Certificate error when deploying Hashicorp Vault with Kubernetes Auth Method on AWS EKS - amazon-web-services

Question

I am trying to deploy Hashicorp Vault with Kubernetes Auth Method on AWS EKS.
Hashicorp Auth Method:
https://www.vaultproject.io/docs/auth/kubernetes.html
Procedure used, derived from CoreOS Vault Operator. Though I am not actually using their operator:
https://github.com/coreos/vault-operator/blob/master/doc/user/kubernetes-auth-backend.md
Below is the summary of the procedure use with some additional content. Essentially, I am getting a certificate error when attempting to actually login to vault after following the needed steps. Any help is appreciated.
Create the service account and clusterrolebinding for tokenreview:
$kubectl -n default create serviceaccount vault-tokenreview
$kubectl -n default create -f example/k8s_auth/vault-tokenreview-binding.yaml
Contents of vault-tokenreview-binding.yaml file
=========================================
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: vault-tokenreview-binding
namespace: default
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: system:auth-delegator
subjects:
- kind: ServiceAccount
name: vault-tokenreview
namespace: default
Enable vault auth and add Kubernetes cluster to vault:
$SECRET_NAME=$(kubectl -n default get serviceaccount vault-tokenreview -o jsonpath='{.secrets[0].name}')
$TR_ACCOUNT_TOKEN=$(kubectl -n default get secret ${SECRET_NAME} -o jsonpath='{.data.token}' | base64 --decode)
$vault auth-enable kubernetes
$vault write auth/kubernetes/config kubernetes_host=XXXXXXXXXX kubernetes_ca_cert=#ca.crt token_reviewer_jwt=$TR_ACCOUNT_TOKEN
Contents of ca.crt file
NOTE: I retrieved the certificate from AWS EKS console. Which
is shown in the "certificate authority" field in
base64 format. I base64 decoded it and placed it here
=================
-----BEGIN CERTIFICATE-----
* encoded entry *
-----END CERTIFICATE-----
Create the vault policy and role:
$vault write sys/policy/demo-policy policy=#example/k8s_auth/policy.hcl
Contents of policy.hcl file
=====================
path "secret/demo/*" {
capabilities = ["create", "read", "update", "delete", "list"]
}
$vault write auth/kubernetes/role/demo-role \
bound_service_account_names=default \
bound_service_account_namespaces=default \
policies=demo-policy \
ttl=1h
Attempt to login to vault using the service account created in last step:
$SECRET_NAME=$(kubectl -n default get serviceaccount default -o jsonpath='{.secrets[0].name}')
$DEFAULT_ACCOUNT_TOKEN=$(kubectl -n default get secret ${SECRET_NAME} -o jsonpath='{.data.token}' | base64 --decode)
$vault write auth/kubernetes/login role=demo-role jwt=${DEFAULT_ACCOUNT_TOKEN}
Error writing data to auth/kubernetes/login: Error making API request.
URL: PUT http://localhost:8200/v1/auth/kubernetes/login
Code: 500. Errors:
* Post https://XXXXXXXXX.sk1.us-west-2.eks.amazonaws.com/apis/authentication.k8s.io/v1/tokenreviews: x509: certificate signed by unknown authority

Answer 1

your kubernetes url https://XXXXXXXXX.sk1.us-west-2.eks.amazonaws.com has the bad cert try adding -tls-skip-verify
vault write -tls-skip-verify auth/kubernetes/login .......