.

security/secrets/hashicorp-vault/assets/kubernetes-auth.yaml

@@ -0,0 +1,81 @@
+# Kubernetes Authentication for Vault
+# Enables pods to authenticate with Vault using service accounts
+
+---
+# ServiceAccount for Vault auth
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: vault-auth
+  namespace: vault
+
+---
+# ClusterRoleBinding for token review
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: vault-tokenreview-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+- kind: ServiceAccount
+  name: vault-auth
+  namespace: vault
+
+---
+# Secret for SA token (K8s 1.24+)
+apiVersion: v1
+kind: Secret
+metadata:
+  name: vault-auth-token
+  namespace: vault
+  annotations:
+    kubernetes.io/service-account.name: vault-auth
+type: kubernetes.io/service-account-token
+
+---
+# Example: Application ServiceAccount
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: myapp
+  namespace: myapp
+
+---
+# Example: Pod using Vault Agent Injector
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myapp
+  namespace: myapp
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: myapp
+  template:
+    metadata:
+      labels:
+        app: myapp
+      annotations:
+        # Vault Agent Injector annotations
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/role: "myapp"
+        vault.hashicorp.com/agent-inject-secret-config: "secret/data/myapp/config"
+        vault.hashicorp.com/agent-inject-template-config: |
+          {{- with secret "secret/data/myapp/config" -}}
+          DATABASE_URL={{ .Data.data.database_url }}
+          API_KEY={{ .Data.data.api_key }}
+          {{- end }}
+    spec:
+      serviceAccountName: myapp
+      containers:
+      - name: myapp
+        image: myapp:latest
+        # Secrets available at /vault/secrets/config
+        volumeMounts:
+        - name: secrets
+          mountPath: /vault/secrets
+          readOnly: true