diff --git a/doc/source/security/kubernetes/configure-vault-using-the-cli.rst b/doc/source/security/kubernetes/configure-vault-using-the-cli.rst index 7236b5842..1e56144dd 100644 --- a/doc/source/security/kubernetes/configure-vault-using-the-cli.rst +++ b/doc/source/security/kubernetes/configure-vault-using-the-cli.rst @@ -99,7 +99,7 @@ You can configure Vault by logging into a Vault server pod and using Vault CLI. .. code-block:: none $ vault policy write basic-secret-policy - <`. + diff --git a/doc/source/security/kubernetes/configure-vault.rst b/doc/source/security/kubernetes/configure-vault.rst index 738a40792..3e5f13452 100644 --- a/doc/source/security/kubernetes/configure-vault.rst +++ b/doc/source/security/kubernetes/configure-vault.rst @@ -79,7 +79,7 @@ The following steps use Vault's REST API and is run from controller-0. .. code-block:: none - $ curl --cacert /home/sysadmin/vault_ca.pem --header "X-Vault-Token:$ROOT_TOKEN" --request POST --data '{"type": "kv","version":"2"}' https://sva-vault.vault.svc.cluster.local:8200/v1/sys/mounts/secret + $ curl --cacert /home/sysadmin/vault_ca.pem --header "X-Vault-Token:$ROOT_TOKEN" --request POST --data '{"type": "kv","options":{"version":"2"}}' https://sva-vault.vault.svc.cluster.local:8200/v1/sys/mounts/secret For more information, see: @@ -100,7 +100,7 @@ The following steps use Vault's REST API and is run from controller-0. .. code-block:: none - $ curl --cacert /home/sysadmin/vault_ca.pem --header "X-Vault-Token:$ROOT_TOKEN" -H "Content-Type: application/json" --request PUT -d '{"policy":"path \"secret/basic-secret/*\" {capabilities = [\"read\"]}"}' https://sva-vault.vault.svc.cluster.local:8200/v1/sys/policy/basic-secret-policy + $ curl --cacert /home/sysadmin/vault_ca.pem --header "X-Vault-Token:$ROOT_TOKEN" -H "Content-Type: application/json" --request PUT -d '{"policy":"path \"secret/data/basic-secret/*\" {capabilities = [\"read\"]}"}' https://sva-vault.vault.svc.cluster.local:8200/v1/sys/policy/basic-secret-policy For more information, see, `https://www.vaultproject.io/docs/concepts/policies `__. @@ -133,13 +133,13 @@ The following steps use Vault's REST API and is run from controller-0. .. code-block:: none - $ curl --cacert /home/sysadmin/vault_ca.pem --header "X-Vault-Token:$ROOT_TOKEN" -H "Content-Type: application/json" -X POST -d '{"username":"pvtest","password":""}' https://sva-vault.vault.svc.cluster.local:8200/v1/secret/basic-secret/helloworld + $ curl --cacert /home/sysadmin/vault_ca.pem --header "X-Vault-Token:$ROOT_TOKEN" -H "Content-Type: application/json" -X POST -d '{"username":"pvtest","password":""}' https://sva-vault.vault.svc.cluster.local:8200/v1/secret/data/basic-secret/helloworld #. Verify the secret. .. code-block:: none - $ curl --cacert /home/sysadmin/vault_ca.pem --header "X-Vault-Token:$ROOT_TOKEN" https://sva-vault.vault.svc.cluster.local:8200/v1/secret/basic-secret/helloworld + $ curl --cacert /home/sysadmin/vault_ca.pem --header "X-Vault-Token:$ROOT_TOKEN" https://sva-vault.vault.svc.cluster.local:8200/v1/secret/data/basic-secret/helloworld #. (Optional) To enable and configure logging, use the steps below: diff --git a/doc/source/usertasks/kubernetes/vault-unaware.rst b/doc/source/usertasks/kubernetes/vault-unaware.rst index dbd04620b..8c139a99c 100644 --- a/doc/source/usertasks/kubernetes/vault-unaware.rst +++ b/doc/source/usertasks/kubernetes/vault-unaware.rst @@ -46,7 +46,7 @@ pod can access these secrets as files. .. code-block:: none - $ curl --cacert /home/sysadmin/vault_ca.pem --header "X-Vault-Token:$ROOT_TOKEN" -H "Content-Type: application/json" --request PUT -d '{"policy":"path \"secret/basic-secret/*\" {capabilities = [\"read\"]}"}' https://sva-vault.vault.svc.cluster.local:8200/v1/sys/policy/basic-secret-policy + $ curl --cacert /home/sysadmin/vault_ca.pem --header "X-Vault-Token:$ROOT_TOKEN" -H "Content-Type: application/json" --request PUT -d '{"policy":"path \"secret/data/basic-secret/*\" {capabilities = [\"read\"]}"}' https://sva-vault.vault.svc.cluster.local:8200/v1/sys/policy/basic-secret-policy #. Create the role with policy and namespace. @@ -58,13 +58,13 @@ pod can access these secrets as files. .. code-block:: none - $ curl --cacert /home/sysadmin/vault_ca.pem --header "X-Vault-Token:$ROOT_TOKEN" -H "Content-Type: application/json" -X POST -d '{"username":"pvtest","password":"Li69nux*"}' https://sva-vault.vault.svc.cluster.local:8200/v1/secret/basic-secret/helloworld + $ curl --cacert /home/sysadmin/vault_ca.pem --header "X-Vault-Token:$ROOT_TOKEN" -H "Content-Type: application/json" -X POST -d '{"username":"pvtest","password":"Li69nux*"}' https://sva-vault.vault.svc.cluster.local:8200/v1/secret/data/basic-secret/helloworld #. Verify the secret. .. code-block:: none - $ curl --cacert /home/sysadmin/vault_ca.pem --header "X-Vault-Token:$ROOT_TOKEN" https://sva-vault.vault.svc.cluster.local:8200/v1/secret/basic-secret/helloworld + $ curl --cacert /home/sysadmin/vault_ca.pem --header "X-Vault-Token:$ROOT_TOKEN" https://sva-vault.vault.svc.cluster.local:8200/v1/secret/data/basic-secret/helloworld .. rubric:: |proc| @@ -103,12 +103,12 @@ pod can access these secrets as files. annotations: vault.hashicorp.com/agent-inject: "true" vault.hashicorp.com/tls-skip-verify: "true" - vault.hashicorp.com/agent-inject-secret-helloworld: "secret/basic-secret/helloworld" + vault.hashicorp.com/agent-inject-secret-helloworld: "secret/data/basic-secret/helloworld" vault.hashicorp.com/agent-inject-template-helloworld: | - {{- with secret "secret/basic-secret/helloworld" -}} + {{- with secret "secret/data/basic-secret/helloworld" -}} { - "username" : "{{ .Data.username }}", - "password" : "{{ .Data.password }}" + "username" : "{{ .Data.data.username }}", + "password" : "{{ .Data.data.password }}" } {{- end }} vault.hashicorp.com/role: "basic-secret-role"