Storing the Enterprise License in Vault
This topic describes how to configure the Consul Helm chart to use an enterprise license stored in Vault.
Overview
Complete the steps outlined in the Data Integration section to use an enterprise license stored in Vault.
Complete the following steps once:
- Store the secret in Vault.
- Create a Vault policy that authorizes the desired level of access to the secret.
Repeat the following steps for each datacenter in the cluster:
- Create Vault Kubernetes auth roles that link the policy to each Consul on Kubernetes service account that requires access.
- Update the Consul on Kubernetes helm chart.
Prerequisites
Prior to setting up the data integration between Vault and Consul on Kubernetes, you will need to have:
- Read and completed the steps in the Systems Integration section of Vault as a Secrets Backend.
- Read the Data Integration Overview section of Vault as a Secrets Backend.
Store the Secret in Vault
First, store the enterprise license in Vault:
Create Vault policy
Next, you will need to create a policy that allows read access to this secret.
The path to the secret referenced in the path
resource is the same value that you will configure in the global.enterpriseLicense.secretName
Helm configuration (refer to Update Consul on Kubernetes Helm chart).
Apply the Vault policy by issuing the vault policy write
CLI command:
Create Vault Authorization Roles for Consul
Next, you will create Kubernetes auth roles for the Consul server and client:
To find out the service account names of the Consul server and client,
you can run the following helm template
commands with your Consul on Kubernetes values file:
Generate Consul server service account name
Generate Consul client service account name
Update Consul on Kubernetes Helm chart.
Now that you have configured Vault, you can configure the Consul Helm chart to use the enterprise enterprise license in Vault:
Note that global.enterpriseLicense.secretName
is the path of the secret in Vault.
This should be the same path as the one you included in your Vault policy.
global.enterpriseLicense.secretKey
is the key inside the secret data. This should be the same
as the key you passed when creating the enterprise license secret in Vault.