Mount MySQL/MariaDB credentials into Kubernetes pod using CSI Driver

You can use Vault cli to manually configure an existing Vault server. The Vault server may be running inside a Kubernetes cluster or running outside a Kubernetes cluster. If you don’t have a Vault server, you can deploy one by running the following command:

```console
$ kubectl apply -f https://raw.githubusercontent.com/kubevault/docs/master/docs/examples/csi-driver/vault-install.yaml
service/vault created
statefulset.apps/vault created
```

To use secret from database engine, you have to do following things.

1. Enable database Engine: To enable database secret engine run the following command.

   $ vault secrets enable database
   Success! Enabled the database secrets engine at: database/
   

2. Create Engine Policy: To read database credentials from engine, we need to create a policy with read capability. Create a policy.hcl file and write the following content:

   # capability of get secret
   path "database/creds/*" {
       capabilities = ["read"]
   }
   

   Write this policy into vault naming test-policy with following command:

   $ vault policy write test-policy policy.hcl
   Success! Uploaded policy: test-policy
   

3. Write Secret on Vault: Configure Vault with the proper plugin and connection information by running:

   $ vault write database/config/my-mysql-database \
       plugin_name=mysql-rds-database-plugin \
       allowed_roles="k8s.-.demo.demo-role" \
       connection_url="{{username}}:{{password}}@tcp(127.0.0.1:3306)/" \
       username="root" \
       password="password"
   

4. Write a DATABASE role: We need to configure a role that maps a name in Vault to an SQL statement to execute to create the database credential:

   $ vault write database/roles/k8s.-.demo.demo-role \
       db_name=my-mysql-database \
       creation_statements="CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}';GRANT SELECT ON *.* TO '{{name}}'@'%';" \
       default_ttl="1h" \
       max_ttl="24h"
   Success! Data written to: database/roles/k8s.-.demo.demo-role
   

Here, k8s.-.demo.demo-role will be treated as secret name on storage class.

Configure Cluster

1. Create Service Account: Create service.yaml file with following content:

       apiVersion: rbac.authorization.k8s.io/v1beta1
       kind: ClusterRoleBinding
       metadata:
         name: role-dbcreds-binding
         namespace: demo
       roleRef:
         apiGroup: rbac.authorization.k8s.io
         kind: ClusterRole
         name: system:auth-delegator
       subjects:
       - kind: ServiceAccount
         name: db-vault
         namespace: demo
       ---
       apiVersion: v1
       kind: ServiceAccount
       metadata:
         name: db-vault
         namespace: demo
   

   After that, run kubectl apply -f service.yaml to create a service account.

2. Enable Kubernetes Auth: To enable Kubernetes auth back-end, we need to extract the token reviewer JWT, Kubernetes CA certificate and Kubernetes host information.

   export VAULT_SA_NAME=$(kubectl get sa db-vault -n demo -o jsonpath="{.secrets[*]['name']}")
   
   export SA_JWT_TOKEN=$(kubectl get secret $VAULT_SA_NAME -n demo -o jsonpath="{.data.token}" | base64 --decode; echo)
   
   export SA_CA_CRT=$(kubectl get secret $VAULT_SA_NAME -n demo -o jsonpath="{.data['ca\.crt']}" | base64 --decode; echo)
   
   export K8S_HOST=<host-ip>
   export K8s_PORT=6443
   

   Now, we can enable the Kubernetes authentication back-end and create a Vault named role that is attached to this service account. Run:

   $ vault auth enable kubernetes
   Success! Enabled Kubernetes auth method at: kubernetes/
   
   $ vault write auth/kubernetes/config \
       token_reviewer_jwt="$SA_JWT_TOKEN" \
       kubernetes_host="https://$K8S_HOST:$K8s_PORT" \
       kubernetes_ca_cert="$SA_CA_CRT"
   Success! Data written to: auth/kubernetes/config
   
   $ vault write auth/kubernetes/role/db-cred-role \
       bound_service_account_names=db-vault \
       bound_service_account_namespaces=demo \
       policies=test-policy \
       ttl=24h
   Success! Data written to: auth/kubernetes/role/db-cred-role
   

   Here, db-cred-role is the name of the role.

3. Create AppBinding: To connect CSI driver with Vault, we need to create an AppBinding. First we need to make sure, if AppBinding CRD is installed in your cluster by running:

   $ kubectl get crd -l app=catalog
   NAME                                          CREATED AT
   appbindings.appcatalog.appscode.com           2018-12-12T06:09:34Z
   

   If you don’t see that CRD, you can register it via the following command:

   kubectl apply -f https://raw.githubusercontent.com/kmodules/custom-resources/master/api/crds/appbinding.yaml
   
   

   If AppBinding CRD is installed, Create AppBinding with the following data:

     apiVersion: appcatalog.appscode.com/v1alpha1
     kind: AppBinding
     metadata:
       name: vault-app
       namespace: demo
     spec:
     clientConfig:
       url: http://165.227.190.238:30001 # Replace this with Vault URL
     parameters:
       apiVersion: "kubevault.com/v1alpha1"
       kind: "VaultServerConfiguration"
       usePodServiceAccountForCSIDriver: true
       authPath: "kubernetes"
       policyControllerRole: db-cred-role # we created this in previous step