Mount MongoDB credentials into Kubernetes pod using CSI Driver

You can use Vault cli to manually configure an existing Vault server. The Vault server may be running inside a Kubernetes cluster or running outside a Kubernetes cluster. If you don’t have a Vault server, you can deploy one by running the following command:

```console
$ kubectl apply -f https://raw.githubusercontent.com/kubevault/docs/master/docs/examples/csi-driver/vault-install.yaml
service/vault created
statefulset.apps/vault created
```

To use secret from database engine, you have to do following things.

1. Enable database Engine: To enable database secret engine run the following command.

   $ vault secrets enable database
   Success! Enabled the database secrets engine at: database/
   

2. Create Engine Policy: To read database credentials from engine, we need to create a policy with read capability. Create a policy.hcl file and write the following content:

   # capability of get secret
   path "database/creds/*" {
     capabilities = ["read"]
   }
   

   Write this policy into vault naming test-policy with following command:

   $ vault policy write test-policy policy.hcl
   Success! Uploaded policy: test-policy
   

3. Write Secret on Vault: Configure Vault with the proper plugin and connection information by running:

   $ vault write database/config/my-mongodb-database \
       plugin_name=mongodb-database-plugin \
       allowed_roles="k8s.-.demo.demo-role" \
       connection_url="mongodb://{{username}}:{{password}}@mongodb.acme.com:27017/admin?ssl=true" \
       username="admin" \
       password="Password!"
   

4. Write a DATABASE role: We need to configure a role that maps a name in Vault to an SQL statement to execute to create the database credential:

   $ vault write database/roles/k8s.-.demo.demo-role \
       db_name=my-mongodb-database \
       creation_statements='{ "db": "admin", "roles": [{ "role": "readWrite" }, {"role": "read", "db": "foo"}] }' \
       default_ttl="1h" \
       max_ttl="24h"
   Success! Data written to: database/roles/k8s.-.demo.demo-role
   

   Here, k8s.-.demo.demo-role will be treated as secret name on storage class.

Configure Cluster

1. Create Service Account: Create service.yaml file with following content:

       apiVersion: rbac.authorization.k8s.io/v1beta1
       kind: ClusterRoleBinding
       metadata:
         name: role-dbcreds-binding
         namespace: demo
       roleRef:
         apiGroup: rbac.authorization.k8s.io
         kind: ClusterRole
         name: system:auth-delegator
       subjects:
       - kind: ServiceAccount
         name: db-vault
         namespace: demo
       ---
       apiVersion: v1
       kind: ServiceAccount
       metadata:
         name: db-vault
         namespace: demo
   

   After that, run kubectl apply -f service.yaml to create a service account.

2. Enable Kubernetes Auth: To enable Kubernetes auth backend, we need to extract the token reviewer JWT, Kubernetes CA certificate and Kubernetes host information.

   export VAULT_SA_NAME=$(kubectl get sa db-vault -n demo -o jsonpath="{.secrets[*]['name']}")
   
   export SA_JWT_TOKEN=$(kubectl get secret $VAULT_SA_NAME -n demo -o jsonpath="{.data.token}" | base64 --decode; echo)
   
   export SA_CA_CRT=$(kubectl get secret $VAULT_SA_NAME -n demo -o jsonpath="{.data['ca\.crt']}" | base64 --decode; echo)
   
   export K8S_HOST=<host-ip>
   export K8s_PORT=6443
   

   Now, we can enable the Kubernetes authentication back-end and create a Vault named role that is attached to this service account. Run:

   $ vault auth enable kubernetes
   Success! Enabled Kubernetes auth method at: kubernetes/
   
   $ vault write auth/kubernetes/config \
       token_reviewer_jwt="$SA_JWT_TOKEN" \
       kubernetes_host="https://$K8S_HOST:$K8s_PORT" \
       kubernetes_ca_cert="$SA_CA_CRT"
   Success! Data written to: auth/kubernetes/config
   
   $ vault write auth/kubernetes/role/db-cred-role \
       bound_service_account_names=db-vault \
       bound_service_account_namespaces=demo \
       policies=test-policy \
       ttl=24h
   Success! Data written to: auth/kubernetes/role/db-cred-role
   

   Here, db-cred-role is the name of the role.

3. Create AppBinding: To connect CSI driver with Vault, we need to create an AppBinding. First we need to make sure, if AppBinding CRD is installed in your cluster by running:

   $ kubectl get crd -l app=catalog
   NAME                                          CREATED AT
   appbindings.appcatalog.appscode.com           2018-12-12T06:09:34Z
   

   If you don’t see that CRD, you can register it via the following command:

   $ kubectl apply -f https://raw.githubusercontent.com/kmodules/custom-resources/master/api/crds/appbinding.yaml
   

   If AppBinding CRD is installed, Create AppBinding with the following data:

   apiVersion: appcatalog.appscode.com/v1alpha1
   kind: AppBinding
   metadata:
     name: vault-app
     namespace: demo
   spec:
   clientConfig:
     url: http://165.227.190.238:30001 # Replace this with Vault URL
   parameters:
     apiVersion: "kubevault.com/v1alpha1"
     kind: "VaultServerConfiguration"
     usePodServiceAccountForCSIDriver: true
     authPath: "kubernetes"
     policyControllerRole: db-cred-role # we created this in previous step