Storing the ACL Replication Token in Vault

    To use an ACL replication token stored in Vault, we will follow the steps outlined in the Data Integration section:

    1. Store the secret in Vault.
    2. Create a Vault policy that authorizes the desired level of access to the secret.

    Setup per Consul datacenter

    1. Create Vault Kubernetes auth roles that link the policy to each Consul on Kubernetes service account that requires access.
    2. Update the Consul on Kubernetes helm chart.

    Prior to setting up the data integration between Vault and Consul on Kubernetes, you will need to have:

    1. Read and completed the steps in the Systems Integration section of .
    2. Read the Data Integration Overview section of .

    First, generate and store the ACL replication token in Vault:

    Create a Vault policy that authorizes the desired level of access to the secret

    Note: The secret path referenced by the Vault Policy below will be your global.acls.replicationToken.secretName Helm value.

    1.   capabilities = ["read"]
    2. }

    replication-token-policy.hcl

    1. path "secret/data/consul/replication-token" {
    2.   capabilities = ["read"]
    3. }

    Apply the Vault policy by issuing the vault policy write CLI command:

    1. $ vault policy write replication-token-policy replication-token-policy.hcl

    Next, you will create Kubernetes auth roles for the Consul server-acl-init job:

    1. $ vault write auth/kubernetes/role/consul-server-acl-init \
    2.     bound_service_account_names=<Consul server service account> \
    3.     bound_service_account_namespaces=<Consul installation namespace> \
    5.     ttl=1h
    1. $ vault write auth/kubernetes/role/consul-server-acl-init \
    2.     bound_service_account_names=<Consul server service account> \
    3.     bound_service_account_namespaces=<Consul installation namespace> \
    4.     policies=replication-token-policy \
    5.     ttl=1h
    1. $ helm template --release-name ${RELEASE_NAME} -s templates/server-acl-init-serviceaccount.yaml hashicorp/consul

    Update the Consul on Kubernetes helm chart

    Now that you have configured Vault, you can configure the Consul Helm chart to use the ACL replication token key in Vault:

    1.   secretsBackend:
    2.     vault:
    3.       enabled: true
    4.       manageSystemACLsRole: consul-server-acl-init
    6.     replicationToken:
    7.       secretName: secret/data/consul/replication-token
    8.       secretKey: token

    Replication Token - 图2

    values.yaml

    1. global:
    2.   secretsBackend:
    3.     vault:
    4.       enabled: true
    5.       manageSystemACLsRole: consul-server-acl-init
    6.   acls:
    7.     replicationToken:
    8.       secretName: secret/data/consul/replication-token
    9.       secretKey: token

    Note that global.acls.replicationToken.secretName is the path of the secret in Vault. This should be the same path as the one you included in your Vault policy. is the key inside the secret data. This should be the same as the key you passed when creating the ACL replication token secret in Vault.