Standalone Server with TLS with kubernetes 1.19+

Vault
1

I used this topics (Standalone Server with TLS | Vault by HashiCorp) to trust my pods to login with my vault server.

Since kubernetes 1.19, an APi updated : apiVersion: certificates.k8s.io/v1 kind: CertificateSigningRequest

Error: request to https://vault.vault.svc.cluster.local:8200/v1/auth/kubernetes/login failed, reason: write EPROTO 140333500554568:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../deps/openssl/openssl/ssl/record/ssl3_record.c:332:

How to solve this issue ? I needed to add an signerName (now mandatory)

 openssl req -new -key ${TMPDIR}/vault.key \
     -subj "/O=system:nodes/CN=system:node:${SERVICE}.${NAMESPACE}.svc" \
     -out ${TMPDIR}/server.csr -config ${TMPDIR}/csr.conf

and

apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
    name: ${CSR_NAME}
spec:
    groups:
    - system:authenticated
    request: $(cat ${TMPDIR}/server.csr | base64 | tr -d '\n')
    signerName:  kubernetes.io/kubelet-serving
    usages:
    - digital signature
    - key encipherment
    - server auth

thx

2

@fanfansama did you ever success with this method using certificates.k8s.io/v1 ?