Vault on Google Kubernetes Engine
This tutorial walks you through provisioning a multi-node HashiCorp Vault cluster on Google Kubernetes Engine.
Cluster Features
- High Availability - The Vault cluster will be provisioned in multi-server mode for high availability.
- Google Cloud Storage Storage Backend - Vault's data is persisted in Google Cloud Storage.
- Production Hardening - Vault is configured and deployed based on the guidance found in the production hardening guide.
- Auto Initialization and Unsealing - Vault is automatically initialized and unsealed at runtime. Keys are encrypted using Cloud KMS and stored on Google Cloud Storage.
Tutorial
Create a New Project
In this section you will create a new GCP project and enable the APIs required by this tutorial.
Generate a project ID:
PROJECT_ID="vault-$(($(date +%s%d)/1000000))"
Create a new GCP project:
gcloud projects create ${PROJECT_ID} \
--name "${PROJECT_ID}"
Enable billing on the new project before moving on to the next step.
Enable the GCP APIs required by this tutorial:
gcloud services enable \
cloudapis.googleapis.com \
cloudkms.googleapis.com \
container.googleapis.com \
containerregistry.googleapis.com \
iam.googleapis.com \
--project ${PROJECT_ID}
Set Configuration
COMPUTE_ZONE="us-west1-c"
COMPUTE_REGION="us-west1"
GCS_BUCKET_NAME="${PROJECT_ID}-vault-storage"
KMS_KEY_ID="projects/${PROJECT_ID}/locations/global/keyRings/vault/cryptoKeys/vault-init"
Create KMS Keyring and Crypto Key
In this section you will create a Cloud KMS keyring and cryptographic key suitable for encrypting and decrypting Vault master keys and root tokens.
Create the vault kms keyring:
gcloud kms keyrings create vault \
--location global \
--project ${PROJECT_ID}
Create the vault-init encryption key:
gcloud kms keys create vault-init \
--location global \
--keyring vault \
--purpose encryption \
--project ${PROJECT_ID}
Create a Google Cloud Storage Bucket
Google Cloud Storage is used to persist Vault's data and hold encrypted Vault master keys and root tokens.
Create a GCS bucket:
gsutil mb -p ${PROJECT_ID} gs://${GCS_BUCKET_NAME}
Create the Vault IAM Service Account
An IAM service account is used by Vault to access the GCS bucket and KMS encryption key created in the previous sections.
Create the vault service account:
gcloud iam service-accounts create vault-server \
--display-name "vault service account" \
--project ${PROJECT_ID}
Grant access to the vault storage bucket:
gsutil iam ch \
serviceAccount:vault-server@${PROJECT_ID}.iam.gserviceaccount.com:objectAdmin \
gs://${GCS_BUCKET_NAME}
gsutil iam ch \
serviceAccount:vault-server@${PROJECT_ID}.iam.gserviceaccount.com:legacyBucketReader \
gs://${GCS_BUCKET_NAME}
Grant access to the vault-init KMS encryption key:
gcloud kms keys add-iam-policy-binding \
vault-init \
--location global \
--keyring vault \
--member serviceAccount:vault-server@${PROJECT_ID}.iam.gserviceaccount.com \
--role roles/cloudkms.cryptoKeyEncrypterDecrypter \
--project ${PROJECT_ID}
Provision a Kubernetes Cluster
In this section you will provision a three node Kubernetes cluster using Google Kubernetes Engine with access to the vault-server service account across the entire cluster.
Create the vault Kubernetes cluster:
gcloud container clusters create vault \
--enable-autorepair \
--cluster-version 1.11.2-gke.9 \
--machine-type n1-standard-2 \
--service-account vault-server@${PROJECT_ID}.iam.gserviceaccount.com \
--num-nodes 3 \
--zone ${COMPUTE_ZONE} \
--project ${PROJECT_ID}
Warning: Each node in the
vaultKubernetes cluster has access to thevault-serverservice account. Thevaultcluster should only be used for running Vault. Other workloads should run on a different cluster and access Vault through an internal or external load balancer.
Provision IP Address
In this section you will create a public IP address that will be used to expose the Vault server to external clients.
Create the vault compute address:
gcloud compute addresses create vault \
--region ${COMPUTE_REGION} \
--project ${PROJECT_ID}
Store the vault compute address in an environment variable:
VAULT_LOAD_BALANCER_IP=$(gcloud compute addresses describe vault \
--region ${COMPUTE_REGION} \
--project ${PROJECT_ID} \
--format='value(address)')
Generate TLS Certificates
In this section you will generate the self-signed TLS certificates used to secure communication between Vault clients and servers.
Create a Certificate Authority:
cfssl gencert -initca ca-csr.json