Using vault-k8s from a different cluster

[stevegore]

We're currently hosting Vault in a dedicated Kubernetes cluster. Ideally, we'd like to use vault-k8s to authenticate service accounts from other clusters.

Obviously this would not work out of the box, as the Vault admissions controller is currently only located in the Vault cluster, and not in the other clusters that are actually running the applications.

Is there a recommended way of making this work? I'm currently thinking along these lines:

In Vault:

• Configure Kubernetes auth , once per application cluster (e.g. vault auth enable --path kubernetes/$CLUSTER_NAME kubernetes). The config of each auth method would store credentials of a vault-auth service account from the relevant application cluster. Each vault-auth service account would have a ClusterRoleBinding to the system:auth-delegator ClusterRole in their cluster.

In each application cluster:

• Deploy a Vault agent, with the injector enabled.
• Create a ConfigMap along these lines, where vault.address is set to the address of our Vault instance, with relevant certs and keys included.

This way, IIUC, when I deploy a pod to the cluster that has the vault annotations, it will be caught by the admissions controller, which will then talk to our Vault instance, and attempt to authenticate the JWT from the application service account.

Is this valid? Or am I making things way to complex? What's the best way to authenticate an application running in a cluster that's separate to the cluster running Vault?

[stevegore]

If the Vault Agent doesn't provide the injector webhook, maybe just an empty instance of Vault would do?

[iiro]

Is this a duplicate for #15 ...?

[stevegore]

@iiro thanks, it does look very similar. Looks like they're deploying Vault via helm onto the application cluster and setting an environment variable to point to the production Vault instance. Let me know if I've misunderstood? I'll try that out tomorrow.

[stevegore]

Closing as this has been resolved on the other issue.