Configure Secret Storage

Add the Vault policies for the Kubernetes Operator and its components.

Write the policies for Kubernetes Operator, MongoDB database, Ops Manager, and AppDB resources to Vault using the following command, replacing the variables with the values in the table:

vault policy write {PolicyName} {PathToPolicyFile}

Repeat the command for all the resources you're adding to Vault.

Bind the Vault roles to the Vault policies for the Kubernetes Operator and its components.

Bind Vault roles to the policies for Kubernetes Operator, MongoDB database, Ops Manager, and AppDB resources using the following four commands, replacing the variables with the values in the table:

vault write auth/kubernetes/role/{OperatorPolicyName}
bound_service_account_names=enterprise-operator bound_service_account_namespaces={ServiceAccountNamespace}

vault write auth/kubernetes/role/{DatabasePolicyName}
bound_service_account_names=mongodb-enterprise-database-pods bound_service_account_namespaces={ServiceAccountNamespace}

vault write auth/kubernetes/role/{OpsManagerPolicyName}
bound_service_account_names=mongodb-enterprise-ops-manager bound_service_account_namespaces={ServiceAccountNamespace}

vault write auth/kubernetes/role/{AppDBPolicyName}
bound_service_account_names=mongodb-enterprise-appdb bound_service_account_namespaces={ServiceAccountNamespace}

These commands ensure that each component's pods have only the access specified in their policy.

vault write auth/kubernetes/role/{PolicyName}
bound_service_account_names={ServiceAccountName} bound_service_account_namespaces={ServiceAccountNamespace}

Add the annotations to the Kubernetes deployment file.

Before running commands in this step, ensure that you have created a Vault role with the name mongodbenterprise.

Add the following highlighted lines to the spec.template.metadata.annotations section of your Kubernetes Operator deployment file. For most users, this file's name is mongodb-enterprise.yaml or mongodb-enterprise-openshift.yaml.

apiVersion: apps/v1
kind: Deployment
metadata:
   name: mongodb-enterprise-operator
   namespace: production
spec:
   replicas: 1
   template:
      metadata:
        annotations:
          vault.hashicorp.com/agent-inject: "true"
          vault.hashicorp.com/role: "mongodbenterprise"

If you're running Vault in TLS mode, and specified the operator.vaultSecretBackend.tlsSecretRef value, the Kubernetes Operator adds the following annotations. Otherwise, add the following highlighted line to the file, replacing {TLSSecret} with the name of the secret containing a ca.crt entry. The content of the ca.crt entry must match the certificate of the CA used to generate the Vault TLS certificates.

        annotations:
          vault.hashicorp.com/agent-inject: "true"
          vault.hashicorp.com/role: "mongodbenterprise"
          vault.hashicorp.com/tls-secret: {TLSSecret}
          vault.hashicorp.com/ca-cert: /vault/tls/ca.crt

Define the environment variable in Kubernetes.

Add the following highlighted lines to the spec.env section of your Kubernetes Operator deployment file. For most users, this file's name is mongodb-enterprise.yaml or mongodb-enterprise-openshift.yaml.

apiVersion: apps/v1
kind: Deployment
metadata:
   name: mongodb-enterprise-operator
   namespace: production
spec:
   env:
   - name: OPERATOR_ENV
     value: ENVIRONMENT_NAME
   - name: SECRET_BACKEND
     value: VAULT_BACKEND

This defines the environment variable for Vault in Kubernetes.

Create a file with the Vault configuration information.

Using your preferred text editing application, create a file named config. Paste the following text into the file:

apiVersion: v1
kind: ConfigMap
metadata:
  name: secret-configuration
  namespace: {Namespace}
data:
  VAULT_SERVER_ADDRESS: {VaultServerAddress}
  OPERATOR_SECRET_BASE_PATH: mongodbenterprise/operator
  DATABASE_SECRET_BASE_PATH: mongodbenterprise/database
  OPS_MANAGER_SECRET_BASE_PATH: mongodbenterprise/opsmanager
  APPDB_SECRET_BASE_PATH: mongodbenterprise/appdb

The paths in this file are the default paths. You can replace them with your base paths if you customized your Kubernetes Operator configuration.

If you're running Vault in TLS mode, you must also add the following highlighted line to the file:

   OPS_MANAGER_SECRET_BASE_PATH: mongodbenterprise/opsmanager
   APPDB_SECRET_BASE_PATH: mongodbenterprise/appdb
   TLS_SECRET_REF: {TLSSecret}

Replace the placeholders in the Vault configuration information.

Replace the placeholders in the config file with these values. Save the file with a YAML file type by replacing the .txt file extension with .yaml.

Create a ConfigMap with the Vault configuration.

Issue the following command to create a ConfigMap containing the Vault information:

kubectl create configmap secret-configuration --from-file=config.yaml

This creates a ConfigMap named secret-configuration. This ConfigMap contains the contents of the config file.

Manually migrate secrets that don't migrate automatically

You must manually migrate the following secrets to store them in Vault:

• Any existing user-created secrets, including Operator credentials stored as Kubernetes secrets, if applicable

• The gen-key secret Kubernetes Operator creates

• The Ops Manager admin credentials/admin key Kubernetes Operator creates

• TLS secrets

To manually migrate or create new secrets, add them to Vault. After you add them to Vault, you can remove them from Kubernetes.

All other secrets that the Kubernetes Operator creates migrate automatically, and Kubernetes Operator uses Vault for new secrets. User-created secrets must be added to Vault.