Skip to content

Enabling Multi-Tenancy in Vault#

Vault Multitenancy#

HashiCorp Vault is an identity-based secret and encryption management system. Vault validates and authorizes a system's clients (users, machines, apps) before providing them access to secrets or stored sensitive data.

Vault integration in Multi Tenant Operator#

Service Account Auth in Vault#

MTO enables the Kubernetes auth method which can be used to authenticate with Vault using a Kubernetes Service Account Token. When enabled, for every tenant namespace, MTO automatically creates policies and roles that allow the service accounts present in those namespaces to read secrets at tenant's path in Vault. The name of the role is the same as namespace name.

These service accounts are required to have true label, so they can be authenticated with Vault via MTO.

The Diagram shows how MTO enables ServiceAccounts to read secrets from Vault.


User OIDC Auth in Vault#

This requires a running RHSSO(RedHat Single Sign On) instance integrated with Vault over OIDC login method.

MTO integration with Vault and RHSSO provides a way for users to log in to Vault where they only have access to relevant tenant paths.

Once both integrations are set up with IntegrationConfig CR, MTO links tenant users to specific client roles named after their tenant under Vault client in RHSSO.

After that, MTO creates specific policies in Vault for its tenant users.

Mapping of tenant roles to Vault is shown below

Tenant Role Vault Path Vault Capabilities
Owner, Editor (tenantName)/* Create, Read, Update, Delete, List
Owner, Editor sys/mounts/(tenantName)/* Create, Read, Update, Delete, List
Owner, Editor managed-addons/* Read, List
Viewer (tenantName)/* Read

A simple user login workflow is shown in the diagram below.


Copyright © 2024 Stakater AB – Change cookie settings