Guide to Hashicorp Consul/Vault with Kubernetes | K&C Consulting

Guide to Hashicorp Consul/Vault with Kubernetes | K&C Consulting

Hashicorp Consul/Vault As An Extra Security Layer When Using Kubernetes

In this edition of our Kubernetes consulting series, we look at the role of Hashicorp’s Consul and Vault as an additional security layer when using Kubernetes to orchestrate containers.

Kubernetes is one of the most advanced container orchestration systems used in contemporary microservices and serverless architectures. It’s compatible across Cloud vendors so can be used on AWS, Google Cloud Platform or Azure. Kubernetes orchestration provides heavy security, application scalability and most importantly, isolation for different types of products.

These features play a key role once you have started developing your app, as they ensure that your microservices, which work in containers, are isolated and secure from each other, so no intruder can affect the work of your entire ecosystem. But sometimes you need an extra layer of security, policy management, audit logging, system monitoring, or service discovery.

That’s where Consul and Vault really help to fortify the whole infrastructure. The implementation of Consul or Vault in Kubernetes, or Kubernetes itself is not an easy task. K&C has a great track record helping companies to achieve their goals in DevOps Services deployment. Furthermore, with Hashicorp Cloud Infrastructure, the development, deployment and security of application infrastructure will be easier and more effective. But what does each and every piece of the new software do, and why is it important to implement?

Hashicorp Consul – Service discovery and system orchestration

Static networking is a thing of the past, as nowadays systems require scalability and fast service discovery once new elements are added into the system. Consul provides dynamic networking and takes us away from the classic host-based systems and moves us to a service-based approach. Outside of the new networking changes, there won’t be static firewalls, as Consul moves us to dynamic service segmentation, meaning an entirely new level of security.

Additionally, due to complex Kubernetes ecosystems, we always need to keep track of our system’s health in order to know the load and identify other important indicators. Consul is a service discovery tool that allows you to know the load of every Pod in your infrastructure. This is done by registering all of your services and providing the HTTP and DNS interfaces. It can then get the query from different network elements to know the state. Now every service can dynamically discover and monitor the other service in a desired sequence and successfully communicate with it.

Consul cluster will store all the information about the cluster itself, health checks, the client’s services in /consul/data, as a volume. The container shows its data directory so the clients can see it, and if it disappears on the client side, it won’t affect any cluster operations. On the server side it stores the client’s information, snapshots, and other important data so the server can recover after an outage. Thus, teams have to take care of containers with consul cluster data, so they are not destroyed once a reboot is completed. When you are running Consul in a container, you have to make sure that an appropriate client address and cluster addresses are assigned. Moreover, you need to add the cluster address when it has just started, to make sure that it finds the correct interface and advertises one that it deems workable to the rest of the Consul participants.

Security is ensured via TLS certificates, service-to-service communication and identity based authorization. Consul can segment the network into different parts, providing each part with its privileges and communication policies without IP-based rules. If it’s not enough and you want to add an extra layer of security, then here’s where Vault comes into play…

Hashicorp in Kubernets

Hashicorp Vault – the top-notch secret management solution

Communication between applications and systems can be vulnerable, and what can really solve the situation of unauthorized access are dynamically created secrets. These secrets are created and exist only when apps or services really need them, and that’s a fantastic feature, because no-one actually knows the secrets and passwords. Moreover, apps and services expect secrets to expire at some point in time. Communication between apps and services have become more reliable with Vault.

These practices allow Vault to avoid providing random users with root privileges to underlying systems. Furthermore, it can also revoke secrets and do key rolling.

Kubernetes Represents a Secure Alliance

Kubernetes clusters provide a couple of heavy security layers that can make your system bulletproof in every way. Furthermore, Consul will allow you to monitor your system’s health and if there is a problem, then it can easily be spotted. Vault provides the possibility to add an additional layer of security in communication between the different network elements, as not only will dynamic secrets protect your company from unnecessary password leaks, but it will ensure that there’s no actual password that can be leaked at all.

Consul implementation

Before you start to implement the Consul you have to install the following:

1.consul

2.cfssl and cfssljson 1.2

Generation of TLS Certificates

RPS communication between each Consul element will be encrypted with TLS. Now we have to Initiate Certificate Authority (CA):

Create certificate and key for Consul:

Now we have the following files:

Generate the Consul Gossip Encryption Key

Gossip communication between Consul elements will be encrypted with a shared key. Generate and save the key:

Creating the Consul Secret and ConfigMap

Saving gossip key and TLS Certificates in Secret:

Now we have to save Consul Configuration in ConfigMap:

Consul Service

service.yaml:

StatfulSet

Deploying 3 Pods:

statefulset.yaml:

Checking the launched nodes:

Final Check

Forward the port to the local machine:

Check the Web-UI

Simply open the https://127.0.0.1:8500 in your browser.

If all the steps above were done correctly, then you have the Consul ready to help with your needs.

Vault Implementation

We’ll be running Vault in Kubernetes, first of all we have to create the configuration file vault.hcl and insert the following:

Creating ConfigMap:

Creating service.yaml:

Create deployment.yaml as well:

Applying Changes

If everything was done correctly, then we should see that the service is working. Let’s begin the initialization and port forwarding to your local machine:

Check the following in the other window:

For convenience, we’ll make initialization with one unsealed key.

Vault initialized with 1 key shares and a key threshold of 1. Please securely distribute the key shares printed above. When the Vault is re-sealed, restarted, or stopped, you must supply at least 1 of these keys to unseal it before it can start servicing requests. Vault does not store the generated master key. Without at least 1 key to reconstruct the master key, Vault will remain permanently sealed! It is possible to generate new unseal keys, provided you have a quorum of existing unseal keys shares. See “vault rekey” for more information.

Make sure to save the output that you are going to get at this stage, because we need the unseal keys and root token. Now we have to unpack the vault with an unseal key:

Login into the vault with root token:

Save the secret:

Update the secret:

It has created the second version of data in secret/apikey. Refresh it once more:

Now, let’s see what we’ve got:

PUT refreshes all of the data in the secret. In order to add changes without losing the old data we have to run the following command:

Let’s check what we have got:

By the way, you can work with different versions:

If all of the steps are executed successfully then you should have a fully working, deployed Vault, which will make a great addition to your ecosystem.

Add comment

E-mail is already registered on the site. Please use the Login form or enter another.

You entered an incorrect username or password

Sorry that something went wrong, repeat again!
Contact us