HashiCorp Vault Associate (003) Question 13
Select 11b Choose an authentication method based on use caseA company runs Vault in Kubernetes and also has several long-running virtual machines in a private datacenter. The security team wants each workload to authenticate to Vault without storing a static Vault token in configuration files. Kubernetes applications should authenticate using their native platform identity, and the virtual machines should authenticate based on their machine identity rather than a shared secret. Which authentication methods best fit these requirements?
- A
Use the Kubernetes auth method for the Kubernetes applications and the AppRole auth method for the virtual machines
- B
Use the Kubernetes auth method for the Kubernetes applications and the TLS certificate auth method for the virtual machines
- C
Use the Userpass auth method for the Kubernetes applications and the TLS certificate auth method for the virtual machines
- D
Use the Token auth method for the Kubernetes applications and the LDAP auth method for the virtual machines
- E
Use the JWT/OIDC auth method for the Kubernetes applications and the Userpass auth method for the virtual machines
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use authentication methods that align with the identity source already available to each workload. For Kubernetes workloads, Vault's Kubernetes auth method is purpose-built to validate Kubernetes service account tokens and map them to Vault roles. For long-running virtual machines, TLS certificate authentication is a strong choice when machines can present unique client certificates, allowing Vault to authenticate them based on machine identity instead of distributing a shared secret or static Vault token. This follows Vault best practices of preferring trusted external identity sources and short-lived credentials over embedded static tokens. HashiCorp documentation for Vault auth methods emphasizes selecting the auth method that matches the platform's native identity system, such as Kubernetes for Kubernetes workloads and cert-based auth when x509 machine identity is available.
- A. Incorrect.
Incorrect. The Kubernetes auth method is a strong fit for applications running in Kubernetes because it lets workloads authenticate using Kubernetes service account identity. However, AppRole is typically used when an application can securely obtain a role_id and secret_id. For long-running virtual machines, this often still introduces secret distribution and lifecycle concerns. The scenario specifically says the VMs should authenticate based on machine identity rather than a shared secret, so AppRole is not the best fit here.
- B. Correct.
Correct. The Kubernetes auth method is designed for workloads running in Kubernetes and uses Kubernetes-native identity, typically a service account token, to authenticate to Vault. For virtual machines, the TLS certificate auth method is a good fit when each machine has its own client certificate and can authenticate based on that machine identity. This avoids storing a static Vault token and aligns with the requirement to use machine identity instead of a shared secret.
- C. Incorrect.
Incorrect. Userpass is intended for human users authenticating with a username and password, not for platform-native workload authentication inside Kubernetes. While TLS certificate auth can work well for virtual machines, the Kubernetes side of this option does not match the use case and introduces unnecessary credential management for applications.
- D. Incorrect.
Incorrect. Token auth assumes the workload already has a Vault token, which is exactly what the security team wants to avoid storing in configuration files. LDAP is generally used for human users or directory-backed identities, not for authenticating machines based on their machine identity. This option conflicts with both parts of the scenario.
- E. Incorrect.
Incorrect. JWT/OIDC can be appropriate in some environments where workloads receive verifiable JWTs from an external identity provider, but the question specifically says Kubernetes applications should use their native platform identity. In Vault, the Kubernetes auth method is the native fit for that requirement. Userpass is also not appropriate for virtual machines because it represents user credentials rather than machine identity.