<commit_before># Using the Kubernetes auth backend

This guide shows a simple example of how to set up and authenticate against the Kubernetes auth backend. For more details consult the Vault documentation on the [Kubernetes Auth Backend][kubernetes-auth-backend].

In this example we will:
* Setup the Kubernetes auth backend
* Configure a role for a service account with some policy
* Authenticate Vault requests using the service account token

### Prerequisites
* Tectonic 1.7+

## Kubernetes auth backend setup

Use the [create-cluster.sh][create-cluster] script to initialize and unseal a vault cluster.

For this example the Vault cluster is assumed to be running in the namespace `vault-services`. Adjust the commands below as needed for your namespace.

### Configure port forwarding

To enable and configure the auth backend with the necessary roles and policies, make the Vault client requests authenticate with the root token.

1. Configure port forwarding between the local machine and the active Vault node:

    ```sh
    kubectl -n vault-services get vault example-vault -o jsonpath='{.status.nodes.active}' | xargs -0 -I {} kubectl -n vault-services port-forward {} 8200
    ```

2. Open a new terminal. Use this terminal for the rest of this guide.

3. Export the following environment for the [Vault CLI environment][vault-cli-env].
    Replace the `<root-token>` with the root token generated during initialization.

    ```sh
    export VAULT_ADDR='https://localhost:8200'
    export VAULT_SKIP_VERIFY="true"
    export VAULT_TOKEN=<root-token>
    ```

### Set up service account for Vault token review

1. Create the service account `vault-tokenreview`:

```sh
kubectl -n vault-services create serviceaccount vault-tokenreview
```

2. Create the ClusterRoleBinding for the `vault-tokenreview` service account to access the k8s TokenReview API:

```sh
kubectl -n vault-services create -f example/k8s_auth/vault-tokenreview-binding.yaml
```

3. Fetch the token for the `vault-tokenreview` service account:
```sh
SECRET_NAME=$(kubectl -n vault-services get serviceaccount vault-tokenreview -o jsonpath='{.secrets[0].name}')
TR_ACCOUNT_TOKEN=$(kubectl -n vault-services get secret ${SECRET_NAME} -o jsonpath='{.data.token}' | base64 --decode)
```

### Enable and configure the backend

1. Enable the Kubernetes auth backend:

    ```sh
    vault auth-enable kubernetes
    ```
2. Configure the backend with the Kubernetes master server URL and certificate-authority-data.

    ```sh
    vault write auth/kubernetes/config kubernetes_host=<server-url> kubernetes_ca_cert=@ca.crt token_reviewer_jwt=$TR_ACCOUNT_TOKEN
    ```

### Create a policy and role

The Kubernetes backend authorizes an entity by granting it a role mapped to a service account. A role is configured with policies which control the entity's access to paths and operations in Vault.

1. Create a new policy `demo-policy` using example policy file `policy.hcl`.

    ```sh
    vault write sys/policy/demo-policy policy=@example/k8s_auth/policy.hcl
    ```

2. Create a new role `demo-role` configured for the service account `default` and policy `demo-policy`:

    ```sh
    vault write auth/kubernetes/role/demo-role \
        bound_service_account_names=default \
        bound_service_account_namespaces=vault-services \
        policies=demo-policy \
        ttl=1h
    ```

## Authenticate requests using the service account token

The backend can now be used to authenticate Vault requests using the service account `default`.

### Authenticate

Now use the service account token to authenticate for the role `demo-role`

1. Fetch the token for the `default` service account:
```sh
SECRET_NAME=$(kubectl -n vault-services get serviceaccount default -o jsonpath='{.secrets[0].name}')
DEFAULT_ACCOUNT_TOKEN=$(kubectl -n vault-services get secret ${SECRET_NAME} -o jsonpath='{.data.token}' | base64 --decode)
```

2. Log in to the Kubernetes auth backend using the service account token:
```sh
$ vault write auth/kubernetes/login role=demo-role jwt=${DEFAULT_ACCOUNT_TOKEN}
Key                                   	Value
---                                   	-----
token                                 	<PASSWORD>
token_accessor                        	4893b0a1-f42a-bfd8-cd9c-c14b9bdb6095
token_duration                        	1h0m0s
token_renewable                       	true
token_policies                        	[default demo-policy]
token_meta_role                       	"demo-role"
token_meta_service_account_name       	"demo"
token_meta_service_account_namespace  	"vault-services"
token_meta_service_account_secret_name	"demo-token-fndln"
token_meta_service_account_uid        	"<KEY>"
```

3. Set the `VAULT_TOKEN` to the value of the key `token` from the output of the last step:
```sh
export VAULT_TOKEN=<PASSWORD>
```

### Issue requests

With the above `VAULT_TOKEN` set, the Vault requests will be authenticated according to the role `demo-role` and the policy `demo-policy`.

Confirm that the policy enables secret creation only under the path "secret/demo/":

```sh
$ vault write secret/demo/foo value=bar
Success! Data written to: secret/demo/foo
```

Reject requests on non-"secret/demo/" path:

```sh
$ vault write secret/foo value=bar
Error writing data to secret/foo: Error making API request.<commit_msg>doc: minor fix<commit_after># Using the Kubernetes auth backend

This guide shows a simple example of how to set up and authenticate against the Kubernetes auth backend. For more details consult the Vault documentation on the [Kubernetes Auth Backend][kubernetes-auth-backend].

In this example we will:
* Setup the Kubernetes auth backend
* Configure a role for a service account with some policy
* Authenticate Vault requests using the service account token

### Prerequisites
* Tectonic 1.7+

## Kubernetes auth backend setup

Use the [create-cluster.sh][create-cluster] script to initialize and unseal a vault cluster.

For this example the Vault cluster is assumed to be running in the namespace `vault-services`. Adjust the commands below as needed for your namespace.

### Configure port forwarding

To enable and configure the auth backend with the necessary roles and policies, make the Vault client requests authenticate with the root token.

1. Configure port forwarding between the local machine and the active Vault node:

    ```sh
    kubectl -n vault-services get vault example-vault -o jsonpath='{.status.nodes.active}' | xargs -0 -I {} kubectl -n vault-services port-forward {} 8200
    ```

2. Open a new terminal. Use this terminal for the rest of this guide.

3. Export the following environment for the [Vault CLI environment][vault-cli-env].
    Replace the `<root-token>` with the root token generated during initialization.

    ```sh
    export VAULT_ADDR='https://localhost:8200'
    export VAULT_SKIP_VERIFY="true"
    export VAULT_TOKEN=<root-token>
    ```

### Set up service account for Vault token review

1. Create the service account `vault-tokenreview`:

```sh
kubectl -n vault-services create serviceaccount vault-tokenreview
```

2. Create the ClusterRoleBinding for the `vault-tokenreview` service account to access the k8s TokenReview API:

```sh
kubectl -n vault-services create -f example/k8s_auth/vault-tokenreview-binding.yaml
```

3. Fetch the token for the `vault-tokenreview` service account:
```sh
SECRET_NAME=$(kubectl -n vault-services get serviceaccount vault-tokenreview -o jsonpath='{.secrets[0].name}')
TR_ACCOUNT_TOKEN=$(kubectl -n vault-services get secret ${SECRET_NAME} -o jsonpath='{.data.token}' | base64 --decode)
```

### Enable and configure the backend

1. Enable the Kubernetes auth backend:

    ```sh
    vault auth-enable kubernetes
    ```
2. Configure the backend with the Kubernetes master server URL and certificate-authority-data.

    ```sh
    vault write auth/kubernetes/config kubernetes_host=<server-url> kubernetes_ca_cert=@ca.crt token_reviewer_jwt=$TR_ACCOUNT_TOKEN
    ```

### Create a policy and role

The Kubernetes backend authorizes an entity by granting it a role mapped to a service account. A role is configured with policies which control the entity's access to paths and operations in Vault.

1. Create a new policy `demo-policy` using example policy file `policy.hcl`.

    ```sh
    vault write sys/policy/demo-policy policy=@example/k8s_auth/policy.hcl
    ```

2. Create a new role `demo-role` configured for the service account `default` and policy `demo-policy`:

    ```sh
    vault write auth/kubernetes/role/demo-role \
        bound_service_account_names=default \
        bound_service_account_namespaces=vault-services \
        policies=demo-policy \
        ttl=1h
    ```

## Authenticate requests using the service account token

The backend can now be used to authenticate Vault requests using the service account `default`.

### Authenticate

Now use the service account token to authenticate for the role `demo-role`

1. Fetch the token for the `default` service account:
```sh
SECRET_NAME=$(kubectl -n vault-services get serviceaccount default -o jsonpath='{.secrets[0].name}')
DEFAULT_ACCOUNT_TOKEN=$(kubectl -n vault-services get secret ${SECRET_NAME} -o jsonpath='{.data.token}' | base64 --decode)
```

2. Log in to the Kubernetes auth backend using the service account token:
```sh
$ vault write auth/kubernetes/login role=demo-role jwt=${DEFAULT_ACCOUNT_TOKEN}
Key                                   	Value
---                                   	-----
token                                 	746<PASSWORD>-<PASSWORD>-4<PASSWORD>-<PASSWORD>-d<PASSWORD>
token_accessor                        	4893b0a1-f42a-bfd8-cd9c-c14b9bdb6095
token_duration                        	1h0m0s
token_renewable                       	true
token_policies                        	[default demo-policy]
token_meta_role                       	"demo-role"
token_meta_service_account_name       	"default"
token_meta_service_account_namespace  	"vault-services"
token_meta_service_account_secret_name	"default-token-fndln"
token_meta_service_account_uid        	"<KEY>"
```

3. Set the `VAULT_TOKEN` to the value of the key `token` from the output of the last step:
```sh
export VAULT_TOKEN=<PASSWORD>
```

### Issue requests

With the above `VAULT_TOKEN` set, the Vault requests will be authenticated according to the role `demo-role` and the policy `demo-policy`.

Confirm that the policy enables secret creation only under the path "secret/demo/":

```sh
$ vault write secret/demo/foo value=bar
Success! Data written to: secret/demo/foo
```

Reject requests on non-"secret/demo/" path:

```sh
$ vault write secret/foo value=bar
Error writing data to secret/foo: Error making API request.
{'fraction_non_alphanumeric': 0.08588785046728972, 'fraction_numerical': 0.010467289719626169, 'mean_word_length': 3.5828693790149893, 'pattern_counts': {'":': 2, '<': 19, '<?xml version=': 0, '>': 19, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 6, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6420210', 'n_tokens_mistral': 3148, 'n_tokens_neox': 3006, 'n_words': 1149}