Vault agent injector TLS with Cert-Manager
The following instructions demonstrate how to configure the Vault Agent Injector to use certificates generated by cert-manager. This allows you to run multiple replicas of the Vault Agent Injector in a Kubernetes cluster.
Prerequisites
Install cert-manager if not already installed (see the cert-manager documentation). For example, with helm:
Create a certificate authority (CA)
For this example we will bootstrap a self-signed certificate authority (CA) Issuer. If you already have a ClusterIssuer configured for your cluster, you may skip this step.
Save that to a file named ca-issuer.yaml
, and apply to your Kubernetes cluster:
Create the Vault agent injector certificate
Next we can create a request for cert-manager to generate a certificate and key signed by the certificate authority above. This certificate and key will be used by the Vault Agent Injector for TLS communications with the Kubernetes API.
The Certificate request object references the CA issuer created above, and specifies the name of the Secret where the CA, Certificate, and Key will be stored by cert-manager.
Important Note: The dnsNames for the certificate must be configured to use the name of the Vault Agent Injector Kubernetes service and namespace where it is deployed.
In this example the Vault Agent Injector service name is vault-agent-injector-svc
in the vault
namespace.
This uses the pattern <k8s service name>.<k8s namespace>.svc
.
Save the Certificate yaml to a file and apply to your cluster:
Configuration
Now that a certificate authority and a signed certificate have been created, we can now configure Helm and the Vault Agent Injector to use them.
Install the Vault Agent Injector with the following custom values: