Gitlab integration with Hashicorp Vault

0
votes

I have integrated my self hosted Gitlab with Hashicorp vault. I have followed the steps here https://docs.gitlab.com/ee/ci/examples/authenticating-with-hashicorp-vault/ and tried to run the pipeline.

I am receiving the certificate error while running the pipeline.

Error writing data to auth/jwt/login: Put "https://vault.systems:8200/v1/auth/jwt/login": x509: certificate signed by unknown authority

My .gitlab yml file -

Vault Client:
  image:
    name: vault:latest
    entrypoint:
        - '/usr/bin/env'
        - 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
  before_script:

  script:
    - export VAULT_ADDR=https:/vault.systems:8200/
    - export VAULT_TOKEN="$(vault write -field=token auth/jwt/login role=staging jwt=$CI_JOB_JWT)"
    - export PASSWORD="$(vault kv get -field=password kv/project/staging/db)"
    - echo $PASSWORD

If i use -tls-skip-verify flag then it works fine.

Do i need to place the self signed server certificate somewhere on the vault server or gitlab server? Please let me know if anyone has any ideas on this one?

4
gitlabhashicorp-vault

4 Answers

1
votes

The containers that are managed by the docker/kube executor must be configured to trust the self-signed cert(s). You can edit the config.toml for your runner to mount in the trusted certs/CA roots to GitLab CI job containers

For example, on Linux-based docker executors:

  [[runners]]
   name = "docker"
   url = "https://example.com/"
   token = "TOKEN"
   executor = "docker"

   [runners.docker]
     image = "ubuntu:latest"

     # Add path to your ca.crt file in the volumes list
     volumes = ["/cache", "/path/to-ca-cert-dir/ca.crt:/etc/gitlab-runner/certs/ca.crt:ro"]

See the docs for more info.

0
votes
Error writing data to auth/jwt/login: Put "https://vault.systems:8200/v1/auth/jwt/login": x509: certificate signed by unknown authority

The error you're receiving is being returned from Vault, so it's Vault that you need to get to accept that certificate. There's a decent note on how to do it in the Deployment Guide. (I used to work for HashiCorp Vault so I knew where to dig it up.)

0
votes

I was able to solve this by using this variable VAULT_CACERT in my gitlab.yml file : - export VAULT_CACERT=/etc/gitlab-runner/certs/ca.crt. The certificate path here is the path of the mounted container which we specify during the start of container.

Posting this so if anyone is looking for it, this is the solution. :)

0
votes

You can use -tls-skip-verify in your vault command vault kv get -tls-skip-verify -field=password kv/project/staging/db , or if you have vault's ca-cert you have to export CA CERT path by setting VAULT_CACERT to the right path .