Shulou(Shulou.com)06/01 Report--

Today, I will talk to you about how to use Vault and Kubernetes to provide strong protection for passwords, which may not be well understood by many people. in order to make you understand better, the editor has summarized the following contents for you. I hope you can get something according to this article.

Introduction

Kubernetes has become the industry standard for container choreography, while Vault from HashiCorp is the industry standard for password management. The question arises: how do you combine these two technologies so that you can use the password from the Vault central instance in your Kubernetes application?

One solution is to use AppRole authentication. Boostport provides perfect integration for the use of AppRoles on Kubernetes. Another feasible method is to use Kubernetes authentication. This authentication mechanism creates a trusted relationship between Vault and Kubernetes clusters so that you can use a service account to authenticate to Vault. You can use Kubernetes's Vault node to obtain and update authentication tokens later.

In this practical article, I will show you how to use some Go helper tools to do the same work such as authentication update tokens, and will further implement-synchronizing a predefined subset of passwords from Vault to Kubernetes.

Grade: advanced

Preparatory work

For simplicity, I have some options:

Start a Kubernetes cluster in several different ways. Generally speaking, minikube is used for testing or development. I will use kubeadm because it is very simple to start a real cluster.

In Kubernetes, the default namespace is used.

Vault runs in development mode. _ Don't use it like you do in a production environment! _ make sure VAULT_ADDR is set in the environment variable.

Ubuntu is used in the code example. These have been tested on Ubuntu 18.10 VM configured with 2 vCPU and 7.5 GB on GCE. (you can take a look at the $300 free package on GCP, just saying … )

Unless otherwise noted, Bash will be used.

Kubernetes

Let's start with a simple test cluster. In the following code, you will see what the installation steps for a simple node look like.

# 1) Install Kubernetes on a Ubuntu machinesudo-icurl-s https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add-echo 'deb http://apt.kubernetes.io/ kubernetes-xenial main' > > / etc/apt/sources.list.d/kubernetes.listapt update & & apt install-y docker.io kubelet kubeadm kubectlsudo systemctl enable docker.servicekubeadm init-- pod-network-cidr=10.244.0.0/16 # Flannel pod network See belowexit# 2) Prepare kubectlmkdir-p $HOME/.kubesudo cp-I / etc/kubernetes/admin.conf $HOME/.kube/configsudo chown $(id-u): $(id-g) $HOME/.kube/configecho "source

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.