with Vault's Kubernetes Auth Method or AppRole Auth Method.
Checkout the Vault documentation for details:
If the environment variables VAULT_ROLE_ID and VAULT_SECRET_ID are set, AppRole Auth Method will be used, Kubernetes Auth Method otherwise.
For a successful Kubernetes authentication the environment variable VAULT_ROLE must be set.
Tests
For testing, HashiCorp's Vault and a Kubernetes cluster will be used.
HashiCorp Vault
- Install Vault
- Start Vault:
export VAULT_DEV_ROOT_TOKEN_ID="90b03685-e17b-7e5e-13a0-e14e45baeb2f" export VAULT_DEV_LISTEN_ADDRESS="127.0.0.1:8200" vault server -dev
IMPORTANT: Start vault with the same root token and listen address as defined in
k8s_test.go.
Kubernetes
- Install and start kind.
kubectl apply -f ci/rbac.yaml
Documentation
¶
Overview ¶
Package vaultk8s provides authentication with Vault on Kubernetes
Index ¶
- Constants
- func FixAuthMountPath(p string) string
- type Authenticate
- type Vault
- func (v *Vault) Authenticate() (string, error)
- func (v *Vault) Client() *vault.Client
- func (v *Vault) GetToken() (string, error)
- func (v *Vault) LoadToken() (string, error)
- func (v *Vault) NewRenewer(token string) (*vault.Renewer, error)
- func (v *Vault) StoreToken(token string) error
- func (v *Vault) UseToken(token string)
Constants ¶
const ( AuthMountPath = "kubernetes" ServiceAccountTokenPath = "/var/run/secrets/kubernetes.io/serviceaccount/token" //nolint: gosec // not the token DefaultTimeout = 30 * time.Second )
Constants
Variables ¶
This section is empty.
Functions ¶
func FixAuthMountPath ¶
FixAuthMountPath add the auth prefix kubernetes -> kubernetes /kubernetes -> kubernetes auth/kubernetes -> kubernetes presumes a valid path
Types ¶
type Authenticate ¶ added in v0.1.0
Authenticate is the function for the Vault authentication.
type Vault ¶
type Vault struct {
// approle auth
RoleID string
SecretID string
// kubernetes auth
Role string
ServiceAccountTokenPath string
TokenPath string
AuthMountPath string
TTL int
ReAuth bool
AllowFail bool
LoginTimeout time.Duration
// contains filtered or unexported fields
}
Vault represents the configuration to get a valid Vault token
func NewFromEnvironment ¶
NewFromEnvironment returns a initialized Vault type for authentication
func (*Vault) GetToken ¶
GetToken tries to load the vault token from VaultTokenPath if token is not available, invalid or not renewable and VaultReAuth is true, try to re-authenticate
func (*Vault) NewRenewer ¶
NewRenewer returns a *vault.Renewer to renew the vault token regularly
func (*Vault) StoreToken ¶
StoreToken in VaultTokenPath
Source Files