Skip to content

Commit 2d2c731

Browse files
Dhruv-Soni11Dhruv-Soni11
authored
Merge pull request #96694 from Dhruv-Soni11/RHDEVDOCS-6360
RHDEVDOCS-6360: Reviews for External secrets stores
2 parents 8a8b2eb + 6b756fa commit 2d2c731

3 files changed

Lines changed: 210 additions & 0 deletions

File tree

‎_topic_maps/_topic_map.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,8 @@ Topics:
117117
File: securing-webhooks-with-event-listeners
118118
- Name: Authenticating pipelines with repositories using secrets
119119
File: authenticating-pipelines-repos-using-secrets
120+
- Name: Using secrets from external secret stores
121+
File: using-secrets-from-external-secret-stores
120122
- Name: Unprivileged building of container images using Buildah
121123
File: unprivileged-building-of-container-images-using-buildah
122124
- Name: Using buildah-ns tekton task

‎modules/op-csi-secrets.adoc‎

Lines changed: 190 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,190 @@
1+
// This module is included in the following assembly:
2+
//
3+
// * secure/using-csi-secrets.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="consuming-secrets-csi_{context}"]
7+
= Consuming secrets from external stores using the Secrets Store CSI Driver
8+
9+
[role="_abstract"]
10+
To use secrets from an external secret store that has a Container Storage Interface (CSI) provider, such as HashiCorp Vault, you can configure {pipelines-shortname} to consume these secrets using the Secrets Store CSI Driver.
11+
12+
.Prerequisites
13+
14+
* You installed the Secrets Store CSI Driver. For information about installing the CSI Driver, see the link:https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/storage/using-container-storage-interface-csi#persistent-storage-csi-secrets-store[Secrets Store CSI Driver] in the {OCP} documentation.
15+
16+
* You installed the CSI provider for your external secret store. For information about installing HashiCorp Vault, including its CSI provider, on {OCP}, see link:https://developer.hashicorp.com/vault/docs/deploy/kubernetes/csi/installation[Install the Vault CSI provider] in the Hashicorp documentation.
17+
+
18+
[NOTE]
19+
====
20+
To use an instance of HashiCorp Vault running outside your {OCP} cluster, you must provide the address to that instance in the Helm configuration when installing the CSI Provider. For information about providing an external Vault address, see link:https://developer.hashicorp.com/vault/docs/deploy/kubernetes/helm/configuration#externalvaultaddr[Configuration] in the Hashicorp documentation.
21+
====
22+
23+
* You configured authentication with the secret store for an {OCP} service account, for example, `pipeline-sa`. For information about configuring Kubernetes authentication with HashiCorp Vault, see link:https://developer.hashicorp.com/vault/docs/auth/kubernetes[Kubernetes auth method] in the HashiCorp documentation.
24+
+
25+
[NOTE]
26+
====
27+
You must create the service account in the namespace in which you create pipelines and other Custom Resources (CRs) for {pipelines-shortname}.
28+
====
29+
30+
* Ensure that the Secrets Store CSI Driver service account has the required cluster-wide permissions to create service account tokens in all relevant namespaces. Without these permissions, pods will fail to start and you may encounter the following error:
31+
+
32+
[source,terminal]
33+
----
34+
User "system:serviceaccount:csi-driver:secrets-store-csi-driver" cannot create resource "serviceaccounts/token" in API group "" in the namespace "tekton-vault"
35+
----
36+
37+
.Procedure
38+
39+
. To allow the CSI driver to mount secrets volumes, configure the namespace to allow privileged pod security:
40+
+
41+
[source,terminal]
42+
----
43+
$ oc label namespace tekton-vault pod-security.kubernetes.io/enforce=privileged
44+
----
45+
46+
. In the namespace in which you create pipelines, for example, `tekton-vault`, create a `Role` resource that allows `get`, `list`, and `watch` operations for the `secrets` resource.
47+
+
48+
[source,yaml]
49+
----
50+
apiVersion: rbac.authorization.k8s.io/v1
51+
kind: Role
52+
metadata:
53+
name: pipeline-role
54+
namespace: tekton-vault
55+
rules:
56+
- apiGroups: [""]
57+
resources: ["secrets"]
58+
verbs: ["get", "list", "watch"]
59+
----
60+
61+
. Create a `RoleBinding` resource that binds the `pipeline-role` role to the service account which you configured for authentication with the secret store, for example, `pipeline-sa`.
62+
+
63+
[source,yaml]
64+
----
65+
apiVersion: rbac.authorization.k8s.io/v1
66+
kind: RoleBinding
67+
metadata:
68+
name: pipeline-role-binding
69+
namespace: tekton-vault
70+
roleRef:
71+
apiGroup: rbac.authorization.k8s.io
72+
kind: Role
73+
name: pipeline-role
74+
subjects:
75+
- kind: ServiceAccount
76+
name: pipeline-sa
77+
namespace: tekton-vault
78+
----
79+
80+
. Create a `SecretProviderClass` CR that defines the secrets that your pipeline or task consumes and the mount path and filename (key) for each of these secrets.
81+
+
82+
[source,yaml]
83+
----
84+
apiVersion: secrets-store.csi.x-k8s.io/v1
85+
kind: SecretProviderClass
86+
metadata:
87+
name: vault-secret
88+
namespace: tekton-vault
89+
spec:
90+
provider: vault
91+
parameters:
92+
vaultAddress: "http://vault.vault:8200"
93+
vaultSkipTLSVerify: "true"
94+
roleName: "my-role"
95+
objects: |
96+
- objectName: "demo-secret"
97+
secretPath: "secret/data/my-secret"
98+
secretKey: "username"
99+
- objectName: "demo-secret-pass"
100+
secretPath: "secret/data/my-secret"
101+
secretKey: "password"
102+
----
103+
+
104+
[WARNING]
105+
====
106+
The `vaultAddress` parameter used in this example uses `http` and `vaultSkipTLSVerify`: `"true"` only for demonstration purposes. For production use, configure Vault with a secure `https` endpoint and do not skip TLS verification.
107+
====
108+
109+
. In the definition of the task that consumes the secrets, define and mount a volume that uses the CSI secrets store driver and specifies the name of the `SecretProviderClass` CR. To minimise security exposure of secrets, mount them in the definition of a task and not of an entire pipeline.
110+
+
111+
[source,yaml]
112+
----
113+
apiVersion: tekton.dev/v1
114+
kind: Task
115+
metadata:
116+
name: secret-task
117+
namespace: tekton-vault
118+
spec:
119+
steps:
120+
- name: use-secret
121+
image: registry.access.redhat.com/ubi8/ubi-minimal:latest
122+
script: |
123+
#!/bin/sh
124+
echo "Reading secrets from mounted volume..."
125+
echo "Username: $(cat /mnt/secrets-store/demo-secret)"
126+
echo "Password: $(cat /mnt/secrets-store/demo-secret-pass)"
127+
volumeMounts:
128+
- name: secrets-store-inline
129+
mountPath: "/mnt/secrets-store"
130+
readOnly: true
131+
volumes:
132+
- name: secrets-store-inline
133+
csi:
134+
driver: secrets-store.csi.k8s.io
135+
readOnly: true
136+
volumeAttributes:
137+
secretProviderClass: "vault-secret"
138+
----
139+
+
140+
[NOTE]
141+
====
142+
* The mount path that you specify in the pipeline or task definition overrides the path that you specify in the `SecretProviderClass` CR.
143+
144+
* This example provides secrets for demonstration purposes only. In production environment, do not log secrets as they are visible in pod logs.
145+
====
146+
147+
. In the `PipelineRun` or `TaskRun` CR, assign the service account that is authenticated with the secret store to the task:
148+
149+
** If you create a `PipelineRun` CR, use the `taskRunSpecs` section to assign the service account to the particular task. Do not assign the service account to the entire pipeline.
150+
+
151+
[source,yaml]
152+
----
153+
apiVersion: tekton.dev/v1
154+
kind: Pipeline
155+
metadata:
156+
name: vault-secret-pipeline
157+
namespace: tekton-vault
158+
spec:
159+
tasks:
160+
- name: read-secret
161+
taskRef:
162+
name: secret-task
163+
---
164+
apiVersion: tekton.dev/v1
165+
kind: PipelineRun
166+
metadata:
167+
name: vault-secret-pipeline-run
168+
namespace: tekton-vault
169+
spec:
170+
pipelineRef:
171+
name: vault-secret-pipeline
172+
taskRunSpecs:
173+
- pipelineTaskName: read-secret
174+
serviceAccountName: pipeline-sa
175+
----
176+
177+
** If you create a `TaskRun` CR, use the `serviceAccountName` setting to assign the service account.
178+
+
179+
[source,yaml]
180+
----
181+
apiVersion: tekton.dev/v1
182+
kind: TaskRun
183+
metadata:
184+
name: vault-secret-task-run
185+
namespace: tekton-vault
186+
spec:
187+
taskRef:
188+
name: secret-task
189+
serviceAccountName: pipeline-sa
190+
----

‎secure/using-secrets-from-external-secret-stores.adoc‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
include::_attributes/common-attributes.adoc[]
3+
[id="using-secrets-from-external-secret-stores"]
4+
= Using secrets from external secret stores
5+
:context: using-secrets-from-external-secret-stores
6+
7+
toc::[]
8+
9+
[role="_abstract"]
10+
You can configure pipelines to consume secrets from external secret stores by using the Secrets Store CSI Driver.
11+
12+
include::modules/op-csi-secrets.adoc[leveloffset=+1]
13+
14+
[role="_additional-resources"]
15+
[id="additional-resources_{context}"]
16+
== Additional resources
17+
18+
link:https://secrets-store-csi-driver.sigs.k8s.io/getting-started/installation.html[Install the Secrets Store CSI Driver]

0 commit comments

Comments
 (0)