Related/Useful links: post, Nginx ingress.
- Installing Go
- Install CloudFlare's SSL ToolKit (
cfsslandcfssljson) - Consul
- Vault
- Pre-installed k8s, by default will be used
vaultnamespace - Pre-configured AWS KMS key and access (Role/Policy)
Create a Certificate Authority:
$ cfssl gencert -initca certs/config/ca-csr.json | cfssljson -bare certs/caCreate the private keys and TLS certificates:
$ cfssl gencert \
-ca=certs/ca.pem \
-ca-key=certs/ca-key.pem \
-config=certs/config/ca-config.json \
-profile=default \
certs/config/consul-csr.json | cfssljson -bare certs/consul
$ cfssl gencert \
-ca=certs/ca.pem \
-ca-key=certs/ca-key.pem \
-config=certs/config/ca-config.json \
-profile=default \
certs/config/vault-csr.json | cfssljson -bare certs/vaultSpin up Vault and Consul on Kubernetes:
$ sh create.shIn a new terminal window, navigate to the project directory and set the following environment variables:
$ export VAULT_ADDR=https://127.0.0.1:8200
$ export VAULT_TOKEN=your_tokenIf having problem with x509, without a proper cert is first way with cert the second one:
$ export VAULT_SKIP_VERIFY=true
$ export VAULT_CACERT="certs/ca.pem"$ kubectl get pods
$ vault status...