Enabling zero-trust security with Kubernetes and Vault

Question

Pulumi · Accepted Answer

In order to enable zero-trust security with a Kubernetes cluster and Vault, we need to integrate HashiCorp Vault with the Kubernetes cluster. This integration will allow us to implement authentication and secure secrets management within our cluster, in line with the principles of a zero-trust security model.

Below is a Pulumi program in TypeScript that demonstrates how you can use Vault with Kubernetes to enhance security. The program will do the following:

Set up Vault's Kubernetes authentication method which allows for the pods to authenticate with Vault using their service account tokens.
Define a Vault role that maps Kubernetes service account names and namespaces to Vault policies.
Configure a Kubernetes auth backend role and role binding to secure access to the API server based on role and namespace.

Before you run this program, ensure you have the Pulumi CLI installed, authenticated to your cloud provider, and the Kubernetes cluster context set correctly if you're running this locally.

Here's how you can set up a Vault Secret Backend for Kubernetes and create roles within Vault that will authenticate against Kubernetes service accounts.

import * as pulumi from "@pulumi/pulumi";
import * as kubernetes from "@pulumi/kubernetes";
import * as vault from "@pulumi/vault";

// Configurations for your Kubernetes cluster and Vault
const config = new pulumi.Config();
const kubeConfig = config.require("kubeconfig");
const vaultAddress = config.require("vaultAddress");

// Creating a new K8S provider to interact with the cluster
const k8sProvider = new kubernetes.Provider("k8sProvider", {
    kubeconfig: kubeConfig,
});

// Creating a new Vault provider to interact with Vault
const vaultProvider = new vault.Provider("vaultProvider", {
    address: vaultAddress,
});

// Create a Kubernetes Secret Backend in Vault
const secretBackend = new vault.kubernetes.SecretBackend("vault-secret-backend", {
    path: "kubernetes",
    kubernetesHost: `https://<your-kubernetes-host>`, // Replace with your Kubernetes API server address
    kubernetesCaCert: "<your-kubernetes-ca-cert>", // Replace with your Kubernetes CA certificate
    // Additional properties can be set depending on requirements
}, { provider: vaultProvider });

// Define a role in Vault that maps a Kubernetes service account to Vault policies
const secretBackendRole = new vault.kubernetes.SecretBackendRole("vault-secret-backend-role", {
    backend: secretBackend.path, // Use the path where we mounted the secret backend
    name: "my-k8s-role", // Name of the role
    boundServiceAccountNames: ["my-service-account"], // Name of the Kubernetes Service Account you want to bind to this role
    boundServiceAccountNamespaces: ["default"], // Namespace where the Service Account exists
    // Other properties like TTL can be set as needed
}, { provider: vaultProvider });

// (Optional) Configure the Kubernetes ClusterRole to provide access to the service account
const clusterRole = new kubernetes.rbac.v1.ClusterRole("vault-auth-cluster-role", {
    metadata: { name: "vault-auth-cluster-role" },
    rules: [
        {
            apiGroups: [""],
            resources: ["serviceaccounts"],
            verbs: ["get", "list"],
        },
        {
            apiGroups: [""],
            resources: ["secrets"],
            verbs: ["get"],
        },
        // Add more rules as per the access requirements
    ],
}, { provider: k8sProvider });

// (Optional) Bind the ClusterRole to the Service Account through a ClusterRoleBinding
const clusterRoleBinding = new kubernetes.rbac.v1.ClusterRoleBinding("vault-auth-cluster-role-binding", {
    metadata: { name: "vault-auth-cluster-role-binding" },
    roleRef: {
        apiGroup: "rbac.authorization.k8s.io",
        kind: "ClusterRole",
        name: clusterRole.metadata.name,
    },
    subjects: [{
        kind: "ServiceAccount",
        name: "my-service-account",
        namespace: "default", // Use the namespace of your Service Account
    }],
}, { provider: k8sProvider });

// Exporting the role name for reference
export const roleName = secretBackendRole.name;

Before running this program, ensure you replace placeholders like <your-kubernetes-host> and <your-kubernetes-ca-cert> with actual values from your Kubernetes cluster.

After you've set up the program, run it with the Pulumi CLI. This process will create the necessary resources within your Vault instance and Kubernetes cluster to establish a zero-trust authentication scheme, where Kubernetes pods authenticate using service account tokens against Vault policies.

Vault plays a critical role in managing secrets and sensitive data in a zero-trust security model. By integrating it with Kubernetes, we can ensure that specific pods get access only to the secrets they are allowed based on their service account token, facilitating least privilege access control which is at the heart of the zero-trust model.

Keep in mind this is a foundational setup. Depending on your specific needs, you may need to adjust policies, add more roles, and secure communications between Vault and your applications in more detail. Additional steps, like setting up Vault's PKI (Public Key Infrastructure) to issue TLS certificates for services, can further enhance the security of your cluster.

Remember to manage and rotate your secrets regularly and audit access to maintain a secure environment.