AWS EKS Auto Unseal

Vault
1

Hello,
I am so confused here.

In order to accomplish auto-unseal issue on aws-eks, is it enough to do tasks under the topic or also are there other KMS related tasks must be completed?

      seal "awskms" {
        region     = "KMS_REGION_HERE"
        kms_key_id = "KMS_KEY_ID_HERE"
      }

Also, regarding to the config example, which one of following partitions is correct? Which one should I put into helm values file?

kubectl create secret -n vault generic eks-creds \
	--from-literal=AWS_ACCESS_KEY_ID=KIAX2SHTCUHNRYKJLKJG\
--from-literal=AWS_SECRET_ACCESS_KEY=asdfaDuhg847th23414dfad

(1)

  extraSecretEnvironmentVars:
    - envName: AWS_ACCESS_KEY_ID
      secretName: eks-creds
      secretKey: AWS_ACCESS_KEY_ID
    - envName: AWS_SECRET_ACCESS_KEY
      secretName: eks-creds
      secretKey: AWS_SECRET_ACCESS_KEY

(2)

  extraSecretEnvironmentVars:
    - envName: AWS_ACCESS_KEY_ID
      secretName: eks-creds
      secretKey: KIAX2SHTCUHNRYKJLKJG
    - envName: AWS_SECRET_ACCESS_KEY
      secretName: eks-creds
      secretKey: asdfaDuhg847th23414dfad

(3)

  extraSecretEnvironmentVars:
    - envName: KIAX2SHTCUHNRYKJLKJG
      secretName: eks-creds
      secretKey: KIAX2SHTCUHNRYKJLKJG
    - envName: asdfaDuhg847th23414dfad
      secretName: eks-creds
      secretKey: asdfaDuhg847th23414dfad

Could you please advise, I’ll be very appreciated.

Thanks & Reagrds

2

You need to actually do the key migration itself before you point your Vault at a KMS key.

The first example seems like the right one, it would sort of defeating the purpose of a secret if you had to put the secret itself into your values.yaml file.

3

Sorry, I didn’t understand, what is key migration? Is there any documentation, precudure or a receipt for it?

4

Also, where/how can I get vault-helm-unseal-key ? I think I should define something there before getting vault-helm-unseal-key. :roll_eyes:

5
6

You get your unseal key when you initialize your cluster.

7

Why do I need to migrate things before installation? I haven’t installed anything yet.
If there is already migrated copy of installation, I prefer to start from there.

8

…but to initialize the cluster, I need to install Vault. In order to install Vault I need to define the key in values.yaml file, don’t I ?

Error parsing Seal configuration: error fetching AWS KMS wrapping key information: RequestError: send request failed
caused by: Post "https://vpce-0e1bb1852241f8cc6-pzi0do8n.kms.us-east-1.vpce.amazonaws.com/": dial tcp: lookup vpce-0e1bb1852241f8cc6-pzi0do8n.kms.us-east-1.vpce.amazonaws.com on 10.100.0.10:53: no such host
9

You can do it either way, you deploy the cluster, manually initialize it (you can have the aws id/secret in your config) if you do then it’ll automatically use the KMS for the key. If you init using shamir then you need to do a key migration after.

10

Hello @aram
Thanks for your answer and advises but I think I couldn’t have explained my concern.

image
How can I fill these fields during deploying cluster? How can I complete the installation without fill these fields?