> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Demo Vault Authentication

> Learn to secure Kubernetes workloads using Vault’s Kubernetes authentication method for validating ServiceAccount JWTs and issuing short-lived Vault tokens.

Learn how to secure Kubernetes workloads by enabling Vault’s Kubernetes authentication method. This guide walks through configuring Vault to validate Kubernetes ServiceAccount JWTs via the Token Review API and issue short-lived Vault tokens.

| Requirement                          | Description                                                            |
| ------------------------------------ | ---------------------------------------------------------------------- |
| Vault CLI                            | Installed and pointed to your Vault server                             |
| Management Vault token (e.g., root)  | Has privileges to enable auth methods and manage roles                 |
| Kubernetes Service Account           | Bound to the `system:auth-delegator` ClusterRole for TokenReview calls |
| Kubernetes API server address and CA | Required for Vault to communicate with the cluster                     |

<Callout icon="lightbulb" color="#1CB2FE">
  You can use any non-root token with sufficient privileges instead of the root token. Follow [Vault best practices](https://www.vaultproject.io/docs/concepts/policies) for production environments.
</Callout>

***

## 1. (Optional) Create and Log In with a Vault Token

If you need a token to configure auth methods and roles, create one:

```bash theme={null}
vault token create
# Example output:
# Key                Value
# ---                -----
# token              s.t3Z3Qzflc14FRideymCDYn
# token_accessor     3gZeW9G8OcK80Wyewuzigth
# token_policies     ["root"]
```

Log in using the new token:

```bash theme={null}
vault login s.t3Z3Qzflc14FRideymCDYn
# Success! You are now authenticated.
```

***

## 2. Enable the Kubernetes Auth Method

Turn on the Kubernetes auth backend in Vault:

```bash theme={null}
vault auth enable kubernetes
# Success! Enabled kubernetes auth method at: kubernetes/
```

***

## 3. Configure Vault to Talk to Kubernetes

Provide Vault with the ServiceAccount reviewer JWT, the cluster’s API endpoint, and the CA certificate:

```bash theme={null}
vault write auth/kubernetes/config \
  token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
  kubernetes_host="https://${KUBERNETES_PORT_443_TCP_ADDR}:443" \
  kubernetes_ca_cert="@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
# Success! Data written to: auth/kubernetes/config
```

<Callout icon="triangle-alert" color="#FF6B6B">
  Ensure your environment variable `KUBERNETES_PORT_443_TCP_ADDR` points to the correct API server IP or DNS name before running this command.
</Callout>

***

## 4. Create a Kubernetes Auth Role Mapping to Vault Policies

Define a role (`phpapp`) that binds a specific ServiceAccount in a namespace to a Vault policy:

```bash theme={null}
vault write auth/kubernetes/role/phpapp \
  bound_service_account_names=app \
  bound_service_account_namespaces=demo \
  policies=app \
  ttl=1h
# Success! Data written to: auth/kubernetes/role/phpapp
```

This role ensures that only pods using the `app` ServiceAccount in the `demo` namespace receive Vault tokens scoped to the `app` policy, valid for one hour.

***

## 5. Verify TokenReview Permissions

Check that the Vault ServiceAccount (for example, `vault` in `demo` namespace) has the `system:auth-delegator` ClusterRole to call the TokenReview API:

```bash theme={null}
kubectl describe clusterrolebinding vault-server-binding
```

Example output:

```YAML theme={null}
Name:         vault-server-binding
Role:
  Kind:       ClusterRole
  Name:       system:auth-delegator
Subjects:
  Kind:             ServiceAccount
  Name:             vault
  Namespace:        demo
```

***

## Next Steps

With Kubernetes auth enabled and roles configured, you can deploy application pods that request Vault tokens via their ServiceAccount JWTs and fetch secrets at runtime.

## Links and References

* [Vault Kubernetes Auth Method](https://www.vaultproject.io/docs/auth/kubernetes)
* [Kubernetes TokenReview API](https://kubernetes.io/docs/reference/access-authn-authz/authentication/)
* [HashiCorp Vault Documentation](https://www.vaultproject.io/docs/)

<CardGroup>
  <Card title="Watch Video" icon="video" cta="Learn more" href="https://learn.kodekloud.com/user/courses/devsecops-kubernetes-devops-security/module/baf5859d-32c2-4e7c-9808-f3486d6b9827/lesson/2f1b7046-4f0b-40bd-9dfc-c2c53311f905" />
</CardGroup>