Guide: Using Red Hat COP Vault Config Operator with SPIFFE Integration

Here’s the complete guide formatted in Markdown, combining all the steps:

NOTE: This guide assumes you have already completed setting up Workload Identity: https://github.com/5GSEC/nephio/wiki/Workload-Identity-Setup-with-Nephio

---

1. Create Namespace vault-admin

Create a YAML file for the namespace:

apiVersion: v1
kind: Namespace
metadata:
  name: vault-admin

Apply the namespace:

kubectl apply -f vault-admin-namespace.yaml

---

2. Install Vault Config Operator Using Helm

Run the following commands to add the Helm repository, update it, and install the Vault Config Operator:

helm repo add vault-config-operator https://redhat-cop.github.io/vault-config-operator
helm repo update
helm install vault-config-operator vault-config-operator/vault-config-operator --namespace vault-admin --values operatorConfig.yaml

operatorConfig.yaml:

env:
  - name: "VAULT_ADDR"
    value: "http://vault.vault.svc:8200"

enableMonitoring: false
enableCertManager: true

---

3. Create and Apply Custom Role for vault-admin

Create a YAML file defining the ClusterRole and ClusterRoleBinding:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: secret-admin
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["list", "watch", "create", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: secrets-admin-global
subjects:
  - kind: Group
    name: system:serviceaccounts
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: secret-admin
  apiGroup: rbac.authorization.k8s.io

Apply the role and binding:

kubectl apply -f vault-admin-clusterrole.yaml

---

4. Exec into the Vault Container and Write Admin Policy

Exec into the Vault container:

kubectl exec -it -n vault vault-0 -- sh

Write an admin policy for the vault-admin namespace (attach the policy file later):

vault policy write vault-admin ./vault-admin-policy.yaml

---

5. Enable Kubernetes Authentication in Vault

1. Enable Kubernetes authentication:

   vault auth enable kubernetes

2. Configure the Kubernetes authentication:

   vault write -tls-skip-verify auth/kubernetes/config kubernetes_host=https://kubernetes.default.svc:443

3. Write a role for the vault-admin policy:

   vault write -tls-skip-verify auth/kubernetes/role/policy-admin \
   bound_service_account_names=default \
   bound_service_account_namespaces=vault-admin \
   policies=vault-admin \
   ttl=1h

---

6. Enable Key-Value Secrets Engine

Apply this YAML to enable the Key-Value (KV) secrets engine:

apiVersion: redhatcop.redhat.io/v1alpha1
kind: SecretEngineMount
metadata:
  name: global-secrets
spec:
  authentication:
    path: kubernetes
    role: policy-admin
  type:
    kv
  path:
    kv

Apply the config:

kubectl apply -f kv-secrets-engine.yaml

---

7. Enable JWT Auth Engine

Apply this YAML to enable the JWT authentication engine:

apiVersion: redhatcop.redhat.io/v1alpha1
kind: JWTOIDCAuthEngineConfig
metadata:
  name: spire-oidc
spec:
  authentication:
    path: kubernetes
    role: policy-admin
  path: jwt
  OIDCDiscoveryURL: "http://spiffe.nephio.org:8888"
  OIDCResponseMode: "form_post"

Apply the config:

kubectl apply -f jwt-auth-engine.yaml

---

8. Grant Read Policy on Global Secrets Path

Apply this YAML to give read permissions on kv/global-secrets/test/*:

apiVersion: redhatcop.redhat.io/v1alpha1
kind: Policy
metadata:
  name: test-reader
spec:
  authentication: 
    path: kubernetes
    role: policy-admin
  policy: |
    # Configure read secrets
    path "kv/global-secrets/test/*" {
      capabilities = ["read"]
    }
  type: acl

Apply the config:

kubectl apply -f test-reader-policy.yaml

---

9. Restrict Access to SPIFFE Identities for Read-Only Access

Apply this YAML to allow only specific SPIFFE identities to access the secret path:

apiVersion: redhatcop.redhat.io/v1alpha1
kind: JWTOIDCAuthEngineRole
metadata:
  name: spire-role
spec:
  authentication:
    path: kubernetes
    role: policy-admin
  path: jwt
  name: dev
  tokenPolicies:
    - test-reader
  roleType: "jwt"
  boundAudiences:
    - "TESTING"
  userClaim: "sub"
  boundSubject: "spiffe://example.org/workload-1"

Apply the config:

kubectl apply -f spire-role-config.yaml

---

This guide should now be fully ready for copying and applying in Markdown format. Let me know if you need any further modifications!