Storing the Enterprise License in Vault

This topic describes how to configure the Consul Helm chart to use an enterprise license stored in Vault.

Overview

To use an enterprise license stored in Vault, we will follow the steps outlined in the Data Integration section:

One time setup in Vault

  1. Store the secret in Vault.
  2. Create a Vault policy that authorizes the desired level of access to the secret.

Setup per Consul datacenter

  1. Create Vault Kubernetes auth roles that link the policy to each Consul on Kubernetes service account that requires access.
  2. Update the Consul on Kubernetes helm chart.

Prerequisites

Prior to setting up the data integration between Vault and Consul on Kubernetes, you will need to have:

  1. Read and completed the steps in the Systems Integration section of Vault as a Secrets Backend.
  2. Read the Data Integration Overview section of Vault as a Secrets Backend.

One time setup in Vault

Store the Secret in Vault

First, store the enterprise license in Vault:

  1. $ vault kv put secret/consul/license key="<enterprise license>"
  1. $ vault kv put secret/consul/license key="<enterprise license>"

Create a Vault policy that authorizes the desired level of access to the secret

Note: The secret path referenced by the Vault Policy below will be your global.enterpriseLicense.secretName Helm value.

Next, you will need to create a policy that allows read access to this secret:

  1. path "secret/data/consul/license" {
  2.   capabilities = ["read"]
  3. }

Enterprise License - 图1

license-policy.hcl

  1. path "secret/data/consul/license" {
  2.   capabilities = ["read"]
  3. }

Apply the Vault policy by issuing the vault policy write CLI command:

  1. $ vault policy write license-policy license-policy.hcl
  1. $ vault policy write license-policy license-policy.hcl

Setup per Consul datacenter

Next, you will create Kubernetes auth roles for the Consul server and client:

  1. $ vault write auth/kubernetes/role/consul-server \
  2.     bound_service_account_names=<Consul server service account> \
  3.     bound_service_account_namespaces=<Consul installation namespace> \
  4.     policies=license-policy \
  5.     ttl=1h
  1. $ vault write auth/kubernetes/role/consul-server \
  2.     bound_service_account_names=<Consul server service account> \
  3.     bound_service_account_namespaces=<Consul installation namespace> \
  4.     policies=license-policy \
  5.     ttl=1h
  1. $ vault write auth/kubernetes/role/consul-client \
  2.     bound_service_account_names=<Consul client service account> \
  3.     bound_service_account_namespaces=<Consul installation namespace> \
  4.     policies=license-policy \
  5.     ttl=1h
  1. $ vault write auth/kubernetes/role/consul-client \
  2.     bound_service_account_names=<Consul client service account> \
  3.     bound_service_account_namespaces=<Consul installation namespace> \
  4.     policies=license-policy \
  5.     ttl=1h

To find out the service account names of the Consul server and client, you can run the following helm template commands with your Consul on Kubernetes values file:

  • Generate Consul server service account name

    1. $ helm template --release-name ${RELEASE_NAME} -s templates/server-serviceaccount.yaml hashicorp/consul
    1. $ helm template --release-name ${RELEASE_NAME} -s templates/server-serviceaccount.yaml hashicorp/consul

  • Generate Consul client service account name

    1. $ helm template --release-name ${RELEASE_NAME} -s templates/client-serviceaccount.yaml hashicorp/consul
    1. $ helm template --release-name ${RELEASE_NAME} -s templates/client-serviceaccount.yaml hashicorp/consul

Update the Consul on Kubernetes helm chart.

Now that you have configured Vault, you can configure the Consul Helm chart to use the enterprise enterprise license in Vault:

  1. global:
  2.   image: hashicorp/consul-enterprise:1.12.0-ent
  3.   secretsBackend:
  4.     vault:
  5.       enabled: true
  6.       consulServerRole: consul-server
  7.       consulClientRole: consul-client
  8.   enterpriseLicense:
  9.     secretName: secret/data/consul/enterpriselicense
  10.     secretKey: key

Enterprise License - 图2

values.yaml

  1. global:
  2.   image: hashicorp/consul-enterprise:1.12.0-ent
  3.   secretsBackend:
  4.     vault:
  5.       enabled: true
  6.       consulServerRole: consul-server
  7.       consulClientRole: consul-client
  8.   enterpriseLicense:
  9.     secretName: secret/data/consul/enterpriselicense
  10.     secretKey: key

Note that global.enterpriseLicense.secretName is the path of the secret in Vault. This should be the same path as the one you included in your Vault policy. global.enterpriseLicense.secretKey is the key inside the secret data. This should be the same as the key you passed when creating the enterprise license secret in Vault.