Vault setup

One KV v2 secret per keyset, a read-only policy, and an auth method for the bridge.

KV v2 secret

The secret holds one field, keys, with the JSON array of entries described in Keyset format. The field may be a JSON value or a string containing JSON. The keyset path in the bridge configuration is <mount>/<path>, for example secret/jwks-bridge/default.

jwks-bridge keygen --alg RS256 --status active | jq -c '[.]' \
  | vault kv put secret/jwks-bridge/default keys=-
vault kv get -field=keys secret/jwks-bridge/default | jq

Vault Transit cannot be used: its keys are not exportable, and the plugin needs the private key.

Policy

path "secret/data/jwks-bridge/*" {
  capabilities = ["read"]
}
path "secret/metadata/jwks-bridge/*" {
  capabilities = ["read"]
}

Kubernetes auth

The default in clusters. The bridge logs in with its service account token and renews the Vault token; when it can no longer be renewed it logs in again.

vault auth enable kubernetes
vault write auth/kubernetes/config kubernetes_host=https://kubernetes.default.svc:443
vault write auth/kubernetes/role/jwks-bridge \
  bound_service_account_names=jwks-bridge \
  bound_service_account_namespaces=jwks \
  policies=jwks-bridge ttl=1h

Bridge settings: JWKSB_VAULT_AUTH=kubernetes, JWKSB_VAULT_ROLE=jwks-bridge, and JWKSB_VAULT_AUTH_MOUNT when the method is mounted elsewhere.

AppRole

Set JWKSB_VAULT_AUTH=approle, JWKSB_VAULT_APPROLE_ROLE_ID and JWKSB_VAULT_APPROLE_SECRET_ID_FILE.

Static token

For development: JWKSB_VAULT_AUTH=token and VAULT_TOKEN.

Connection settings

The standard Vault client variables apply: VAULT_ADDR, VAULT_CACERT, VAULT_NAMESPACE (Vault Enterprise), VAULT_CLIENT_TIMEOUT. The repository has a setup script in examples/vault/setup.sh.

Introduction

Kong

Operations

Reference