Creating Vault secrets for LDAP bind credentials

Edit online

Create Vault secrets for Lightweight Directory Access Protocol (LDAP) bind credentials.

About this task

To use LDAP bind credentials from Vault, create Vault secrets for the LDAP bind distinguished name (DN) and password.

Procedure

  1. Create secrets in Vault for LDAP bind credentials as shown in the following example. 
    vault kv put secret/im-ldap-bind-creds msad-ldap-bind-password="<msad_ldap_bind_password>" msad-ldap-bind-dn="<msad_ldap_bind_dn>"

    If you need to use multiple LDAP bind credentials from Vault, create a multiple key value pair as shown in the following example:

    vault kv put secret/im-ldap-bind-creds msad-ldap-bind-password="<msad_ldap_bind_password>" msad-ldap-bind-dn="<msad_ldap_bind_dn>" openldap-ldap-bind-password="<openldap_ldap_bind_password>" openldap-ldap-bind-dn="<openldap_ldap_bind_dn>"
  2. Configure Vault to use Kubernetes authentication: 
    vault auth enable kubernetes
  3. Configure the Kubernetes authentication method.
    If Vault is running in the same Kubernetes cluster, run the following command: 
    vault write auth/kubernetes/config \
issuer="https://kubernetes.default.svc.cluster.local" \
token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
kubernetes_host="https://$KUBERNETES_PORT_443_TCP_ADDR:443" \
kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    If Vault is running outside of the Kubernetes cluster, run the following commands to gather the token and the ca.crt certificate from one of the pods, update it in Vault, and help ensure that vault-csi-provider is running in the cluster. 
    oc exec -n <CSNamespace> -it <some-pod> -- sh
    cat /var/run/secrets/kubernetes.io/serviceaccount/token
cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    vault write auth/kubernetes/config \
issuer="https://kubernetes.default.svc.cluster.local" \
token_reviewer_jwt="<token_content>" \
kubernetes_host="<kuberentes_external_host>" \
kubernetes_ca_cert=<ca_crt_content>`
  4. Create a policy for IBM Cloud Pak foundational services Identity Management (IM) LDAP. 
    vault policy write cs-im-ldap-policy - <<EOF
# Read-only access to bind credentials
path "secret/data/im-ldap-bind-creds" {
  capabilities = ["read"]
}
EOF
  5. Create an auth role to access the policy. Replace the <CSNamespace> value with a namespace where IBM Cloud Pak foundational services is deployed.
    version 4170 Starting with version 4.17.0, use the following command: 
    vault write auth/kubernetes/role/cs-im-ldap-role \
  bound_service_account_names="ibm-iam-operand-restricted,platform-identity-management,platform-identity-provider" \
  bound_service_account_namespaces="<CSNamespace>" \
  audience="https://kubernetes.default.svc" \
  policies="cs-im-ldap-policy" \
  ttl=20m
    version 4160 For versions 4.16.0 and earlier, use the following command: 
    vault write auth/kubernetes/role/cs-im-ldap-role \
  bound_service_account_names=ibm-iam-operand-restricted \
  bound_service_account_namespaces=<CSNamespace> \
  policies=cs-im-ldap-policy \
  ttl=20m
  6. Create a SecretProviderClass object for LDAP bind credentials.
    1. Run the following command to create a SecretProviderClass object that contains IM LDAP bind credentials information in the foundational services namespace with the authentication.operator.ibm.com/as-volume: "ldap-bind-cred-vol" and app.kubernetes.io/part-of: "im" labels.
    2. Replace the <CSNamespace> value with a namespace where foundational services is deployed.
    3. For the objectName values, replace <ldap_connection_name> with the LDAP connection name that is created when you configure an LDAP connection with IM. 
      cat << EOF | oc apply -f -
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: im-ldap-bind-creds-spc
  namespace: <CSNamespace>
  labels:
    authentication.operator.ibm.com/as-volume: "ldap-bind-cred-vol"
    app.kubernetes.io/part-of: "im"
spec:
  parameters:
    objects: |
      - objectName: "<ldap_connection_name>_ldap_bind_pwd"
        secretPath: "secret/data/im-ldap-bind-creds"
        secretKey: "msad-ldap-bind-password"
      - objectName: "<ldap_connection_name>_ldap_bind_dn"
        secretPath: "secret/data/im-ldap-bind-creds"
        secretKey: "msad-ldap-bind-dn"
    roleName: cs-im-ldap-role
    vaultAddress: 'http://vault.hashicorp-vault:8200'
  provider: vault
EOF
    4. After the secret provider classes are created, update the IM authentication custom resource (CR) by setting the useSecretsStoreCSI value to true. Then, the IM operator picks the SecretProviderClass objects, mounts them into IM operand pods, and uses LDAP bind credentials from Vault. After the SecretProviderClass objects are present in the cluster, updated volume and volume mounts appear.
      • This example shows the volume after the SecretProviderClass objects are present in the cluster. 
            - name: ldap-bind-cred-vol
      csi:
        driver: secrets-store.csi.k8s.io
        readOnly: true
        volumeAttributes:
          secretProviderClass: im-ldap-bind-creds-spc
      • This example shows volume mounts after the SecretProviderClass objects are present in the cluster. 
                - name: ldap-bind-cred-vol
          mountPath: /opt/ibm/vault/ldap-bind-cred
    5. When an LDAP connection is created with an API, and you want to use bind DN and a password from Vault, omit the "ldap_binddn" and "ldap_bindpassword" parameters from the idp_config configuration and include "ldap_bindfromvault": true in the idp_config configuration.
    6. When an LDAP connection is created with the UI, and the useSecretsStoreCSI value is set to true on the Authentication CR, from Connection details, you can select Use vault for bind DN and password.