<p>I've created 2 <code>kubernetes</code> cluster within the same <code>VPC</code> in the same region in AWS.</p>

<p>The first cluster is dedicated to my micro services.Let's name it "MS"
The second one is dedicated to vault and its highly available storage (consul). Let's name it "V"</p>

<p>The question is how i can get access to the secrets I've created in "V" cluster, from the containers in "MS" cluster ?</p>

<p>What I've tried so far:</p>

<ol>
<li><p>I started by creating a new service account in "MS" cluster which authenticates with the review token API.</p></li>
<li><p>Then I had to extract the token reviewer JWT, Kuberenetes CA certificate and the Kubernetes host from "MI" cluster</p></li>
<li><p>Then I switched to for "V" cluster context to enabled and create a new kubernetes auth method attached to that service account.</p></li>
</ol>

<p>From there I don't know what to do and I'm not sure that method really works when using 2 different clusters?</p>

<p><strong>Service account:</strong></p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: consul
  labels:
    app: consul
rules:
  - apiGroups: [""]
    resources:
      - pods
    verbs:
      - get
      - list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: consul
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: consul
subjects:
  - kind: ServiceAccount
    name: consul
    namespace: default
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: consul
  labels:
    app: consul
</code></pre>

<p><strong>Export token review variables from "MI" cluster</strong></p>

<pre><code>export VAULT_SA_NAME=$(kubectl get sa postgres-vault -o jsonpath="{.secrets[*]['name']}")

export SA_JWT_TOKEN=$(kubectl get secret $VAULT_SA_NAME -o jsonpath="{.data.token}" | base64 --decode; echo)

export SA_CA_CRT=$(kubectl get secret $VAULT_SA_NAME -o jsonpath="{.data['ca\.crt']}" | base64 --decode; echo)

export K8S_HOST=$(kubectl exec consul-consul-0 -- sh -c 'echo $KUBERNETES_SERVICE_HOST')

</code></pre>

<p><strong>Create kubernetes auth method</strong></p>

<pre><code>
vault auth enable kubernetes
vault write auth/kubernetes/config \
  token_reviewer_jwt="$SA_JWT_TOKEN" \
  kubernetes_host="https://$K8S_HOST:443" \
  kubernetes_ca_cert="$SA_CA_CRT"
</code></pre>

<p>I expect to gain access to the secrets stored in vault from my micros services. Though I'm not sure that method works when vault is deployed in a dedicated cluster.</p>

<p>I guess there might be something else to join both clusters? May be using consul?</p>

<p>You are 80% there. the next steps are:
1. Run a deployment with the correct service account
2. Login/Authenticate to vault using Kubernetes authentication method and get a relevant vault token.
3. Retrieve secrets.</p>

<p>This is an example of adding the service account to your deployment:</p>

<pre><code>apiVersion: apps/v1beta2
kind: Deployment
metadata:
  name: xxx
  labels:
    app: xxx
spec:
  replicas: 1
  template:
    metadata:
      ...
    spec:
      serviceAccountName: vault-auth
  ...
</code></pre>

<p>To login using kube auth see <a href="https://www.vaultproject.io/api/auth/kubernetes/index.html#login" rel="nofollow noreferrer">here</a>. I would suggest that you take a look at this <a href="https://github.com/WealthWizardsEngineering/kube-vault-auth-init" rel="nofollow noreferrer">project</a> for a concrete example. </p>

<p>Once you get token with the correct permissions you can use vault cli/ rest api to access secrets.</p>
