Vault PKI - Basic Demo

agent.hcl

auto_auth {
  method "approle" {
    config = {
      role_id_file_path   = ".role-id"
      secret_id_file_path = ".secret-id"
    }
  }

  sink "file" {
    config = {
      path = "token-sink"
    }
  }
}

cert.pem.tpl

{{ with secret "pki/issue/consul-service" "common_name=profitapp.service.consul" }}
{{ .Data.issuing_ca }}
{{ .Data.certificate }}
{{ .Data.private_key }}
{{ end }}

run.md

vault read -format=json auth/approle/role/certs/role-id | \
    jq -r .data.role_id > .role-id

vault write -format=json -f auth/approle/role/certs/secret-id | \
    jq -r .data.secret_id > .secret-id

Start the vault agent in one window(screen/tmux/tabs/etc.)

vault agent -config=agent.hcl

Start consul-template in another window

consul-template -vault-agent-token-file=token-sink -vault-renew-token=false \
    -template "cert.pem.tpl:cert.pem" -log-level=debug

Watch the file contents in another window(need to brew install watch on a mac)

watch -n 1 cat cert.pem

setup.md

echo '
path "pki/issue/consul-service" {
    capabilities = ["create","update"]
}
path "pki/cert/ca" {
    capabilities = ["read"]
}
path "auth/token/renew" {
    capabilities = ["update"]
}
path "auth/token/renew-self" {
    capabilities = ["update"]
}
' | vault policy write certuser -
vault secrets enable pki
vault secrets tune -max-lease-ttl=8760h pki
vault write pki/root/generate/internal \
    common_name=service.consul \
    ttl=8760h
vault write pki/config/urls \
    issuing_certificates="http://active.vault.service.consul:8200/v1/pki/ca" \
    crl_distribution_points="http://active.vault.service.consul:8200/v1/pki/crl"
vault write pki/roles/consul-service \
    allowed_domains="service.consul" \
    allow_subdomains=true \
    generate_lease=true \
    ttl=5s \
    max_ttl=10s
vault auth enable approle
vault write auth/approle/role/certs policies="certuser" secret_id_ttl=24h token_num_uses=5000 token_ttl=5m token_max_ttl=30m secret_id_num_uses=5000