openlab-red / mutating-webhook-vault-agent

Mutating Admission Controller - Vault Agent Sidecar Injection

Mutating Webhook Vault Agent

DEPRECATED

In favour of Vault Agent Injector

More info how to use with OpenShift: https://github.com/openlab-red/hashicorp-vault-for-openshift

Build Vault Agent Webhook container

    oc project hashicorp

    oc apply -f build/webhook-build.yaml

    oc start-build vault-agent-webhook --follow

Deploy Vault Agent WebHook

1. Create the sidecar vault agent configuration

   oc apply -f build/sidecar-configmap.yaml
   

2. Process Mutating WebHook Template.

   The template is going to create the following resources:

   • vault-agent-webhook-psp PodSecurityPolicy
   • vault-agent-webhook-clusterrole ClusterRole
   • vault-agent-webhook ServiceAccount
   • vault-agent-webhook-rolebinding ClusterRoleBinding
   • vault-agent-webhook Service
   • vault-agent-webhook DeploymentConfig
   • vault-agent-webhook MutatingWebhookConfiguration

   2.1 Get service-ca.crt from the configmap ca-bundle.

   oc extract configmap/vault-agent-webhook-cabundle --confirm
   export CA_BUNDLE=$(cat service-ca.crt | base64 | tr -d '\n')
   

   2.2 Process the webhook-template

   oc process -f build/webhook-template.yaml -p CA_BUNDLE=${CA_BUNDLE} | oc apply -f -
   

   PARAMETER	DEFAULT	DESCRIPTION
   CA_BUNDLE		CA used by kubernetes to trust the webhook
   VAULT_NAMESPACE	hashicorp	Hashicorp Vault Namespac
   GIN_MODE	release	Http server startup mode gin-gonic
   LOG_LEVEL	INFO	Log level from logrus

Verify Sidecar Injection

1. Label the target project where you want the webhook to inject the vault agent sidecar container.

   oc label namespace app sidecar.agent.vaultproject.io/webhook=enabled
   

2. Add the sidecar.agent.vaultproject.io/inject annotation with value true to the pod template spec to enable injection.

   oc patch dc/thorntail-example -p '{
                                    "spec": {
                                      "template": {
                                        "metadata": {
                                          "annotations": {
                                            "sidecar.agent.vaultproject.io/inject": "true",
                                            "sidecar.agent.vaultproject.io/secret": "secret/example",
                                            "sidecar.agent.vaultproject.io/filename": "application.yaml",
                                            "sidecar.agent.vaultproject.io/role": "example"
                                          }
                                        }
                                      }
                                    }
                                  }'
   

3. The vault agent webhook will:

   • Create or Update the vault agent configmap
   • Inject Vault agent sidecar container
   • Inject Vault secret fetcher sidecar container
   • Mount Vault volume to the app container

References

• https://docs.openshift.com/container-platform/3.10/architecture/additional_concepts/dynamic_admission_controllers.html
• https://v1-10.docs.kubernetes.io/docs/admin/extensible-admission-controllers/
• https://github.com/morvencao/kube-mutating-webhook-tutorial/
• https://github.com/kubernetes/kubernetes/tree/release-1.10/test/images/webhook

mutating-webhook-vault-agent's Issues

Deployed to openshift 4.3 and got a build error.

Expectations:
Following the steps, my expectation is to see two pods in the namespace.
Build pod is in "Failed" state and the errors are :
STEP 1: FROM docker.io/golang:1.11
STEP 2: LABEL authors="Mattia Mascia [email protected]"
823cb071399627a31b62c23b734a0c7128d8a5b2465e6e80110664f058d198e8
STEP 3: ADD https://github.com/golang/dep/releases/download/v0.5.0/dep-linux-amd64 /usr/bin/dep
error: build error: error building at STEP "ADD https://github.com/golang/dep/releases/download/v0.5.0/dep-linux-amd64 /usr/bin/dep": source can't be a URL for COPY

Don't know how to proceed.
Any assistance is appreciated.