20 lines
5.6 KiB
HTML
20 lines
5.6 KiB
HTML
<html><head>
|
|
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
|
<title>102. GCP-GCE authentication</title><link rel="stylesheet" type="text/css" href="css/manual-multipage.css"><meta name="generator" content="DocBook XSL Stylesheets V1.78.1"><link rel="home" href="multi_spring-cloud.html" title="Spring Cloud"><link rel="up" href="multi__spring_cloud_vault.html" title="Part XIV. Spring Cloud Vault"><link rel="prev" href="multi_vault.config.authentication.html" title="101. Authentication methods"><link rel="next" href="multi_vault.config.authentication.gcpiam.html" title="103. GCP-IAM authentication"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">102. GCP-GCE authentication</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="multi_vault.config.authentication.html">Prev</a> </td><th width="60%" align="center">Part XIV. Spring Cloud Vault</th><td width="20%" align="right"> <a accesskey="n" href="multi_vault.config.authentication.gcpiam.html">Next</a></td></tr></table><hr></div><div class="chapter"><div class="titlepage"><div><div><h2 class="title"><a name="vault.config.authentication.gcpgce" href="#vault.config.authentication.gcpgce"></a>102. GCP-GCE authentication</h2></div></div></div><p>The <a class="link" href="https://www.vaultproject.io/docs/auth/gcp.html" target="_top">gcp</a>
|
|
auth backend allows Vault login by using existing GCP (Google Cloud Platform) IAM and GCE credentials.</p><p>GCP GCE (Google Compute Engine) authentication creates a signature in the form of a
|
|
JSON Web Token (JWT) for a service account. A JWT for a Compute Engine instance
|
|
is obtained from the GCE metadata service using <a class="link" href="https://cloud.google.com/compute/docs/instances/verifying-instance-identity" target="_top">Instance identification</a>.
|
|
This API creates a JSON Web Token that can be used to confirm the instance identity.</p><p>Unlike most Vault authentication backends, this backend
|
|
does not require first-deploying, or provisioning security-sensitive
|
|
credentials (tokens, username/password, client certificates, etc.).
|
|
Instead, it treats GCP as a Trusted Third Party and uses the
|
|
cryptographically signed dynamic metadata information that uniquely
|
|
represents each GCP service account.</p><div class="example"><a name="d0e30242" href="#d0e30242"></a><p class="title"><b>Example 102.1. bootstrap.yml with required GCP-GCE Authentication properties</b></p><div class="example-contents"><pre class="programlisting"><span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute">spring.cloud.vault</span>:
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> authentication</span>: GCP_GCE
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> gcp-gce</span>:
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> role</span>: my-dev-role</pre></div></div><br class="example-break"><div class="example"><a name="d0e30247" href="#d0e30247"></a><p class="title"><b>Example 102.2. bootstrap.yml with all GCP-GCE Authentication properties</b></p><div class="example-contents"><pre class="programlisting"><span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute">spring.cloud.vault</span>:
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> authentication</span>: GCP_GCE
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> gcp-gce</span>:
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> gcp-path</span>: gcp
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> role</span>: my-dev-role
|
|
<span xmlns:d="http://docbook.org/ns/docbook" class="hl-attribute"> service-account</span>: my-service@projectid.iam.gserviceaccount.com</pre></div></div><br class="example-break"><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><code class="literal">role</code> sets the name of the role against which the login is being attempted.</li><li class="listitem"><code class="literal">gcp-path</code> sets the path of the GCP mount to use</li><li class="listitem"><code class="literal">service-account</code> allows overriding the service account Id to a specific value. Defaults to the <code class="literal">default</code> service account.</li></ul></div><p>See also:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><a class="link" href="https://www.vaultproject.io/docs/auth/gcp.html" target="_top">Vault Documentation: Using the GCP auth backend</a></li><li class="listitem"><a class="link" href="https://cloud.google.com/compute/docs/instances/verifying-instance-identity" target="_top">GCP Documentation: Verifying the Identity of Instances</a></li></ul></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="multi_vault.config.authentication.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="multi__spring_cloud_vault.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="multi_vault.config.authentication.gcpiam.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">101. Authentication methods </td><td width="20%" align="center"><a accesskey="h" href="multi_spring-cloud.html">Home</a></td><td width="40%" align="right" valign="top"> 103. GCP-IAM authentication</td></tr></table></div></body></html> |