## Install SSCSI Driver

1. Install SSCSI Driver Operator with default option from OCP Operator hub.


2. Create ClusterCSIDriver object called `secrets-store.csi.k8s.io`

apiVersion: operator.openshift.io/v1
kind: ClusterCSIDriver
metadata:
    name: secrets-store.csi.k8s.io
spec:
  managementState: Managed

## Install Vault for test

1. Install helm on bastion

curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
chmod 700 get_helm.sh
./get_helm.sh

2. Install Vault via hem chart

Add the HashiCorp Helm Repository

helm repo add hashicorp https://helm.releases.hashicorp.com

Update your Helm Repositories

helm repo update

Create a namespace for Vault

oc new-project hashicorp-vault

Create a SCC for the CSI driver

oc adm policy add-scc-to-user privileged \
  system:serviceaccount:hashicorp-vault:vault-csi-provider

Create a values file for Helm to use

cat << EOF > values.yaml
global:
  openshift: true
csi:
  enabled: true
  daemonSet:
    providersDir: /var/run/secrets-store-csi-providers
  agent:
    image:
      repository: "registry.connect.redhat.com/hashicorp/vault"
      tag: "1.20.4-ubi"
injector:
  enabled: false
server:
  image:
    repository: "registry.connect.redhat.com/hashicorp/vault"
    tag: "1.20.4-ubi"
  dev:
    enabled: true
EOF

Install Hashicorp Vault with CSI enabled

helm install vault hashicorp/vault --namespace hashicorp-vault --values=values.yaml

## Configure Hashicorp Vault
1. Get a bash prompt inside the Vault pod

oc exec -it vault-0 -- bash

2. Create a Secret in Vault

vault kv put secret/db-pass password="hunter2"

3. Configure Vault to use Kubernetes Auth

vault auth enable kubernetes

4. Check your Cluster’s token issuer in another terminal

oc get authentication.config cluster \
  -o json | jq -r .spec.serviceAccountIssuer

5. Configure Kubernetes auth method

If the issuer here does not match the above, update it.

vault write auth/kubernetes/config \
issuer="https://kubernetes.default.svc.cluster.local" \
token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
kubernetes_host="https://$KUBERNETES_PORT_443_TCP_ADDR:443" \
kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt

**If your token issuer is empty**

[quickcluster@upi-0 ~]$ oc get authentication.config cluster \
>   -o json | jq -r .spec.serviceAccountIssuer

[quickcluster@upi-0 ~]$

vault write auth/kubernetes/config \
  disable_iss_validation=true \
  token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
  kubernetes_host="https://$KUBERNETES_PORT_443_TCP_ADDR:443" \
  kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt

6. Create a policy for our app

vault policy write internal-app - <<EOF
path "secret/data/db-pass" {
  capabilities = ["read"]
}
EOF

7. Create an auth role to access it

vault write auth/kubernetes/role/database \
  bound_service_account_names=webapp-sa \
  bound_service_account_namespaces=default \
  policies=internal-app \
  ttl=20m

8. exit from the vault-0 pod

exit

## Deploy a sample application
1. Create a SecretProviderClass in the default namespace

cat <<EOF | oc apply -f -
apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
kind: SecretProviderClass
metadata:
  name: vault-database
  namespace: default
spec:
  provider: vault
  parameters:
    vaultAddress: "http://vault.hashicorp-vault:8200"
    roleName: "database"
    objects: |
      - objectName: "db-password"
        secretPath: "secret/data/db-pass"
        secretKey: "password"
EOF

2. Create a service account webapp-sa

oc create serviceaccount -n default webapp-sa

3. Create a Pod to use the secret

cat << EOF | oc apply -f -
kind: Pod
apiVersion: v1
metadata:
  name: webapp
  namespace: default
spec:
  serviceAccountName: webapp-sa
  containers:
  - image: quay.io/rhn_support_jaliang/app:0.0.1
    name: webapp
    volumeMounts:
    - name: secrets-store-inline
      mountPath: "/mnt/secrets-store"
      readOnly: true
  volumes:
    - name: secrets-store-inline
      csi:
        driver: secrets-store.csi.k8s.io
        readOnly: true
        volumeAttributes:
          secretProviderClass: "vault-database"
EOF

4. Check the Pod has the secret

oc -n default exec webapp \
  -- cat /mnt/secrets-store/db-password

The output should match

hunter2

## Test case 2

oc new-project vault-demo

cat << 'EOF' | oc apply -f -
apiVersion: v1
kind: Secret
metadata:
  name: my-password-secret
  namespace: vault-demo
type: Opaque
stringData:
  db-password: "my-super-secret-password-from-k8s-secret"
EOF

cat << 'EOF' | oc apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: echo-password-pod
  namespace: vault-demo
spec:
  containers:
  - name: echo-container
    image: quay.io/quay/busybox:latest
    command: ["/bin/sh", "-c"]
    args:
    - "export SECRET_PASSWORD=$(cat /mnt/secrets-store/db-password) && 
      echo \"Password from secret is: $SECRET_PASSWORD\" && sleep 3600"
    volumeMounts:
    - name: secret-volume
      mountPath: "/mnt/secrets-store"
      readOnly: true
  volumes:
  - name: secret-volume
    secret:
      secretName: my-password-secret
  restartPolicy: Never
EOF

oc exec -n hashicorp-vault -it vault-0 -- bash

vault kv put secret/db-pass password-for-demo="my-super-secret-password-from-vault"

vault write auth/kubernetes/role/database \
  bound_service_account_names=default \
  bound_service_account_namespaces=vault-demo \
  policies=internal-app \
  ttl=20m

exit

cat << 'EOF' | oc apply -f -
apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
kind: SecretProviderClass
metadata:
  name: vault-database-demo
  namespace: vault-demo
spec:
  provider: vault
  parameters:
    vaultAddress: "http://vault.hashicorp-vault:8200"
    roleName: "database"
    objects: |
      - objectName: "db-password"
        secretPath: "secret/data/db-pass"
        secretKey: "password-for-demo"
EOF

cat << 'EOF' | oc apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: echo-password-pod-from-vault
  namespace: vault-demo
spec:
  containers:
  - name: echo-container
    image: quay.io/quay/busybox:latest
    command: ["/bin/sh", "-c"]
    args:
    - "export SECRET_PASSWORD=$(cat /mnt/secrets-store/db-password) && echo \"Password from secret is: $SECRET_PASSWORD\" && sleep 3600"
    volumeMounts:
    - name: secrets-store-volume
      mountPath: "/mnt/secrets-store/"
      readOnly: true
  volumes:
  - name: secrets-store-volume
    csi:
      driver: secrets-store.csi.k8s.io
      readOnly: true
      volumeAttributes:
        secretProviderClass: "vault-database-demo"
  restartPolicy: Never
EOF

## Uninstall HashiCorp Vault with CSI driver enabled
Delete the pod and

oc delete -n default pod webapp
oc delete -n default secretproviderclass vault-database
oc delete -n default serviceaccount webapp-sa

Delete the Hashicorp Vault Helm

helm delete -n hashicorp-vault vault

Delete the SCC for Hashicorp Vault

oc adm policy remove-scc-from-user privileged \
  system:serviceaccount:hashicorp-vault:vault-csi-provider

Delete the Hashicorp vault project

oc delete project hashicorp-vault

## Uninstalling the Kubernetes Secret Store CSI

Delete the secrets store csi driver

helm delete -n k8s-secrets-store-csi csi-secrets-store

Delete the SecurityContextConstraints

oc adm policy remove-scc-from-user privileged \
  system:serviceaccount:k8s-secrets-store-csi:secrets-store-csi-driver

## Resources

https://balakrishnan-b.medium.com/using-hashicorp-vault-provider-for-secrets-store-csi-driver-on-openshift-ec94f0a16e5

https://medium.com/pareture/hashicorp-kubernetes-vault-auth-claim-iss-is-invalid-abdd748c8ad6

https://cloud.redhat.com/experts/misc/secrets-store-csi/hashicorp-vault/