Creating Vault secrets for external EDB PostgreSQL credentials

Edit online

Create Vault secrets for EDB PostgreSQL credentials.

About this task

To use EDB PostgreSQL bind credentials from Vault, create Vault secrets for the Postgres database connection credentials.

Procedure

  1. Create secrets in Vault for external Postgres database connection credentials. 
    vault kv put secret/im-external-edb-postgres-creds ca.crt="<ca_crt_content>" tls.crt="<tls_crt_content>" tls.key="<tls_key_content>"
  2. If exeternal Postgres supports password-based authentication, you can also create a password in Vault. 
    vault kv put secret/im-external-edb-postgres-creds db_password="<psql_db_password>" ca.crt="<ca_crt_content>" tls.crt="<tls_crt_content>" tls.key="<tls_key_content>"
  3. Configure Vault to use Kubernetes authentication. 
    vault auth enable kubernetes
  4. Configure the Kubernetes authentication method.
    • If Vault is running in the same Kubernetes cluster, run the following command: 
      vault write auth/kubernetes/config \
issuer="https://kubernetes.default.svc.cluster.local" \
token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
kubernetes_host="https://$KUBERNETES_PORT_443_TCP_ADDR:443" \
kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    • If Vault is running outside of the Kubernetes cluster, run the following commands to gather the token and the ca.crt certificate from one of the pods, update it in Vault, and help ensure that vault-csi-provider is running in the cluster. 
      oc exec -n <CSNamespace> -it <some-pod> -- sh
      cat /var/run/secrets/kubernetes.io/serviceaccount/token
cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
      vault write auth/kubernetes/config \
issuer="https://kubernetes.default.svc.cluster.local" \
token_reviewer_jwt="<token_content>" \
kubernetes_host="<kuberentes_external_host>" \
kubernetes_ca_cert=<ca_crt_content>`
  5. Create a policy for IBM Cloud Pak foundational services Identity Management (IM) EDB. 
    vault policy write cs-im-edb-policy - <<EOF
# Read-only access to bind password
path "secret/data/im-external-edb-postgres-creds" {
  capabilities = ["read"]
}
EOF
  6. Create an auth role to access the policy. Replace the <CSNamespace> value with a namespace where IBM Cloud Pak foundational services is deployed.
    version 4170 Starting with version 4.17.0, use the following command: 
    vault write auth/kubernetes/role/cs-im-edb-role \
  bound_service_account_names="ibm-iam-operand-restricted,platform-identity-management,platform-identity-provider" \
  bound_service_account_namespaces="<CSNamespace>" \
  audience="https://kubernetes.default.svc" \
  policies="cs-im-edb-policy" \
  ttl=20m
    version 4160 For versions 4.16.0 and earlier, use the following command: 
    vault write auth/kubernetes/role/cs-im-edb-role \
  bound_service_account_names=ibm-iam-operand-restricted \
  bound_service_account_namespaces=<CSNamespace> \
  policies=cs-im-edb-policy \
  ttl=20m
  7. Create a SecretProviderClass object for external EDB PostgreSQL credentials.
    1. Run one of the following commands to create a SecretProviderClass object that contains external EDB PostgreSQL credentials in the foundational services namespace with the authentication.operator.ibm.com/as-volume: "im-external-edb-cred-vol" and app.kubernetes.io/part-of: "im" labels.
      • Replace the <CSNamespace> value with a namespace where foundational services is deployed.
      • Do not change the objectName value and labels.
      • If external PostgreSQL does not support password-based authentication, run the following command: 
        cat << EOF | oc apply -f -
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: im-external-edb-creds-spc
  namespace: <CSNamespace>
  labels:
    authentication.operator.ibm.com/as-volume: "pgsql-certs"
    app.kubernetes.io/part-of: "im"
spec:
parameters:
  objects: |
    - objectName: "ca.crt"
      secretPath: "secret/data/im-external-edb-postgres-creds"
      secretKey: "ca.crt"
    - objectName: "tls.crt"
      secretPath: "secret/data/im-external-edb-postgres-creds"
      secretKey: "tls.crt"
    - objectName: "tls.key"
      secretPath: "secret/data/im-external-edb-postgres-creds"
      secretKey: "tls.key"
  roleName: cs-im-edb-role
  vaultAddress: 'http://vault.hashicorp-vault:8200'
provider: vault
EOF
      • If external PostgreSQL does support password-based authentication, run the following command: 
        cat << EOF | oc apply -f -
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: im-external-edb-creds-spc
  namespace: <CSNamespace>
  labels:
    authentication.operator.ibm.com/as-volume: "pgsql-certs"
    app.kubernetes.io/part-of: "im"
spec:
parameters:
  objects: |
    - objectName: "ca.crt"
      secretPath: "secret/data/im-external-edb-postgres-creds"
      secretKey: "ca.crt"
    - objectName: "tls.crt"
      secretPath: "secret/data/im-external-edb-postgres-creds"
      secretKey: "tls.crt"
    - objectName: "tls.key"
      secretPath: "secret/data/im-external-edb-postgres-creds"
      secretKey: "tls.key"
    - objectName: "DATABASE_PASSWORD"
      secretPath: "secret/data/im-external-edb-postgres-creds"
      secretKey: "db_password"
  roleName: cs-im-edb-role
  vaultAddress: 'http://vault.hashicorp-vault:8200'
provider: vault
EOF
    2. After the secret provider classes are created, update the IM authentication custom resource (CR) by setting the useSecretsStoreCSI value to true. Then, the IM operator picks the SecretProviderClass objects, mounts them into IM operand pods, and uses external EDB Postgres credentials from Vault. After the SecretProviderClass objects are present in the cluster, updated volume and volume mounts appear.
      • This example shows the volume before the SecretProviderClass objects are present in the cluster. 
            - name: pgsql-certs
      secret:
        secretName: im-datastore-edb-secret
        defaultMode: 420
      • This example shows volume mounts before the SecretProviderClass objects are present in the cluster. 
                - name: pgsql-certs
          mountPath: /certs/pgsql
      • This example shows the volume after the SecretProviderClass objects are present in the cluster. 
            - name: pgsql-certs
      csi:
        driver: secrets-store.csi.k8s.io
        readOnly: true
        volumeAttributes:
          secretProviderClass: im-external-edb-creds-spc
      • This example shows volume mounts after the SecretProviderClass objects are present in the cluster. 
                - name: pgsql-certs
          mountPath: /certs/pgsql