Using consul-template in the mutating webhook

With Bank-Vaults you can use Consul Template as an addition to vault-env to handle secrets that expire, and supply them to applications that read their configurations from a file.

When to use consul-template 🔗︎

• You have an application or tool that must read its configuration from a file.
• You wish to have secrets that have a TTL and expire.
• You do not wish to be limited on which vault secrets backend you use.
• You can also expire tokens/revoke tokens (to do this you need to have a ready/live probe that can send a HUP to consul-template when the current details fail).

Workflow 🔗︎

The following shows the general workflow for using Consul Template:

1. Your pod starts up. The webhook injects an init container (running vault agent) and a sidecar container (running consul-template) into the pods lifecycle.
2. The vault agent in the init container logs in to Vault and retrieves a Vault token based on the configured VAULT_ROLE and Kubernetes Service Account.
3. The consul-template running in the sidecar container logs in to Vault using the Vault token and writes a configuration file based on a pre-configured template in a configmap onto a temporary file system which your application can use.

Prerequisites 🔗︎

This document assumes the following.

• You have a working Kubernetes cluster which has:

  • a working Vault installation
  • a working installation of the mutating webhook.

• You have a working knowledge of Kubernetes.

• You can apply Deployments or PodSpec’s to the cluster.

• You can change the configuration of the mutating webhook.

Use Vault TTLs 🔗︎

If you wish to use Vault TTLs, you need a way to HUP your application on configuration file change. You can configure the Consul Template to execute a command when it writes a new configuration file using the command attribute. The following is a basic example (adapted from here).

apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/name: my-app
    my-app.kubernetes.io/name: my-app-consul-template
    branches: "true"
  name: my-app-consul-template
data:
  config.hcl: |
    vault {
      ssl {
        ca_cert = "/etc/vault/tls/ca.crt"
      }
      retry {
        backoff = "1s"
      }
    }
    template {
      contents = <<EOH
        {{- with secret "database/creds/readonly" }}
        username: {{ .Data.username }}
        password: {{ .Data.password }}
        {{ end }}
      EOH
      destination = "/etc/secrets/config"
      command     = "/bin/sh -c \"kill -HUP $(pidof vault-demo-app) || true\""
    }

Configuration 🔗︎

To configure the webhook, you can either:

• set some sane defaults in the environment of the mutating webhook, or
• configure it via annotations in your PodSpec.

Enable Consul Template in the webhook 🔗︎

For the webhook to detect that it will need to mutate or change a PodSpec, add the vault.security.banzaicloud.io/vault-ct-configmap annotation to the Deployment or PodSpec you want to mutate, otherwise it will be ignored for configuration with Consul Template.

Defaults via environment variables 🔗︎

PodSpec annotations 🔗︎