{"id":13728,"date":"2022-01-02T10:37:39","date_gmt":"2022-01-02T10:37:39","guid":{"rendered":"https:\/\/engineering.lusha.com\/blog\/?p=13728"},"modified":"2022-01-02T10:37:39","modified_gmt":"2022-01-02T10:37:39","slug":"vault-golang-and-kubernetes-integration","status":"publish","type":"post","link":"https:\/\/engineering.lusha.com\/blog\/vault-golang-and-kubernetes-integration\/","title":{"rendered":"Vault, Golang and Kubernetes Integration"},"content":{"rendered":"

Being a data company,\u00a0Lusha<\/a> takes security issues very seriously. This is why we use Hashicorp’s Vault<\/a>.<\/p>\n

What is Vault?<\/h2>\n

Vault by HashiCorp is an identity-based secret and encryption management system. It helps manage credentials effectively.
\nA modern system requires access to a multitude of secrets: database credentials, API keys for external services, etc.
\nVault helps store your secret securely, define dynamic secrets, lease, renew and revoke secrets.<\/p>\n

Authentication Methods<\/h2>\n

Vault implements various authentication methods in order to assign identity and a set of policies to a user.
\nSome of Its auth methods includes: AppRole, Kubernetes, AWS, Github, Google Cloud, JWT\/OIDC,\u00a0 Kerberos, and Okta. For the sake of this article, I’ll focus on K8S<\/a> auth and show you how to implement Vault’s K8S auth with Golang,<\/p>\n

Kubernetes Authentication<\/h2>\n

In this method, we will leverage the Kubernetes Service Account Token.
\nThis authentication method makes it easy to introduce a Vault token into a Kubernetes Pod.<\/p>\n

In the section below we will implement a function that will authenticate to vault using K8S auth and will help us implement secrets fetching later on.<\/p>\n