How to Use HashiCorp Vault 1.16.0 to Store Secrets for Kubernetes 1.32 Apps

#!/bin/bash
# Pre-flight check script for Vault 1.16.0 + Kubernetes 1.32 integration
# Exit immediately if any command fails
set -euo pipefail
# Enable verbose mode for debugging (comment out in production)
# set -x

# Define required versions
REQUIRED_K8S_VERSION="1.32"
REQUIRED_VAULT_CLI_VERSION="1.16.0"
REQUIRED_HELM_VERSION="3.14.0"
REQUIRED_KUBECTL_VERSION="1.32.0"

# Color codes for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Function to print error and exit
print_error() {
    echo -e "${RED}ERROR: $1${NC}"
    exit 1
}

# Function to print success
print_success() {
    echo -e "${GREEN}✓ $1${NC}"
}

# Function to print warning
print_warning() {
    echo -e "${YELLOW}⚠ $1${NC}"
}

echo "Starting pre-flight checks for Vault 1.16.0 + Kubernetes 1.32 integration..."
echo "--------------------------------------------------------"

# Check if kubectl is installed
if ! command -v kubectl &> /dev/null; then
    print_error "kubectl is not installed. Install kubectl v${REQUIRED_KUBECTL_VERSION} or higher."
fi
print_success "kubectl is installed"

# Check kubectl version
KUBECTL_VERSION=$(kubectl version --client -o json | jq -r '.clientVersion.gitVersion' | sed 's/v//')
if [[ "${KUBECTL_VERSION}" < "${REQUIRED_KUBECTL_VERSION}" ]]; then
    print_error "kubectl version ${KUBECTL_VERSION} is below required ${REQUIRED_KUBECTL_VERSION}"
fi
print_success "kubectl version ${KUBECTL_VERSION} meets requirements"

# Check if kubectl can connect to cluster
if ! kubectl cluster-info &> /dev/null; then
    print_error "kubectl cannot connect to Kubernetes cluster. Check kubeconfig."
fi
print_success "kubectl connected to cluster"

# Check Kubernetes server version
K8S_SERVER_VERSION=$(kubectl version -o json | jq -r '.serverVersion.gitVersion' | sed 's/v//')
if [[ "${K8S_SERVER_VERSION}" != "${REQUIRED_K8S_VERSION}"* ]]; then
    print_warning "Kubernetes server version ${K8S_SERVER_VERSION} is not 1.32.x. Integration may have unexpected behavior."
else
    print_success "Kubernetes server version ${K8S_SERVER_VERSION} matches required 1.32.x"
fi

# Check if helm is installed
if ! command -v helm &> /dev/null; then
    print_error "Helm is not installed. Install Helm v${REQUIRED_HELM_VERSION} or higher."
fi
print_success "Helm is installed"

# Check helm version
HELM_VERSION=$(helm version --short | sed 's/v//')
if [[ "${HELM_VERSION}" < "${REQUIRED_HELM_VERSION}" ]]; then
    print_error "Helm version ${HELM_VERSION} is below required ${REQUIRED_HELM_VERSION}"
fi
print_success "Helm version ${HELM_VERSION} meets requirements"

# Check if vault CLI is installed
if ! command -v vault &> /dev/null; then
    print_error "Vault CLI is not installed. Install Vault CLI v${REQUIRED_VAULT_CLI_VERSION} or higher."
fi
print_success "Vault CLI is installed"

# Check vault CLI version
VAULT_CLI_VERSION=$(vault version | awk '{print $2}' | sed 's/v//')
if [[ "${VAULT_CLI_VERSION}" < "${REQUIRED_VAULT_CLI_VERSION}" ]]; then
    print_error "Vault CLI version ${VAULT_CLI_VERSION} is below required ${REQUIRED_VAULT_CLI_VERSION}"
fi
print_success "Vault CLI version ${VAULT_CLI_VERSION} meets requirements"

# Check if jq is installed (used for JSON parsing)
if ! command -v jq &> /dev/null; then
    print_warning "jq is not installed. Some checks may fail. Install jq for full functionality."
fi

echo "--------------------------------------------------------"
echo -e "${GREEN}All pre-flight checks passed! Proceeding with deployment.${NC}"

#!/bin/bash
# Deploy Vault 1.16.0 to Kubernetes 1.32 via Helm
# Exit on error, undefined variables, pipe failures
set -euo pipefail

# Define variables
VAULT_HELM_CHART_VERSION="0.28.0" # Chart version compatible with Vault 1.16.0
VAULT_NAMESPACE="vault"
VAULT_RELEASE_NAME="vault"
VAULT_VALUES_FILE="vault-1.16-values.yaml"

# Color codes
RED='\033[0;31m'
GREEN='\033[0;32m'
NC='\033[0m'

print_error() {
    echo -e "${RED}ERROR: $1${NC}"
    exit 1
}

print_success() {
    echo -e "${GREEN}✓ $1${NC}"
}

echo "Deploying Vault 1.16.0 to Kubernetes 1.32 cluster..."
echo "--------------------------------------------------------"

# Create namespace for Vault
echo "Creating namespace: ${VAULT_NAMESPACE}"
kubectl create namespace "${VAULT_NAMESPACE}" --dry-run=client -o yaml | kubectl apply -f -
print_success "Namespace ${VAULT_NAMESPACE} created/exists"

# Write Vault Helm values file optimized for K8s 1.32
cat > "${VAULT_VALUES_FILE}" << EOF
# Vault 1.16.0 Helm values for Kubernetes 1.32
global:
  enabled: true
  tlsDisable: false # Enable TLS for all Vault communication

server:
  image:
    repository: hashicorp/vault
    tag: "1.16.0" # Pin to exact Vault version
  ha:
    enabled: true
    replicas: 3 # 3-node HA cluster for production
    raft:
      enabled: true # Use Raft integrated storage (no external storage needed)
  auth:
    kubernetes:
      enabled: true # Enable Kubernetes auth method
      serviceAccount:
        create: true
        name: vault-auth
      role: vault-auth-role
  service:
    type: ClusterIP
    port: 8200
  ingress:
    enabled: false # Disable ingress for this tutorial (use port-forward)
  extraEnvironmentVars:
    VAULT_CACERT: /vault/tls/ca.crt
  tls:
    serverCertificate: |
      # Replace with your own TLS cert or use cert-manager (see tips)
      # For testing, you can use self-signed certs (not production recommended)
    serverKey: |
      # Replace with your own TLS key
    caCertificate: |
      # Replace with your own CA cert

ui:
  enabled: true
  serviceType: ClusterIP
  accessMode: LoadBalancer # Change to ClusterIP for production

injector:
  enabled: true # Enable Vault Agent Injector for sidecar injection
  image:
    tag: "1.16.0" # Match Vault server version
EOF

print_success "Vault values file written to ${VAULT_VALUES_FILE}"

# Add HashiCorp Helm repo
echo "Adding HashiCorp Helm repository..."
helm repo add hashicorp https://helm.releases.hashicorp.com || print_error "Failed to add HashiCorp Helm repo"
helm repo update || print_error "Failed to update Helm repos"
print_success "HashiCorp Helm repo added and updated"

# Install Vault via Helm
echo "Installing Vault ${VAULT_RELEASE_NAME} in ${VAULT_NAMESPACE}..."
helm install "${VAULT_RELEASE_NAME}" hashicorp/vault \
  --namespace "${VAULT_NAMESPACE}" \
  --version "${VAULT_HELM_CHART_VERSION}" \
  --values "${VAULT_VALUES_FILE}" \
  --wait --timeout 10m || print_error "Vault Helm install failed"

print_success "Vault deployed successfully"

# Check Vault pod status
echo "Checking Vault pod status..."
kubectl wait --namespace "${VAULT_NAMESPACE}" \
  --for=condition=ready pod \
  --selector=app.kubernetes.io/name=vault \
  --timeout=5m || print_error "Vault pods not ready in time"

print_success "All Vault pods are ready"

# Initialize and unseal Vault (for Raft storage)
echo "Initializing and unsealing Vault..."
kubectl exec -n "${VAULT_NAMESPACE}" vault-0 -- vault operator init -key-shares=5 -key-threshold=3 -format=json > vault-init.json || print_error "Vault init failed"
print_success "Vault initialized. Unseal keys and root token saved to vault-init.json"

# Unseal all Vault pods
for i in 0 1 2; do
  echo "Unsealing vault-${i}..."
  for j in {1..3}; do
    kubectl exec -n "${VAULT_NAMESPACE}" vault-${i} -- vault operator unseal $(jq -r ".unseal_keys_b64[$((j-1))]" vault-init.json) || print_error "Failed to unseal vault-${i}"
  done
  print_success "vault-${i} unsealed"
done

# Check Vault seal status
kubectl exec -n "${VAULT_NAMESPACE}" vault-0 -- vault status || print_error "Vault status check failed"
print_success "Vault is unsealed and operational"

#!/bin/bash
# Configure Vault Kubernetes Auth for Kubernetes 1.32
# Exit on error
set -euo pipefail

# Variables
VAULT_NAMESPACE="vault"
VAULT_RELEASE_NAME="vault"
K8S_CLUSTER_NAME="k8s-1.32-cluster"
SERVICE_ACCOUNT="vault-auth"
POLICY_NAME="app-secrets-policy"
ROLE_NAME="app-role"

# Color codes
RED='\033[0;31m'
GREEN='\033[0;32m'
NC='\033[0m'

print_error() {
    echo -e "${RED}ERROR: $1${NC}"
    exit 1
}

print_success() {
    echo -e "${GREEN}✓ $1${NC}"
}

echo "Configuring Vault Kubernetes Auth for K8s 1.32..."
echo "--------------------------------------------------------"

# Port-forward Vault to local machine
echo "Starting Vault port-forward (background process)..."
kubectl port-forward -n "${VAULT_NAMESPACE}" svc/vault 8200:8200 &
PF_PID=$!
# Wait for port-forward to start
sleep 5
# Trap to kill port-forward on exit
trap "kill ${PF_PID} 2>/dev/null" EXIT

# Set Vault address
export VAULT_ADDR="https://127.0.0.1:8200"
# Disable TLS verification for testing (enable for production!)
export VAULT_SKIP_VERIFY="true"
# Set root token from init file
export VAULT_TOKEN=$(jq -r '.root_token' vault-init.json)
if [[ -z "${VAULT_TOKEN}" ]]; then
    print_error "Root token not found. Check vault-init.json"
fi
print_success "Vault CLI configured with root token"

# Enable Kubernetes auth method
echo "Enabling Kubernetes auth method..."
vault auth enable kubernetes || print_error "Failed to enable Kubernetes auth"
print_success "Kubernetes auth enabled"

# Configure Kubernetes auth with K8s 1.32 cluster details
echo "Configuring Kubernetes auth for cluster ${K8S_CLUSTER_NAME}..."
# Get K8s service account JWT for Vault auth
SA_JWT=$(kubectl exec -n "${VAULT_NAMESPACE}" vault-0 -- cat /var/run/secrets/kubernetes.io/serviceaccount/token)
# Get K8s service account CA cert
SA_CA_CERT=$(kubectl exec -n "${VAULT_NAMESPACE}" vault-0 -- cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt)

vault write auth/kubernetes/config \
    kubernetes_host="https://kubernetes.default.svc:443" \
    kubernetes_ca_cert="${SA_CA_CERT}" \
    token_reviewer_jwt="${SA_JWT}" \
    issuer="https://kubernetes.default.svc.cluster.local" || print_error "Failed to configure Kubernetes auth"

print_success "Kubernetes auth configured for cluster"

# Create Vault policy for app secrets
echo "Creating Vault policy: ${POLICY_NAME}..."
vault policy write "${POLICY_NAME}" - << EOF
# Allow read access to app secrets path
path "secret/data/apps/*" {
  capabilities = ["read"]
}

# Allow list access to secret paths
path "secret/metadata/apps/*" {
  capabilities = ["list"]
}
EOF
print_success "Policy ${POLICY_NAME} created"

# Create Kubernetes auth role
echo "Creating Kubernetes auth role: ${ROLE_NAME}..."
vault write auth/kubernetes/role/${ROLE_NAME} \
    bound_service_account_names="app-sa" \
    bound_service_account_namespaces="default" \
    policies="${POLICY_NAME}" \
    ttl="24h" || print_error "Failed to create auth role"

print_success "Auth role ${ROLE_NAME} created"

# Enable KV v2 secrets engine (Vault 1.16 default, but explicit enable)
echo "Enabling KV v2 secrets engine at path 'secret'..."
vault secrets enable -path=secret kv-v2 || print_error "Failed to enable KV v2"
print_success "KV v2 secrets engine enabled"

# Write a test secret
echo "Writing test secret to Vault..."
vault kv put secret/apps/my-app api-key="test-key-12345" db-password="super-secret-password" || print_error "Failed to write test secret"
print_success "Test secret written to secret/apps/my-app"

# Verify secret read
echo "Verifying secret read..."
vault kv get secret/apps/my-app || print_error "Failed to read test secret"
print_success "Secret read verified"

echo "--------------------------------------------------------"
echo -e "${GREEN}Vault Kubernetes Auth configuration complete!${NC}"

package main

// Sample Go app to read secrets from Vault using Kubernetes auth
// Build: go build -o vault-secret-reader main.go
// Run in Kubernetes with service account app-sa

import (
    "encoding/json"
    "fmt"
    "log"
    "os"
    "time"

    vault "github.com/hashicorp/vault/api"
    auth "github.com/hashicorp/vault/api/auth/kubernetes"
)

// SecretConfig holds the secrets read from Vault
type SecretConfig struct {
    APIKey     string `json:"api-key"`
    DBPassword string `json:"db-password"`
}

func main() {
    // Vault address from environment variable, default to in-cluster address
    vaultAddr := os.Getenv("VAULT_ADDR")
    if vaultAddr == "" {
        vaultAddr = "https://vault.vault.svc:8200"
    }

    // Secret path to read from Vault
    secretPath := os.Getenv("VAULT_SECRET_PATH")
    if secretPath == "" {
        secretPath = "secret/data/apps/my-app"
    }

    // Kubernetes service account path for JWT
    saTokenPath := "/var/run/secrets/kubernetes.io/serviceaccount/token"
    // Read service account JWT
    jwt, err := os.ReadFile(saTokenPath)
    if err != nil {
        log.Fatalf("Failed to read service account token: %v", err)
    }

    // Create Vault client
    client, err := vault.NewClient(&vault.Config{Address: vaultAddr})
    if err != nil {
        log.Fatalf("Failed to create Vault client: %v", err)
    }

    // Configure Kubernetes auth
    k8sAuth, err := auth.NewKubernetesAuth(
        "app-role", // Must match the role created in Vault
        auth.WithServiceAccountToken(string(jwt)),
    )
    if err != nil {
        log.Fatalf("Failed to create Kubernetes auth method: %v", err)
    }

    // Authenticate to Vault using Kubernetes auth
    authSecret, err := client.Auth().Login(k8sAuth)
    if err != nil {
        log.Fatalf("Vault authentication failed: %v", err)
    }
    if authSecret == nil {
        log.Fatal("Vault authentication returned nil secret")
    }
    log.Printf("Successfully authenticated to Vault. Token TTL: %v", authSecret.Auth.TTL)

    // Set the client token from auth response
    client.SetToken(authSecret.Auth.ClientToken)

    // Read secret from Vault
    secret, err := client.KVv2("secret").Get(secretPath)
    if err != nil {
        log.Fatalf("Failed to read secret from Vault: %v", err)
    }

    // Parse secret data into SecretConfig
    var config SecretConfig
    if err := mapToStruct(secret.Data, &config); err != nil {
        log.Fatalf("Failed to parse secret data: %v", err)
    }

    // Log the secrets (in production, use them, don't log!)
    log.Printf("Successfully read secrets from Vault:")
    log.Printf("API Key: %s", maskString(config.APIKey))
    log.Printf("DB Password: %s", maskString(config.DBPassword))

    // Keep app running to simulate workload
    log.Println("App running. Press Ctrl+C to exit.")
    for {
        time.Sleep(30 * time.Second)
        // Renew token if needed (simplified for example)
        if authSecret.Auth.Renewable {
            _, err := client.Auth().Token().Renew(authSecret.Auth.ClientToken, 1*time.Hour)
            if err != nil {
                log.Printf("Failed to renew token: %v", err)
            }
        }
    }
}

// mapToStruct converts a map[string]interface{} to a struct using JSON marshaling
func mapToStruct(data map[string]interface{}, v interface{}) error {
    b, err := json.Marshal(data)
    if err != nil {
        return fmt.Errorf("failed to marshal data: %w", err)
    }
    if err := json.Unmarshal(b, v); err != nil {
        return fmt.Errorf("failed to unmarshal data: %w", err)
    }
    return nil
}

// maskString masks a string for logging, showing only first 4 and last 4 characters
func maskString(s string) string {
    if len(s) <= 8 {
        return "****"
    }
    return s[:4] + "****" + s[len(s)-4:]
}

annotations:
  vault.hashicorp.com/agent-inject: "true"
  vault.hashicorp.com/agent-inject-secret-config: "secret/data/apps/my-app"
  vault.hashicorp.com/agent-inject-template-config: |
    {{ with secret "secret/data/apps/my-app" }}
    API_KEY={{ .Data.data.api-key }}
    DB_PASSWORD={{ .Data.data.db-password }}
    {{ end }}

injector:
  enabled: false
kms:
  enabled: true
  image: hashicorp/vault-kms:1.0.0 # Compatible with Vault 1.16.0
  vaultAddr: "https://vault.vault.svc:8200"
  transitKeyName: "k8s-encryption-key"
  authPath: "auth/kubernetes"

vault write auth/kubernetes/role/team-a-role \
  bound_service_account_names="team-a-sa" \
  bound_service_account_namespaces="team-a-namespace" \
  policies="team-a-policy" \
  namespace="team-a-vault-namespace" \
  ttl="8h"

vault-k8s-1.32-tutorial/
├── pre-flight-checks.sh       # Pre-flight check script (Code Block 1)
├── deploy-vault.sh            # Vault deployment script (Code Block 2)
├── configure-vault-auth.sh    # Vault auth configuration script (Code Block 3)
├── sample-app/
│   ├── main.go                # Sample Go app (Code Block 4)
│   ├── go.mod                 # Go module dependencies
│   ├── Dockerfile             # App containerization
│   └── k8s-deployment.yaml    # App K8s deployment manifest
├── helm-values/
│   └── vault-1.16-values.yaml # Vault Helm values
├── policies/
│   └── app-secrets-policy.hcl # Vault policy
├── case-study/
│   └── metrics.json           # Benchmark metrics
└── README.md                  # Tutorial overview