Skip to content

Latest commit

 

History

History
28 lines (25 loc) · 1.63 KB

README.md

File metadata and controls

28 lines (25 loc) · 1.63 KB
Raw

Kubernetes Secrets used by Vault

Five secrets must be created to spin up a new vault instance

  1. gossip-key which Consul uses to encrypt gossip communications
  2. vault-consul.ca which contains a PEM-encoded CA cert to use to verify the Vault server SSL certificate
  3. vault-consul.tls which contains a PEM-encoded client certificate for TLS authentication to the Vault server along with an unencrypted PEM-encoded private key matching the client certificate
  4. vault.ca which contains a PEM-encoded CA cert to use to verify the Vault server SSL certificate
  5. vault.tls which contains a PEM-encoded client certificate for TLS authentication to the Vault server along with an unencrypted PEM-encoded private key matching the client certificate

Create/Update Vault Secrets

  1. Generate new CA and Consul certs
  2. TBD - Ryan Wilcox
  3. Ensure the following files are in the certs/ directory and are up to date
  4. consul.ca - Consul CA Cert
  5. consul.crt - Consul TLS Cert
  6. consul.key - Consul TLS Private Key
  7. vault.ca - Vault CA Cert
  8. vault.crt - Vault TLS Cert
  9. vault.key - Vault TLS Private Key
  10. Run the following to replace all consul/vault K8S secrets
./apply.sh <vault_cluster_name> <namespace>

Add a true parameter at the end if you also want to create/replace the Consul gossip key with a new auto-generated one. -WARNING- replacing the gossip key should not be done on a running cluster as it may cause inconsistent keys between Consul nodes. This should only be done when creating or completely destroying/re-creating a Vault cluster.

./apply.sh <vault_cluster_name> <namespace> true