[ExternalSecrets-Vault-k8s] Hướng dẫn đồng bộ secret từ Vault sang K8s bằng 1 opensouce Godady

Đầu tiên install external secrets bằng helm
helm repo add external-secrets https://godaddy.github.io/kubernetes-external-secrets/
kubectl create namespace external-secrets
helm install kubernetes-external-secrets external-secrets/kubernetes-external-secrets --namespace external-secrets --values values.yaml

thay gia trị VAULT_ADDR bằng url vault cần có ssl xanh lè nhé
vault cần ở bản 1.7.3 và k8s 1.21
>>>>>>>>>>>>>>>>>>>>

TRên master chạy cái này:
kubectl apply \
  --filename=-<<EOH
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: role-tokenreview-binding
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
- kind: ServiceAccount
  name: kubernetes-external-secrets
  namespace: external-secrets
EOH
####
Ở đây thì namespace ClusterRoleBinding là default có một số bài họ để cùng với ns của external-secrets
ở ClusterRole dùng name là system:auth-delegator(là gì tự đọc docx nhé)
ở ServiceAccount thì đặt biệt để ý
  name: kubernetes-external-secrets
  namespace: external-secrets

>>>>>>>>>>>>>>>>>>>>>>>>>>>

Vào vault:
kubectl -n vault exec -it pod/vault-0 -- sh
export CLUSTER_NAME=kubernetes-external-secrets

>>> Tạo policy là: kubernetes-external-secrets-kv-rw
vault policy write ${CLUSTER_NAME}-kv-rw - <<EOH
path "kv/data/${CLUSTER_NAME}/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}
EOH

>>>>output "Success! Uploaded policy: kubernetes-external-secrets-kv-rw"

##step 5
>>> bước này tạm hiểu bạn cần liên kết policy mà bạn tạo trên vault và k8s

vault auth enable --path="${CLUSTER_NAME}" kubernetes
>>>output Success! Enabled kubernetes auth method at: kubernetes-external-secrets/

vault write auth/${CLUSTER_NAME}/config \
token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
kubernetes_host="https://$KUBERNETES_PORT_443_TCP_ADDR:443" \
kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt \
disable_iss_validation=true

>>>>output Success! Data written to: auth/kubernetes-external-secrets/config

disable_iss_validation=true ta bắt buộc phải có cái này
lý do: https://github.com/external-secrets/kubernetes-external-secrets/issues/721

##step 7
>>> Bạn tạo role

vault write auth/${CLUSTER_NAME}/role/${CLUSTER_NAME}-role \
  bound_service_account_names="kubernetes-external-secrets" \
  bound_service_account_namespaces="external-secrets" \
  policies="default,${CLUSTER_NAME}-kv-rw" \
  ttl="15m"
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>>output: Success! Data written to: auth/kubernetes-external-secrets/role/kubernetes-external-secrets-role

về lại k8s master

kubectl apply \
  --filename=-<<EOH
---
apiVersion: 'kubernetes-client.io/v1'
kind: ExternalSecret
metadata:
  name: test
spec:
  backendType: vault
  vaultMountPoint: kubernetes-external-secrets #created at step 5
  vaultRole: kubernetes-external-secrets-role #created at step 7
  dataFrom:
    - kv/data/kubernetes-external-secrets/test
EOH

>>>>> gõ command trong vault nhé

vault secrets enable -path kv/ kv-v2

vault kv put kv/kubernetes-external-secrets/test \
secret="your-random-string-shared-secret"


>>>output
Key              Value
---              -----
created_time     2021-09-11T13:49:39.297424961Z
deletion_time    n/a
destroyed        false
version          1

vault kv put kv/kubernetes-external-secrets/nim \
secret="your-random-string-shared-secret"

apiVersion: 'kubernetes-client.io/v1'
kind: ExternalSecret
metadata:
  name: env-nim
spec:
  backendType: vault
  vaultMountPoint: kubernetes-external-secrets #created at step 5
  vaultRole: kubernetes-external-secrets-role #created at step 7
  dataFrom:
    - kv/data/kubernetes-external-secrets/nim

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: role-tokenreview-binding
  namespace: sample
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
- kind: ServiceAccount
  name: kubernetes-external-secrets
  namespace: external-secrets

apiVersion: 'kubernetes-client.io/v1'
kind: ExternalSecret
metadata:
  name: env-nim
  namespace: sample
spec:
  backendType: vault
  vaultMountPoint: kubernetes-external-secrets #created at step 5
  vaultRole: kubernetes-external-secrets-role #created at step 7
  dataFrom:
    - kv/data/kubernetes-external-secrets/nim