this repo has no description
feat: migrate Vault cluster to flux in staging
+148
+8
platform/staging/app-template.yaml
+8
platform/staging/app-template.yaml
+140
platform/staging/vault.yaml
+140
platform/staging/vault.yaml
···
47
47
values:
48
48
env:
49
49
VAULT_ADDR: http://vault-cluster.vault.svc.cluster.local:8200
50
+
---
51
+
apiVersion: helm.toolkit.fluxcd.io/v2
52
+
kind: HelmRelease
53
+
metadata:
54
+
name: vault
55
+
namespace: flux-system
56
+
spec:
57
+
interval: 30m
58
+
releaseName: vault
59
+
targetNamespace: vault
60
+
install:
61
+
createNamespace: true
62
+
chart:
63
+
spec:
64
+
chart: app-template
65
+
version: 4.6.0
66
+
sourceRef:
67
+
kind: HelmRepository
68
+
name: app-template
69
+
values:
70
+
persistence:
71
+
data:
72
+
accessMode: ReadWriteOnce
73
+
size: 2Gi
74
+
rawResources:
75
+
cluster:
76
+
apiVersion: vault.banzaicloud.com/v1alpha1
77
+
kind: Vault
78
+
spec:
79
+
spec:
80
+
config:
81
+
listener:
82
+
tcp:
83
+
address: 0.0.0.0:8200
84
+
tls_disable: true
85
+
storage:
86
+
file:
87
+
path: /vault/data
88
+
ui: true
89
+
externalConfig:
90
+
auth:
91
+
- roles:
92
+
- bound_service_account_names:
93
+
- '*'
94
+
bound_service_account_namespaces:
95
+
- '*'
96
+
name: default
97
+
policies:
98
+
- allow_secrets
99
+
ttl: 1h
100
+
type: kubernetes
101
+
policies:
102
+
- name: allow_secrets
103
+
rules: |
104
+
# TODO optimize this
105
+
path "secret/*" {
106
+
capabilities = ["create", "read", "update", "delete", "list"]
107
+
}
108
+
secrets:
109
+
- options:
110
+
version: 2
111
+
path: secret
112
+
type: kv
113
+
image: docker.io/hashicorp/vault:1.20.2
114
+
ingress:
115
+
annotations:
116
+
cert-manager.io/cluster-issuer: letsencrypt-prod
117
+
spec:
118
+
ingressClassName: nginx
119
+
rules:
120
+
- host: vault.cloudlab.khuedoan.com
121
+
http:
122
+
paths:
123
+
- backend:
124
+
service:
125
+
name: vault-cluster
126
+
port:
127
+
number: 8200
128
+
path: /
129
+
pathType: Prefix
130
+
tls:
131
+
- hosts:
132
+
- vault.cloudlab.khuedoan.com
133
+
secretName: vault-tls-certificate
134
+
serviceAccount: vault
135
+
size: 1
136
+
unsealConfig:
137
+
kubernetes:
138
+
secretNamespace: '{{ .Release.Namespace }}'
139
+
volumeMounts:
140
+
- mountPath: /vault/data
141
+
name: vault-data
142
+
volumes:
143
+
- name: vault-data
144
+
persistentVolumeClaim:
145
+
claimName: vault-data
146
+
rbac:
147
+
bindings:
148
+
cluster:
149
+
forceRename: vault
150
+
roleRef:
151
+
apiGroup: rbac.authorization.k8s.io
152
+
kind: ClusterRole
153
+
name: system:auth-delegator
154
+
subjects:
155
+
- kind: ServiceAccount
156
+
name: vault
157
+
namespace: '{{ .Release.Namespace }}'
158
+
type: ClusterRoleBinding
159
+
namespace:
160
+
forceRename: vault
161
+
roleRef:
162
+
apiGroup: rbac.authorization.k8s.io
163
+
kind: Role
164
+
name: vault
165
+
subjects:
166
+
- kind: ServiceAccount
167
+
name: vault
168
+
namespace: '{{ .Release.Namespace }}'
169
+
type: RoleBinding
170
+
roles:
171
+
vault:
172
+
rules:
173
+
- apiGroups:
174
+
- ""
175
+
resources:
176
+
- secrets
177
+
verbs:
178
+
- '*'
179
+
- apiGroups:
180
+
- ""
181
+
resources:
182
+
- pods
183
+
verbs:
184
+
- get
185
+
- update
186
+
- patch
187
+
type: Role
188
+
serviceAccount:
189
+
vault: {}