35 lines
10 KiB
HTML
35 lines
10 KiB
HTML
<html><head>
|
|
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
|
<title>103. GCP-IAM authentication</title><link rel="stylesheet" type="text/css" href="css/manual-multipage.css"><meta name="generator" content="DocBook XSL Stylesheets V1.78.1"><link rel="home" href="multi_spring-cloud.html" title="Spring Cloud"><link rel="up" href="multi__spring_cloud_vault.html" title="Part XIV. Spring Cloud Vault"><link rel="prev" href="multi_vault.config.authentication.gcpgce.html" title="102. GCP-GCE authentication"><link rel="next" href="multi_vault.config.backends.html" title="104. Secret Backends"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">103. GCP-IAM authentication</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="multi_vault.config.authentication.gcpgce.html">Prev</a> </td><th width="60%" align="center">Part XIV. Spring Cloud Vault</th><td width="20%" align="right"> <a accesskey="n" href="multi_vault.config.backends.html">Next</a></td></tr></table><hr></div><div class="chapter"><div class="titlepage"><div><div><h2 class="title"><a name="vault.config.authentication.gcpiam" href="#vault.config.authentication.gcpiam"></a>103. GCP-IAM authentication</h2></div></div></div><p>The <a class="link" href="https://www.vaultproject.io/docs/auth/gcp.html" target="_top">gcp</a>
|
|
auth backend allows Vault login by using existing GCP (Google Cloud Platform) IAM and GCE credentials.</p><p>GCP IAM authentication creates a signature in the form of a JSON Web Token (JWT)
|
|
for a service account. A JWT for a service account is obtained by
|
|
calling GCP IAM’s <a class="link" href="https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts/signJwt" target="_top"><code class="literal">projects.serviceAccounts.signJwt</code></a> API. The caller authenticates against GCP IAM
|
|
and proves thereby its identity. This Vault backend treats GCP as a Trusted Third Party.</p><p>IAM credentials can be obtained from either the runtime environment
|
|
, specifically the <a class="link" href="https://cloud.google.com/docs/authentication/production" target="_top"><code class="literal">GOOGLE_APPLICATION_CREDENTIALS</code></a>
|
|
environment variable, the Google Compute metadata service,
|
|
or supplied externally as e.g. JSON or base64 encoded.
|
|
JSON is the preferred form as it carries the project id and
|
|
service account identifier required for calling <code class="literal">projects.serviceAccounts.signJwt</code>.</p><div class="example"><a name="d0e30694" href="#d0e30694"></a><p class="title"><b>Example 103.1. bootstrap.yml with required GCP-IAM Authentication properties</b></p><div class="example-contents"><pre class="programlisting"><span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute">spring.cloud.vault</span>:
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> authentication</span>: GCP_IAM
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> gcp-iam</span>:
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> role</span>: my-dev-role</pre></div></div><br class="example-break"><div class="example"><a name="d0e30699" href="#d0e30699"></a><p class="title"><b>Example 103.2. bootstrap.yml with all GCP-IAM Authentication properties</b></p><div class="example-contents"><pre class="programlisting"><span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute">spring.cloud.vault</span>:
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> authentication</span>: GCP_IAM
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> gcp-iam</span>:
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> credentials</span>:
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> location</span>: classpath:credentials.json
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> encoded-key</span>: e+KApn0=
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> gcp-path</span>: gcp
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> jwt-validity</span>: <span class="hl-number">15</span>m
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> project-id</span>: my-project-id
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> role</span>: my-dev-role
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> service-account</span>: my-service@projectid.iam.gserviceaccount.com</pre></div></div><br class="example-break"><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><code class="literal">role</code> sets the name of the role against which the login is being attempted.</li><li class="listitem"><code class="literal">credentials.location</code> path to the credentials resource that contains Google credentials in JSON format.</li><li class="listitem"><code class="literal">credentials.encoded-key</code> the base64 encoded contents of an OAuth2 account private key in the JSON format.</li><li class="listitem"><code class="literal">gcp-path</code> sets the path of the GCP mount to use</li><li class="listitem"><code class="literal">jwt-validity</code> configures the JWT token validity. Defaults to 15 minutes.</li><li class="listitem"><code class="literal">project-id</code> allows overriding the project Id to a specific value. Defaults to the project Id from the obtained credential.</li><li class="listitem"><code class="literal">service-account</code> allows overriding the service account Id to a specific value. Defaults to the service account from the obtained credential.</li></ul></div><p>GCP IAM authentication requires the Google Cloud Java SDK dependency
|
|
(<code class="literal">com.google.apis:google-api-services-iam</code> and <code class="literal">com.google.auth:google-auth-library-oauth2-http</code>)
|
|
as the authentication implementation uses Google APIs for credentials and JWT signing.</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><table border="0" summary="Note"><tr><td rowspan="2" align="center" valign="top" width="25"><img alt="[Note]" src="images/note.png"></td><th align="left">Note</th></tr><tr><td align="left" valign="top"><p>Google credentials require an OAuth 2 token maintaining the token lifecycle. All API
|
|
is synchronous therefore, <code class="literal">GcpIamAuthentication</code> does not support <code class="literal">AuthenticationSteps</code> which is
|
|
required for reactive usage.</p></td></tr></table></div><p>See also:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><a class="link" href="https://www.vaultproject.io/docs/auth/gcp.html" target="_top">Vault Documentation: Using the GCP auth backend</a></li><li class="listitem"><a class="link" href="https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts/signJwt" target="_top">GCP Documentation: projects.serviceAccounts.signJwt</a><a name="vault.authentication.gcpiam" href="#vault.authentication.gcpiam"></a></li></ul></div><div class="section"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="vault.config.authentication.kubernetes" href="#vault.config.authentication.kubernetes"></a>103.1 Kubernetes authentication</h2></div></div></div><p>Kubernetes authentication mechanism (since Vault 0.8.3) allows to authenticate with Vault using a Kubernetes Service Account Token.
|
|
The authentication is role based and the role is bound to a service account name and a namespace.</p><p>A file containing a JWT token for a pod’s service account is automatically mounted at <code class="literal">/var/run/secrets/kubernetes.io/serviceaccount/token</code>.</p><div class="example"><a name="d0e30779" href="#d0e30779"></a><p class="title"><b>Example 103.3. bootstrap.yml with all Kubernetes authentication properties</b></p><div class="example-contents"><pre class="programlisting"><span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute">spring.cloud.vault</span>:
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> authentication</span>: KUBERNETES
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> kubernetes</span>:
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> role</span>: my-dev-role
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> kubernetes-path</span>: kubernetes
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> service-account-token-file</span>: /var/run/secrets/kubernetes.io/serviceaccount/token</pre></div></div><br class="example-break"><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><code class="literal">role</code> sets the Role.</li><li class="listitem"><code class="literal">kubernetes-path</code> sets the path of the Kubernetes mount to use.</li><li class="listitem"><code class="literal">service-account-token-file</code> sets the location of the file containing the Kubernetes Service Account Token. Defaults to <code class="literal">/var/run/secrets/kubernetes.io/serviceaccount/token</code>.</li></ul></div><p>See also:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><a class="link" href="https://www.vaultproject.io/docs/auth/kubernetes.html" target="_top">Vault Documentation: Kubernetes</a></li><li class="listitem"><a class="link" href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/" target="_top">Kubernetes Documentation: Configure Service Accounts for Pods</a></li></ul></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="multi_vault.config.authentication.gcpgce.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="multi__spring_cloud_vault.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="multi_vault.config.backends.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">102. GCP-GCE authentication </td><td width="20%" align="center"><a accesskey="h" href="multi_spring-cloud.html">Home</a></td><td width="40%" align="right" valign="top"> 104. Secret Backends</td></tr></table></div></body></html> |