How did you add Vault support to the Kubernetes cluster?

The following steps are typically performed to add Vault support to a Kubernetes cluster:

1. Installing Vault: Deploy the Vault server, often as a StatefulSet or Deployment within or outside the cluster.
2. Configuring authentication: Set up the Kubernetes authentication method (e.g., Kubernetes Auth) so that pods can obtain Vault tokens.
3. Creating Vault policies: Define access policies that restrict application rights.
4. Integrating with applications: Applications retrieve secrets via sidecar containers, init containers, or directly through the Vault API.
5. Using the CSI driver: Mount Vault secrets as volumes in pods.

Example manifest for enabling Kubernetes Auth in Vault:

# In Vault CLI
vault auth enable kubernetes
vault write auth/kubernetes/config \
    token_reviewer_jwt="<JWT_TOKEN>" \
    kubernetes_host="https://<K8S_API>" \
    kubernetes_ca_cert=@ca.crt

vault write auth/kubernetes/role/my-role \
    bound_service_account_names=my-service-account \
    bound_service_account_namespaces=default \
    policies=my-policy \
    ttl=24h

Thus, applications in Kubernetes can securely access Vault secrets using their service accounts.