Short-lived token-based SSH access to MOSK cluster nodes

This blueprint outlines the configuration of HashiCorp Vault as an SSH certificate authority, the process of issuing short-lived SSH certificates through Vault, and the integration of Vault with Keycloak using OpenID Connect (OIDC). This integration enables cloud operators to obtain time-bound SSH credentials in a controlled, auditable, and user-friendly way.

• Architecture overview
  • Components and their roles
  • Authentication flow
• Configure token-based SSH access to MOSK using Vault and Keycloak
  • Prerequisites
  • Step 1. Prepare the environment variables
  • Step 2. Initialize and configure the Keycloak server
  • Step 3. Configure SSH certificates in Vault
  • Step 4. Configure OIDC integration and RBAC in Vault
  • Step 5. Configure MOSK cluster nodes (SSHD)
  • Step 6. Obtain SSH certificates and verify RBAC
  • Step 7. Configure audit and logging

See also

• HashiCorp Vault documentation

  • SSH secrets engine

  • JWT/OIDC authentication method

  • Identity concepts (Entities and Groups)

• Keycloak client scopes and protocol mappers

• OpenSSH documentation: ssh-keygen(1) certificates