GCP环境下Vault CSI Provider登录错误求助及Terraform配置疑问

错误核心是Vault无法获取GCP服务账号的公钥以验证JWT凭证，导致登录请求失败。常见诱因包括：

• 用于验证JWT的Vault关联GCP服务账号，缺少获取目标服务账号公钥的权限
• Vault的GCP Auth后端配置与GCP项目、服务账号信息不匹配
• 目标服务账号（system:serviceaccount:vault:service-web-app）的IAM权限或身份配置异常

以下是覆盖GCP权限配置、Vault GCP Auth后端设置、CSI Provider配置的完整代码示例：

1. 配置GCP服务账号与IAM权限 #

确保Vault使用的GCP服务账号拥有获取目标服务账号公钥的必要权限：

# 定义Pod使用的目标服务账号
resource "google_service_account" "web_app" {
  account_id   = "service-web-app"
  display_name = "Web App Service Account"
  project      = var.gcp_project_id
}

# 创建自定义IAM角色，包含获取服务账号公钥的权限
resource "google_project_iam_custom_role" "vault_gcp_auth" {
  role_id     = "VaultGcpAuthRole"
  title       = "Vault GCP Auth Role"
  description = "Permits Vault to fetch service account public keys for JWT verification"
  permissions = [
    "iam.serviceAccounts.getPublicKey",
  ]
  project     = var.gcp_project_id
}

# 将自定义角色绑定到Vault使用的GCP服务账号
resource "google_project_iam_member" "vault_auth_binding" {
  project = var.gcp_project_id
  role    = google_project_iam_custom_role.vault_gcp_auth.id
  member  = "serviceAccount:${var.vault_service_account_email}"
}

2. 配置Vault GCP Auth后端 #

启用GCP Auth后端并创建允许目标服务账号登录的Vault角色：

# 启用Vault GCP Auth后端
resource "vault_auth_backend" "gcp" {
  type = "gcp"
  path = "auth/gcp"
}

# 配置GCP Auth后端的项目与凭证信息
resource "vault_gcp_auth_backend_config" "default" {
  backend         = vault_auth_backend.gcp.path
  credentials     = file(var.gcp_service_account_key_path) # Vault关联的GCP服务账号密钥路径
  project         = var.gcp_project_id
}

# 创建允许web app服务账号登录的Vault角色
resource "vault_gcp_auth_backend_role" "web_app" {
  backend               = vault_auth_backend.gcp.path
  role                  = "web-app-role"
  type                  = "iam"
  bound_service_accounts = [
    google_service_account.web_app.email,
  ]
  token_policies        = ["web-app-secrets-policy"] # 替换为你的密钥访问策略名
}

3. 配置Vault CSI Provider的SecretProviderClass #

确保CSI Provider的配置与Vault GCP Auth角色匹配：

resource "kubernetes_manifest" "secret_provider_class" {
  manifest = {
    apiVersion = "secrets-store.csi.x-k8s.io/v1"
    kind       = "SecretProviderClass"
    metadata = {
      name      = "vault-secrets"
      namespace = "vault"
    }
    spec = {
      provider = "vault"
      parameters = {
        vaultAddress          = "https://vault.craft-code.com"
        vaultNamespace        = "vault"
        roleName              = "web-app-role" # 与上述Vault角色名一致
        authType              = "gcp"
        gcpServiceAccountName = "service-web-app" # 目标服务账号名
      }
      secretObjects = [
        {
          secretName = "app-secrets"
          type       = "Opaque"
          data = [
            {
              objectName = "db-password"
              key        = "DB_PASSWORD"
            }
          ]
        }
      ]
    }
  }
}

1. 应用配置后检查Vault Auth后端状态：

   vault auth list
   vault read auth/gcp/config
   

2. 手动测试服务账号登录流程：

   # 获取目标服务账号的JWT凭证
   gcloud auth print-identity-token --audiences="vault" --impersonate-service-account=${google_service_account.web_app.email}
   # 使用JWT登录Vault
   vault write auth/gcp/login role=web-app-role jwt=<生成的JWT_TOKEN>
   

内容的提问来源于stack exchange，提问作者wipcrep