Reading secrets from Vault CLI

Question

I'm trying to read secrets from Vault using CLI using the following commands:

JWT=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
vault write auth/kubernetes/login role="${K8S_ROLE_IDENTIFIER}" jwt="${JWT}"

When calling vault write, I am getting the following:

'Error writing data to auth/kubernetes/login: Error making API request.\n'
'URL: PUT https://...:8200/v1/auth/kubernetes/login\n'
'Code: 400. Errors:\n'
'* missing client token\n'

The token is actually there. I was able to echo JWT but I am still getting missing client token error.

Any ideas?

Thank you!

The error is referencing the token for Vault client authentication. Did you authenticate before attempting to create the Kubernetes authentication engine role? — Matthew Schuchard, Jan 18 '22 at 20:16

score 1 · Answer 1 · answered Jan 19 '22 at 13:21

In this situation, the thrown error message is not referring to the JSON Web Token. The error message is referring to the lack of Vault client authentication. This authentication, regardless of method, eventually involves generating a bound token for authentication.

To remedy this error, you need to authenticate your Vault client with a token or other method. This authentication also requires an attached policy which would authorize enabling the Kubernetes authentication engine, or else the next error will be authorization related.

I was able to do this reading client_token from vault write and exporting to VAULT_TOKEN :) — briba, Jan 20 '22 at 08:21

score 0 · Accepted Answer · answered Jan 20 '22 at 08:22

0

Here's the solution:

VAULT_TOKEN=$(vault write -format="json" \
  auth/"${VAULT_PATH}"/login \
  role="${K8S_ROLE_IDENTIFIER}" \
  jwt="${JWT}" \
  | jq -r '.auth["client_token"]')

answered Jan 20 '22 at 08:22

briba

2,857
2
31
59

no need to use `jq` .. just use `-field` option.. check my answer – Abdennour TOUMI Aug 23 '22 at 05:03
interesting @AbdennourTOUMI! Thanks for sharing! – briba Aug 23 '22 at 09:07
Then React with the answer :) https://stackoverflow.com/a/73453378/747579 – Abdennour TOUMI Aug 23 '22 at 14:51

score 0 · Answer 3 · answered Aug 23 '22 at 05:03

0

Optimizing solutions of briba, by using -field=token option instead of depending on another command like jq :

VAULT_TOKEN=$(vault write -format="json" \
  auth/"${VAULT_PATH}"/login \
  role="${K8S_ROLE_IDENTIFIER}" \
  jwt="${JWT}" -field=token)

answered Aug 23 '22 at 05:03

Abdennour TOUMI

87,526
38
249
254

Reading secrets from Vault CLI

3 Answers3