Skip to main content
Learn how to secure Kubernetes workloads by enabling Vault’s Kubernetes authentication method. This guide walks through configuring Vault to validate Kubernetes ServiceAccount JWTs via the Token Review API and issue short-lived Vault tokens.
You can use any non-root token with sufficient privileges instead of the root token. Follow Vault best practices for production environments.

​
1. (Optional) Create and Log In with a Vault Token

If you need a token to configure auth methods and roles, create one:
Log in using the new token:

​
2. Enable the Kubernetes Auth Method

Turn on the Kubernetes auth backend in Vault:

​
3. Configure Vault to Talk to Kubernetes

Provide Vault with the ServiceAccount reviewer JWT, the cluster’s API endpoint, and the CA certificate:
Ensure your environment variable KUBERNETES_PORT_443_TCP_ADDR points to the correct API server IP or DNS name before running this command.

​
4. Create a Kubernetes Auth Role Mapping to Vault Policies

Define a role (phpapp) that binds a specific ServiceAccount in a namespace to a Vault policy:
This role ensures that only pods using the app ServiceAccount in the demo namespace receive Vault tokens scoped to the app policy, valid for one hour.

​
5. Verify TokenReview Permissions

Check that the Vault ServiceAccount (for example, vault in demo namespace) has the system:auth-delegator ClusterRole to call the TokenReview API:
Example output:

​
Next Steps

With Kubernetes auth enabled and roles configured, you can deploy application pods that request Vault tokens via their ServiceAccount JWTs and fetch secrets at runtime.

Watch Video