mirror of
https://github.com/marcel-dempers/docker-development-youtube-series.git
synced 2025-06-06 17:01:30 +00:00
Marcel Dempers
GitHub
commit
cfb70bac24
11
hashicorp/vault-2022/consul-values.yaml
Normal file
11
hashicorp/vault-2022/consul-values.yaml
Normal file
@ -0,0 +1,11 @@
|
|||||||
|
global:
|
||||||
|
datacenter: vault-kubernetes-guide
|
||||||
|
|
||||||
|
client:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
server:
|
||||||
|
replicas: 1
|
||||||
|
bootstrapExpect: 1
|
||||||
|
disruptionBudget:
|
||||||
|
maxUnavailable: 0
|
||||||
@ -0,0 +1,39 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: basic-secret
|
||||||
|
labels:
|
||||||
|
app: basic-secret
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: basic-secret
|
||||||
|
replicas: 1
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
vault.hashicorp.com/agent-inject: "true"
|
||||||
|
vault.hashicorp.com/tls-skip-verify: "true"
|
||||||
|
vault.hashicorp.com/agent-inject-secret-helloworld: "secret/basic-secret/helloworld"
|
||||||
|
vault.hashicorp.com/agent-inject-template-helloworld: |
|
||||||
|
{{- with secret "secret/basic-secret/helloworld" -}}
|
||||||
|
{
|
||||||
|
"username" : "{{ .Data.username }}",
|
||||||
|
"password" : "{{ .Data.password }}"
|
||||||
|
}
|
||||||
|
{{- end }}
|
||||||
|
vault.hashicorp.com/role: "basic-secret-role"
|
||||||
|
labels:
|
||||||
|
app: basic-secret
|
||||||
|
spec:
|
||||||
|
serviceAccountName: basic-secret
|
||||||
|
containers:
|
||||||
|
- name: app
|
||||||
|
image: jweissig/app:0.0.1
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: basic-secret
|
||||||
|
labels:
|
||||||
|
app: basic-secret
|
||||||
52
hashicorp/vault-2022/example-apps/basic-secret/readme.md
Normal file
52
hashicorp/vault-2022/example-apps/basic-secret/readme.md
Normal file
@ -0,0 +1,52 @@
|
|||||||
|
# Basic Secret Injection
|
||||||
|
|
||||||
|
In order for us to start using secrets in vault, we need to setup a policy.
|
||||||
|
|
||||||
|
```
|
||||||
|
#Create a role for our app
|
||||||
|
|
||||||
|
kubectl -n vault exec -it vault-0 -- sh
|
||||||
|
|
||||||
|
vault write auth/kubernetes/role/basic-secret-role \
|
||||||
|
bound_service_account_names=basic-secret \
|
||||||
|
bound_service_account_namespaces=example-app \
|
||||||
|
policies=basic-secret-policy \
|
||||||
|
ttl=1h
|
||||||
|
```
|
||||||
|
|
||||||
|
The above maps our Kubernetes service account, used by our pod, to a policy.
|
||||||
|
Now lets create the policy to map our service account to a bunch of secrets
|
||||||
|
|
||||||
|
```
|
||||||
|
kubectl -n vault exec -it vault-0 -- sh
|
||||||
|
|
||||||
|
cat <<EOF > /home/vault/app-policy.hcl
|
||||||
|
path "secret/basic-secret/*" {
|
||||||
|
capabilities = ["read"]
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
vault policy write basic-secret-policy /home/vault/app-policy.hcl
|
||||||
|
```
|
||||||
|
|
||||||
|
Now our service account for our pod can access all secrets under `secret/basic-secret/*`
|
||||||
|
Lets create some secrets.
|
||||||
|
|
||||||
|
```
|
||||||
|
kubectl -n vault exec -it vault-0 -- sh
|
||||||
|
vault secrets enable -path=secret/ kv
|
||||||
|
vault kv put secret/basic-secret/helloworld username=dbuser password=sUp3rS3cUr3P@ssw0rd
|
||||||
|
```
|
||||||
|
|
||||||
|
Lets deploy our app and see if it works:
|
||||||
|
|
||||||
|
```
|
||||||
|
kubectl create ns example-app
|
||||||
|
kubectl -n example-app apply -f ./example-apps/basic-secret/deployment.yaml
|
||||||
|
kubectl -n example-app get pods
|
||||||
|
```
|
||||||
|
|
||||||
|
Once the pod is ready, the secret is injected into the pod at the following location:
|
||||||
|
|
||||||
|
```
|
||||||
|
kubectl -n example-app exec <pod-name> -- sh -c "cat /vault/secrets/helloworld"
|
||||||
|
```
|
||||||
7
hashicorp/vault-2022/kind.yaml
Normal file
7
hashicorp/vault-2022/kind.yaml
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
kind: Cluster
|
||||||
|
apiVersion: kind.x-k8s.io/v1alpha4
|
||||||
|
nodes:
|
||||||
|
- role: control-plane
|
||||||
|
- role: worker
|
||||||
|
- role: worker
|
||||||
|
- role: worker
|
||||||
626
hashicorp/vault-2022/manifests/consul.yaml
Normal file
626
hashicorp/vault-2022/manifests/consul.yaml
Normal file
@ -0,0 +1,626 @@
|
|||||||
|
---
|
||||||
|
# Source: consul/templates/server-disruptionbudget.yaml
|
||||||
|
# PodDisruptionBudget to prevent degrading the server cluster through
|
||||||
|
# voluntary cluster changes.
|
||||||
|
apiVersion: policy/v1
|
||||||
|
kind: PodDisruptionBudget
|
||||||
|
metadata:
|
||||||
|
name: consul-consul-server
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
app: consul
|
||||||
|
chart: consul-helm
|
||||||
|
heritage: Helm
|
||||||
|
release: consul
|
||||||
|
component: server
|
||||||
|
spec:
|
||||||
|
maxUnavailable: 0
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: consul
|
||||||
|
release: "consul"
|
||||||
|
component: server
|
||||||
|
---
|
||||||
|
# Source: consul/templates/client-serviceaccount.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: consul-consul-client
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
app: consul
|
||||||
|
chart: consul-helm
|
||||||
|
heritage: Helm
|
||||||
|
release: consul
|
||||||
|
component: client
|
||||||
|
---
|
||||||
|
# Source: consul/templates/server-serviceaccount.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: consul-consul-server
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
app: consul
|
||||||
|
chart: consul-helm
|
||||||
|
heritage: Helm
|
||||||
|
release: consul
|
||||||
|
component: server
|
||||||
|
---
|
||||||
|
# Source: consul/templates/client-config-configmap.yaml
|
||||||
|
# ConfigMap with extra configuration specified directly to the chart
|
||||||
|
# for client agents only.
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: consul-consul-client-config
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
app: consul
|
||||||
|
chart: consul-helm
|
||||||
|
heritage: Helm
|
||||||
|
release: consul
|
||||||
|
component: client
|
||||||
|
data:
|
||||||
|
extra-from-values.json: |-
|
||||||
|
{}
|
||||||
|
|
||||||
|
central-config.json: |-
|
||||||
|
{
|
||||||
|
"enable_central_service_config": true
|
||||||
|
}
|
||||||
|
---
|
||||||
|
# Source: consul/templates/server-config-configmap.yaml
|
||||||
|
# StatefulSet to run the actual Consul server cluster.
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: consul-consul-server-config
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
app: consul
|
||||||
|
chart: consul-helm
|
||||||
|
heritage: Helm
|
||||||
|
release: consul
|
||||||
|
component: server
|
||||||
|
data:
|
||||||
|
extra-from-values.json: |-
|
||||||
|
{}
|
||||||
|
|
||||||
|
central-config.json: |-
|
||||||
|
{
|
||||||
|
"enable_central_service_config": true
|
||||||
|
}
|
||||||
|
---
|
||||||
|
# Source: consul/templates/client-role.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
name: consul-consul-client
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
app: consul
|
||||||
|
chart: consul-helm
|
||||||
|
heritage: Helm
|
||||||
|
release: consul
|
||||||
|
component: client
|
||||||
|
rules: []
|
||||||
|
---
|
||||||
|
# Source: consul/templates/server-role.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
name: consul-consul-server
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
app: consul
|
||||||
|
chart: consul-helm
|
||||||
|
heritage: Helm
|
||||||
|
release: consul
|
||||||
|
component: server
|
||||||
|
rules: []
|
||||||
|
---
|
||||||
|
# Source: consul/templates/client-rolebinding.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
name: consul-consul-client
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
app: consul
|
||||||
|
chart: consul-helm
|
||||||
|
heritage: Helm
|
||||||
|
release: consul
|
||||||
|
component: client
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: consul-consul-client
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: consul-consul-client
|
||||||
|
---
|
||||||
|
# Source: consul/templates/server-rolebinding.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
name: consul-consul-server
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
app: consul
|
||||||
|
chart: consul-helm
|
||||||
|
heritage: Helm
|
||||||
|
release: consul
|
||||||
|
component: server
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: consul-consul-server
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: consul-consul-server
|
||||||
|
---
|
||||||
|
# Source: consul/templates/dns-service.yaml
|
||||||
|
# Service for Consul DNS.
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: consul-consul-dns
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
app: consul
|
||||||
|
chart: consul-helm
|
||||||
|
heritage: Helm
|
||||||
|
release: consul
|
||||||
|
component: dns
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- name: dns-tcp
|
||||||
|
port: 53
|
||||||
|
protocol: "TCP"
|
||||||
|
targetPort: dns-tcp
|
||||||
|
- name: dns-udp
|
||||||
|
port: 53
|
||||||
|
protocol: "UDP"
|
||||||
|
targetPort: dns-udp
|
||||||
|
selector:
|
||||||
|
app: consul
|
||||||
|
release: "consul"
|
||||||
|
hasDNS: "true"
|
||||||
|
---
|
||||||
|
# Source: consul/templates/server-service.yaml
|
||||||
|
# Headless service for Consul server DNS entries. This service should only
|
||||||
|
# point to Consul servers. For access to an agent, one should assume that
|
||||||
|
# the agent is installed locally on the node and the NODE_IP should be used.
|
||||||
|
# If the node can't run a Consul agent, then this service can be used to
|
||||||
|
# communicate directly to a server agent.
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: consul-consul-server
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
app: consul
|
||||||
|
chart: consul-helm
|
||||||
|
heritage: Helm
|
||||||
|
release: consul
|
||||||
|
component: server
|
||||||
|
annotations:
|
||||||
|
# This must be set in addition to publishNotReadyAddresses due
|
||||||
|
# to an open issue where it may not work:
|
||||||
|
# https://github.com/kubernetes/kubernetes/issues/58662
|
||||||
|
service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
|
||||||
|
spec:
|
||||||
|
clusterIP: None
|
||||||
|
# We want the servers to become available even if they're not ready
|
||||||
|
# since this DNS is also used for join operations.
|
||||||
|
publishNotReadyAddresses: true
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
port: 8500
|
||||||
|
targetPort: 8500
|
||||||
|
- name: serflan-tcp
|
||||||
|
protocol: "TCP"
|
||||||
|
port: 8301
|
||||||
|
targetPort: 8301
|
||||||
|
- name: serflan-udp
|
||||||
|
protocol: "UDP"
|
||||||
|
port: 8301
|
||||||
|
targetPort: 8301
|
||||||
|
- name: serfwan-tcp
|
||||||
|
protocol: "TCP"
|
||||||
|
port: 8302
|
||||||
|
targetPort: 8302
|
||||||
|
- name: serfwan-udp
|
||||||
|
protocol: "UDP"
|
||||||
|
port: 8302
|
||||||
|
targetPort: 8302
|
||||||
|
- name: server
|
||||||
|
port: 8300
|
||||||
|
targetPort: 8300
|
||||||
|
- name: dns-tcp
|
||||||
|
protocol: "TCP"
|
||||||
|
port: 8600
|
||||||
|
targetPort: dns-tcp
|
||||||
|
- name: dns-udp
|
||||||
|
protocol: "UDP"
|
||||||
|
port: 8600
|
||||||
|
targetPort: dns-udp
|
||||||
|
selector:
|
||||||
|
app: consul
|
||||||
|
release: "consul"
|
||||||
|
component: server
|
||||||
|
---
|
||||||
|
# Source: consul/templates/ui-service.yaml
|
||||||
|
# UI Service for Consul Server
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: consul-consul-ui
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
app: consul
|
||||||
|
chart: consul-helm
|
||||||
|
heritage: Helm
|
||||||
|
release: consul
|
||||||
|
component: ui
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
app: consul
|
||||||
|
release: "consul"
|
||||||
|
component: server
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
port: 80
|
||||||
|
targetPort: 8500
|
||||||
|
---
|
||||||
|
# Source: consul/templates/client-daemonset.yaml
|
||||||
|
# DaemonSet to run the Consul clients on every node.
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: DaemonSet
|
||||||
|
metadata:
|
||||||
|
name: consul-consul
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
app: consul
|
||||||
|
chart: consul-helm
|
||||||
|
heritage: Helm
|
||||||
|
release: consul
|
||||||
|
component: client
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: consul
|
||||||
|
chart: consul-helm
|
||||||
|
release: consul
|
||||||
|
component: client
|
||||||
|
hasDNS: "true"
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: consul
|
||||||
|
chart: consul-helm
|
||||||
|
release: consul
|
||||||
|
component: client
|
||||||
|
hasDNS: "true"
|
||||||
|
annotations:
|
||||||
|
"consul.hashicorp.com/connect-inject": "false"
|
||||||
|
"consul.hashicorp.com/config-checksum": 797b3593a73b78fc74f3b1e3b978107b3022d4649802185631f959f000234331
|
||||||
|
spec:
|
||||||
|
terminationGracePeriodSeconds: 10
|
||||||
|
serviceAccountName: consul-consul-client
|
||||||
|
securityContext:
|
||||||
|
fsGroup: 1000
|
||||||
|
runAsGroup: 1000
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 100
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
- name: data
|
||||||
|
emptyDir: {}
|
||||||
|
- name: config
|
||||||
|
configMap:
|
||||||
|
name: consul-consul-client-config
|
||||||
|
containers:
|
||||||
|
- name: consul
|
||||||
|
image: "hashicorp/consul:1.11.1"
|
||||||
|
env:
|
||||||
|
- name: ADVERTISE_IP
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: status.podIP
|
||||||
|
- name: NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
- name: NODE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: spec.nodeName
|
||||||
|
- name: HOST_IP
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: status.hostIP
|
||||||
|
- name: POD_IP
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: status.podIP
|
||||||
|
- name: CONSUL_DISABLE_PERM_MGMT
|
||||||
|
value: "true"
|
||||||
|
|
||||||
|
command:
|
||||||
|
- "/bin/sh"
|
||||||
|
- "-ec"
|
||||||
|
- |
|
||||||
|
CONSUL_FULLNAME="consul-consul"
|
||||||
|
|
||||||
|
mkdir -p /consul/extra-config
|
||||||
|
cp /consul/config/extra-from-values.json /consul/extra-config/extra-from-values.json
|
||||||
|
[ -n "${HOST_IP}" ] && sed -Ei "s|HOST_IP|${HOST_IP?}|g" /consul/extra-config/extra-from-values.json
|
||||||
|
[ -n "${POD_IP}" ] && sed -Ei "s|POD_IP|${POD_IP?}|g" /consul/extra-config/extra-from-values.json
|
||||||
|
[ -n "${HOSTNAME}" ] && sed -Ei "s|HOSTNAME|${HOSTNAME?}|g" /consul/extra-config/extra-from-values.json
|
||||||
|
|
||||||
|
exec /usr/local/bin/docker-entrypoint.sh consul agent \
|
||||||
|
-node="${NODE}" \
|
||||||
|
-advertise="${ADVERTISE_IP}" \
|
||||||
|
-bind=0.0.0.0 \
|
||||||
|
-client=0.0.0.0 \
|
||||||
|
-node-meta=host-ip:${HOST_IP} \
|
||||||
|
-node-meta=pod-name:${HOSTNAME} \
|
||||||
|
-hcl='leave_on_terminate = true' \
|
||||||
|
-hcl='ports { grpc = 8502 }' \
|
||||||
|
-config-dir=/consul/config \
|
||||||
|
-datacenter=vault-kubernetes-guide \
|
||||||
|
-data-dir=/consul/data \
|
||||||
|
-retry-join="${CONSUL_FULLNAME}-server-0.${CONSUL_FULLNAME}-server.${NAMESPACE}.svc:8301" \
|
||||||
|
-config-file=/consul/extra-config/extra-from-values.json \
|
||||||
|
-domain=consul
|
||||||
|
volumeMounts:
|
||||||
|
- name: data
|
||||||
|
mountPath: /consul/data
|
||||||
|
- name: config
|
||||||
|
mountPath: /consul/config
|
||||||
|
ports:
|
||||||
|
- containerPort: 8500
|
||||||
|
hostPort: 8500
|
||||||
|
name: http
|
||||||
|
- containerPort: 8502
|
||||||
|
hostPort: 8502
|
||||||
|
name: grpc
|
||||||
|
- containerPort: 8301
|
||||||
|
protocol: "TCP"
|
||||||
|
name: serflan-tcp
|
||||||
|
- containerPort: 8301
|
||||||
|
protocol: "UDP"
|
||||||
|
name: serflan-udp
|
||||||
|
- containerPort: 8600
|
||||||
|
name: dns-tcp
|
||||||
|
protocol: "TCP"
|
||||||
|
- containerPort: 8600
|
||||||
|
name: dns-udp
|
||||||
|
protocol: "UDP"
|
||||||
|
readinessProbe:
|
||||||
|
# NOTE(mitchellh): when our HTTP status endpoints support the
|
||||||
|
# proper status codes, we should switch to that. This is temporary.
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- "/bin/sh"
|
||||||
|
- "-ec"
|
||||||
|
- |
|
||||||
|
curl http://127.0.0.1:8500/v1/status/leader \
|
||||||
|
2>/dev/null | grep -E '".+"'
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 100Mi
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 100Mi
|
||||||
|
securityContext:
|
||||||
|
null
|
||||||
|
---
|
||||||
|
# Source: consul/templates/server-statefulset.yaml
|
||||||
|
# StatefulSet to run the actual Consul server cluster.
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: StatefulSet
|
||||||
|
metadata:
|
||||||
|
name: consul-consul-server
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
app: consul
|
||||||
|
chart: consul-helm
|
||||||
|
heritage: Helm
|
||||||
|
release: consul
|
||||||
|
component: server
|
||||||
|
spec:
|
||||||
|
serviceName: consul-consul-server
|
||||||
|
podManagementPolicy: Parallel
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: consul
|
||||||
|
chart: consul-helm
|
||||||
|
release: consul
|
||||||
|
component: server
|
||||||
|
hasDNS: "true"
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: consul
|
||||||
|
chart: consul-helm
|
||||||
|
release: consul
|
||||||
|
component: server
|
||||||
|
hasDNS: "true"
|
||||||
|
annotations:
|
||||||
|
"consul.hashicorp.com/connect-inject": "false"
|
||||||
|
"consul.hashicorp.com/config-checksum": c9b100f895d5bda6a5c8bbebac73e1ab5bdc4cad06b04e72eb1b620677bfe41d
|
||||||
|
spec:
|
||||||
|
affinity:
|
||||||
|
podAntiAffinity:
|
||||||
|
requiredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
- labelSelector:
|
||||||
|
matchLabels:
|
||||||
|
app: consul
|
||||||
|
release: "consul"
|
||||||
|
component: server
|
||||||
|
topologyKey: kubernetes.io/hostname
|
||||||
|
terminationGracePeriodSeconds: 30
|
||||||
|
serviceAccountName: consul-consul-server
|
||||||
|
securityContext:
|
||||||
|
fsGroup: 1000
|
||||||
|
runAsGroup: 1000
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 100
|
||||||
|
volumes:
|
||||||
|
- name: config
|
||||||
|
configMap:
|
||||||
|
name: consul-consul-server-config
|
||||||
|
containers:
|
||||||
|
- name: consul
|
||||||
|
image: "hashicorp/consul:1.11.1"
|
||||||
|
env:
|
||||||
|
- name: ADVERTISE_IP
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: status.podIP
|
||||||
|
- name: HOST_IP
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: status.hostIP
|
||||||
|
- name: POD_IP
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: status.podIP
|
||||||
|
- name: NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
- name: CONSUL_DISABLE_PERM_MGMT
|
||||||
|
value: "true"
|
||||||
|
|
||||||
|
command:
|
||||||
|
- "/bin/sh"
|
||||||
|
- "-ec"
|
||||||
|
- |
|
||||||
|
CONSUL_FULLNAME="consul-consul"
|
||||||
|
|
||||||
|
mkdir -p /consul/extra-config
|
||||||
|
cp /consul/config/extra-from-values.json /consul/extra-config/extra-from-values.json
|
||||||
|
[ -n "${HOST_IP}" ] && sed -Ei "s|HOST_IP|${HOST_IP?}|g" /consul/extra-config/extra-from-values.json
|
||||||
|
[ -n "${POD_IP}" ] && sed -Ei "s|POD_IP|${POD_IP?}|g" /consul/extra-config/extra-from-values.json
|
||||||
|
[ -n "${HOSTNAME}" ] && sed -Ei "s|HOSTNAME|${HOSTNAME?}|g" /consul/extra-config/extra-from-values.json
|
||||||
|
|
||||||
|
exec /usr/local/bin/docker-entrypoint.sh consul agent \
|
||||||
|
-advertise="${ADVERTISE_IP}" \
|
||||||
|
-bind=0.0.0.0 \
|
||||||
|
-bootstrap-expect=1 \
|
||||||
|
-client=0.0.0.0 \
|
||||||
|
-config-dir=/consul/config \
|
||||||
|
-datacenter=vault-kubernetes-guide \
|
||||||
|
-data-dir=/consul/data \
|
||||||
|
-domain=consul \
|
||||||
|
-hcl="connect { enabled = true }" \
|
||||||
|
-ui \
|
||||||
|
-retry-join="${CONSUL_FULLNAME}-server-0.${CONSUL_FULLNAME}-server.${NAMESPACE}.svc:8301" \
|
||||||
|
-serf-lan-port=8301 \
|
||||||
|
-config-file=/consul/extra-config/extra-from-values.json \
|
||||||
|
-server
|
||||||
|
volumeMounts:
|
||||||
|
- name: data-vault
|
||||||
|
mountPath: /consul/data
|
||||||
|
- name: config
|
||||||
|
mountPath: /consul/config
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
containerPort: 8500
|
||||||
|
- name: serflan-tcp
|
||||||
|
containerPort: 8301
|
||||||
|
protocol: "TCP"
|
||||||
|
- name: serflan-udp
|
||||||
|
containerPort: 8301
|
||||||
|
protocol: "UDP"
|
||||||
|
- name: serfwan-tcp
|
||||||
|
containerPort: 8302
|
||||||
|
protocol: "TCP"
|
||||||
|
- name: serfwan-udp
|
||||||
|
containerPort: 8302
|
||||||
|
protocol: "UDP"
|
||||||
|
- name: server
|
||||||
|
containerPort: 8300
|
||||||
|
- name: dns-tcp
|
||||||
|
containerPort: 8600
|
||||||
|
protocol: "TCP"
|
||||||
|
- name: dns-udp
|
||||||
|
containerPort: 8600
|
||||||
|
protocol: "UDP"
|
||||||
|
readinessProbe:
|
||||||
|
# NOTE(mitchellh): when our HTTP status endpoints support the
|
||||||
|
# proper status codes, we should switch to that. This is temporary.
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- "/bin/sh"
|
||||||
|
- "-ec"
|
||||||
|
- |
|
||||||
|
curl http://127.0.0.1:8500/v1/status/leader \
|
||||||
|
2>/dev/null | grep -E '".+"'
|
||||||
|
failureThreshold: 2
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 3
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 5
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 100Mi
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 100Mi
|
||||||
|
securityContext:
|
||||||
|
null
|
||||||
|
volumeClaimTemplates:
|
||||||
|
- metadata:
|
||||||
|
name: data-vault
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 10Gi
|
||||||
|
---
|
||||||
|
# Source: consul/templates/tests/test-runner.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Pod
|
||||||
|
metadata:
|
||||||
|
name: "consul-consul-test"
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
app: consul
|
||||||
|
chart: consul-helm
|
||||||
|
heritage: Helm
|
||||||
|
release: consul
|
||||||
|
annotations:
|
||||||
|
"helm.sh/hook": test-success
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: consul-test
|
||||||
|
image: "hashicorp/consul:1.11.1"
|
||||||
|
env:
|
||||||
|
- name: HOST_IP
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: status.hostIP
|
||||||
|
- name: CONSUL_HTTP_ADDR
|
||||||
|
value: http://$(HOST_IP):8500
|
||||||
|
command:
|
||||||
|
- "/bin/sh"
|
||||||
|
- "-ec"
|
||||||
|
- |
|
||||||
|
consul members | tee members.txt
|
||||||
|
if [ $(grep -c consul-server members.txt) != $(grep consul-server members.txt | grep -c alive) ]
|
||||||
|
then
|
||||||
|
echo "Failed because not all consul servers are available"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
restartPolicy: Never
|
||||||
710
hashicorp/vault-2022/manifests/vault.yaml
Normal file
710
hashicorp/vault-2022/manifests/vault.yaml
Normal file
@ -0,0 +1,710 @@
|
|||||||
|
---
|
||||||
|
# Source: vault/templates/server-disruptionbudget.yaml
|
||||||
|
# PodDisruptionBudget to prevent degrading the server cluster through
|
||||||
|
# voluntary cluster changes.
|
||||||
|
apiVersion: policy/v1beta1
|
||||||
|
kind: PodDisruptionBudget
|
||||||
|
metadata:
|
||||||
|
name: vault
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: vault-0.19.0
|
||||||
|
app.kubernetes.io/name: vault
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
spec:
|
||||||
|
maxUnavailable: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/name: vault
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
component: server
|
||||||
|
---
|
||||||
|
# Source: vault/templates/injector-serviceaccount.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: vault-agent-injector
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: vault-agent-injector
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
---
|
||||||
|
# Source: vault/templates/server-serviceaccount.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: vault
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: vault-0.19.0
|
||||||
|
app.kubernetes.io/name: vault
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
---
|
||||||
|
# Source: vault/templates/server-config-configmap.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: vault-config
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: vault-0.19.0
|
||||||
|
app.kubernetes.io/name: vault
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
data:
|
||||||
|
extraconfig-from-values.hcl: |-
|
||||||
|
disable_mlock = true
|
||||||
|
ui = true
|
||||||
|
|
||||||
|
listener "tcp" {
|
||||||
|
tls_disable = 0
|
||||||
|
address = "0.0.0.0:8200"
|
||||||
|
tls_cert_file = "/vault/userconfig/tls-server/tls.crt"
|
||||||
|
tls_key_file = "/vault/userconfig/tls-server/tls.key"
|
||||||
|
tls_min_version = "tls12"
|
||||||
|
}
|
||||||
|
|
||||||
|
storage "consul" {
|
||||||
|
path = "vault"
|
||||||
|
address = "consul-consul-server:8500"
|
||||||
|
}
|
||||||
|
---
|
||||||
|
# Source: vault/templates/injector-clusterrole.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: vault-agent-injector-clusterrole
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: vault-agent-injector
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["admissionregistration.k8s.io"]
|
||||||
|
resources: ["mutatingwebhookconfigurations"]
|
||||||
|
verbs:
|
||||||
|
- "get"
|
||||||
|
- "list"
|
||||||
|
- "watch"
|
||||||
|
- "patch"
|
||||||
|
---
|
||||||
|
# Source: vault/templates/injector-clusterrolebinding.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: vault-agent-injector-binding
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: vault-agent-injector
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: vault-agent-injector-clusterrole
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: vault-agent-injector
|
||||||
|
namespace: vault
|
||||||
|
---
|
||||||
|
# Source: vault/templates/server-clusterrolebinding.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: vault-server-binding
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: vault-0.19.0
|
||||||
|
app.kubernetes.io/name: vault
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: system:auth-delegator
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: vault
|
||||||
|
namespace: vault
|
||||||
|
---
|
||||||
|
# Source: vault/templates/server-discovery-role.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
namespace: vault
|
||||||
|
name: vault-discovery-role
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: vault-0.19.0
|
||||||
|
app.kubernetes.io/name: vault
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
rules:
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["pods"]
|
||||||
|
verbs: ["get", "watch", "list", "update", "patch"]
|
||||||
|
---
|
||||||
|
# Source: vault/templates/server-discovery-rolebinding.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
name: vault-discovery-rolebinding
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: vault-0.19.0
|
||||||
|
app.kubernetes.io/name: vault
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: vault-discovery-role
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: vault
|
||||||
|
namespace: vault
|
||||||
|
---
|
||||||
|
# Source: vault/templates/injector-service.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: vault-agent-injector-svc
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: vault-agent-injector
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
|
||||||
|
spec:
|
||||||
|
ports:
|
||||||
|
- name: https
|
||||||
|
port: 443
|
||||||
|
targetPort: 8080
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/name: vault-agent-injector
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
component: webhook
|
||||||
|
---
|
||||||
|
# Source: vault/templates/server-ha-active-service.yaml
|
||||||
|
# Service for active Vault pod
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: vault-active
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: vault-0.19.0
|
||||||
|
app.kubernetes.io/name: vault
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
annotations:
|
||||||
|
|
||||||
|
spec:
|
||||||
|
publishNotReadyAddresses: true
|
||||||
|
ports:
|
||||||
|
- name: https
|
||||||
|
port: 8200
|
||||||
|
targetPort: 8200
|
||||||
|
- name: https-internal
|
||||||
|
port: 8201
|
||||||
|
targetPort: 8201
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/name: vault
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
component: server
|
||||||
|
vault-active: "true"
|
||||||
|
---
|
||||||
|
# Source: vault/templates/server-ha-standby-service.yaml
|
||||||
|
# Service for standby Vault pod
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: vault-standby
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: vault-0.19.0
|
||||||
|
app.kubernetes.io/name: vault
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
annotations:
|
||||||
|
|
||||||
|
spec:
|
||||||
|
publishNotReadyAddresses: true
|
||||||
|
ports:
|
||||||
|
- name: https
|
||||||
|
port: 8200
|
||||||
|
targetPort: 8200
|
||||||
|
- name: https-internal
|
||||||
|
port: 8201
|
||||||
|
targetPort: 8201
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/name: vault
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
component: server
|
||||||
|
vault-active: "false"
|
||||||
|
---
|
||||||
|
# Source: vault/templates/server-headless-service.yaml
|
||||||
|
# Service for Vault cluster
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: vault-internal
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: vault-0.19.0
|
||||||
|
app.kubernetes.io/name: vault
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
annotations:
|
||||||
|
|
||||||
|
spec:
|
||||||
|
clusterIP: None
|
||||||
|
publishNotReadyAddresses: true
|
||||||
|
ports:
|
||||||
|
- name: "https"
|
||||||
|
port: 8200
|
||||||
|
targetPort: 8200
|
||||||
|
- name: https-internal
|
||||||
|
port: 8201
|
||||||
|
targetPort: 8201
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/name: vault
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
component: server
|
||||||
|
---
|
||||||
|
# Source: vault/templates/server-service.yaml
|
||||||
|
# Service for Vault cluster
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: vault
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: vault-0.19.0
|
||||||
|
app.kubernetes.io/name: vault
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
annotations:
|
||||||
|
|
||||||
|
spec:
|
||||||
|
# We want the servers to become available even if they're not ready
|
||||||
|
# since this DNS is also used for join operations.
|
||||||
|
publishNotReadyAddresses: true
|
||||||
|
ports:
|
||||||
|
- name: https
|
||||||
|
port: 8200
|
||||||
|
targetPort: 8200
|
||||||
|
- name: https-internal
|
||||||
|
port: 8201
|
||||||
|
targetPort: 8201
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/name: vault
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
component: server
|
||||||
|
---
|
||||||
|
# Source: vault/templates/ui-service.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: vault-ui
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: vault-0.19.0
|
||||||
|
app.kubernetes.io/name: vault-ui
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/name: vault
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
component: server
|
||||||
|
publishNotReadyAddresses: true
|
||||||
|
ports:
|
||||||
|
- name: https
|
||||||
|
port: 8200
|
||||||
|
targetPort: 8200
|
||||||
|
type: ClusterIP
|
||||||
|
---
|
||||||
|
# Source: vault/templates/injector-deployment.yaml
|
||||||
|
# Deployment for the injector
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: vault-agent-injector
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: vault-agent-injector
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
component: webhook
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/name: vault-agent-injector
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
component: webhook
|
||||||
|
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: vault-agent-injector
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
component: webhook
|
||||||
|
spec:
|
||||||
|
|
||||||
|
affinity:
|
||||||
|
podAntiAffinity:
|
||||||
|
requiredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
- labelSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/name: vault-agent-injector
|
||||||
|
app.kubernetes.io/instance: "vault"
|
||||||
|
component: webhook
|
||||||
|
topologyKey: kubernetes.io/hostname
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
serviceAccountName: "vault-agent-injector"
|
||||||
|
hostNetwork: false
|
||||||
|
securityContext:
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsGroup: 1000
|
||||||
|
runAsUser: 100
|
||||||
|
containers:
|
||||||
|
- name: sidecar-injector
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 250m
|
||||||
|
memory: 256Mi
|
||||||
|
requests:
|
||||||
|
cpu: 50m
|
||||||
|
memory: 50Mi
|
||||||
|
|
||||||
|
image: "hashicorp/vault-k8s:0.14.1"
|
||||||
|
imagePullPolicy: "IfNotPresent"
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
env:
|
||||||
|
- name: AGENT_INJECT_LISTEN
|
||||||
|
value: :8080
|
||||||
|
- name: AGENT_INJECT_LOG_LEVEL
|
||||||
|
value: info
|
||||||
|
- name: AGENT_INJECT_VAULT_ADDR
|
||||||
|
value: https://vault.vault.svc:8200
|
||||||
|
- name: AGENT_INJECT_VAULT_AUTH_PATH
|
||||||
|
value: auth/kubernetes
|
||||||
|
- name: AGENT_INJECT_VAULT_IMAGE
|
||||||
|
value: "hashicorp/vault:1.9.2"
|
||||||
|
- name: AGENT_INJECT_TLS_AUTO
|
||||||
|
value: vault-agent-injector-cfg
|
||||||
|
- name: AGENT_INJECT_TLS_AUTO_HOSTS
|
||||||
|
value: vault-agent-injector-svc,vault-agent-injector-svc.vault,vault-agent-injector-svc.vault.svc
|
||||||
|
- name: AGENT_INJECT_LOG_FORMAT
|
||||||
|
value: standard
|
||||||
|
- name: AGENT_INJECT_REVOKE_ON_SHUTDOWN
|
||||||
|
value: "false"
|
||||||
|
- name: AGENT_INJECT_CPU_REQUEST
|
||||||
|
value: "250m"
|
||||||
|
- name: AGENT_INJECT_CPU_LIMIT
|
||||||
|
value: "500m"
|
||||||
|
- name: AGENT_INJECT_MEM_REQUEST
|
||||||
|
value: "64Mi"
|
||||||
|
- name: AGENT_INJECT_MEM_LIMIT
|
||||||
|
value: "128Mi"
|
||||||
|
- name: AGENT_INJECT_DEFAULT_TEMPLATE
|
||||||
|
value: "map"
|
||||||
|
- name: AGENT_INJECT_TEMPLATE_CONFIG_EXIT_ON_RETRY_FAILURE
|
||||||
|
value: "true"
|
||||||
|
|
||||||
|
- name: POD_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.name
|
||||||
|
args:
|
||||||
|
- agent-inject
|
||||||
|
- 2>&1
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /health/ready
|
||||||
|
port: 8080
|
||||||
|
scheme: HTTPS
|
||||||
|
failureThreshold: 2
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 2
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 5
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /health/ready
|
||||||
|
port: 8080
|
||||||
|
scheme: HTTPS
|
||||||
|
failureThreshold: 2
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 2
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 5
|
||||||
|
---
|
||||||
|
# Source: vault/templates/server-statefulset.yaml
|
||||||
|
# StatefulSet to run the actual vault server cluster.
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: StatefulSet
|
||||||
|
metadata:
|
||||||
|
name: vault
|
||||||
|
namespace: vault
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: vault
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
spec:
|
||||||
|
serviceName: vault-internal
|
||||||
|
podManagementPolicy: Parallel
|
||||||
|
replicas: 3
|
||||||
|
updateStrategy:
|
||||||
|
type: OnDelete
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/name: vault
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
component: server
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: vault-0.19.0
|
||||||
|
app.kubernetes.io/name: vault
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
component: server
|
||||||
|
spec:
|
||||||
|
|
||||||
|
affinity:
|
||||||
|
podAntiAffinity:
|
||||||
|
requiredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
- labelSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/name: vault
|
||||||
|
app.kubernetes.io/instance: "vault"
|
||||||
|
component: server
|
||||||
|
topologyKey: kubernetes.io/hostname
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
terminationGracePeriodSeconds: 10
|
||||||
|
serviceAccountName: vault
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsGroup: 1000
|
||||||
|
runAsUser: 100
|
||||||
|
fsGroup: 1000
|
||||||
|
volumes:
|
||||||
|
|
||||||
|
- name: config
|
||||||
|
configMap:
|
||||||
|
name: vault-config
|
||||||
|
|
||||||
|
- name: userconfig-tls-server
|
||||||
|
secret:
|
||||||
|
secretName: tls-server
|
||||||
|
defaultMode: 420
|
||||||
|
- name: userconfig-tls-ca
|
||||||
|
secret:
|
||||||
|
secretName: tls-ca
|
||||||
|
defaultMode: 420
|
||||||
|
- name: home
|
||||||
|
emptyDir: {}
|
||||||
|
containers:
|
||||||
|
- name: vault
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 2000m
|
||||||
|
memory: 16Gi
|
||||||
|
requests:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 50Mi
|
||||||
|
|
||||||
|
image: hashicorp/vault:1.9.2
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
command:
|
||||||
|
- "/bin/sh"
|
||||||
|
- "-ec"
|
||||||
|
args:
|
||||||
|
- |
|
||||||
|
cp /vault/config/extraconfig-from-values.hcl /tmp/storageconfig.hcl;
|
||||||
|
[ -n "${HOST_IP}" ] && sed -Ei "s|HOST_IP|${HOST_IP?}|g" /tmp/storageconfig.hcl;
|
||||||
|
[ -n "${POD_IP}" ] && sed -Ei "s|POD_IP|${POD_IP?}|g" /tmp/storageconfig.hcl;
|
||||||
|
[ -n "${HOSTNAME}" ] && sed -Ei "s|HOSTNAME|${HOSTNAME?}|g" /tmp/storageconfig.hcl;
|
||||||
|
[ -n "${API_ADDR}" ] && sed -Ei "s|API_ADDR|${API_ADDR?}|g" /tmp/storageconfig.hcl;
|
||||||
|
[ -n "${TRANSIT_ADDR}" ] && sed -Ei "s|TRANSIT_ADDR|${TRANSIT_ADDR?}|g" /tmp/storageconfig.hcl;
|
||||||
|
[ -n "${RAFT_ADDR}" ] && sed -Ei "s|RAFT_ADDR|${RAFT_ADDR?}|g" /tmp/storageconfig.hcl;
|
||||||
|
/usr/local/bin/docker-entrypoint.sh vault server -config=/tmp/storageconfig.hcl
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
env:
|
||||||
|
- name: HOST_IP
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: status.hostIP
|
||||||
|
- name: POD_IP
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: status.podIP
|
||||||
|
- name: VAULT_K8S_POD_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.name
|
||||||
|
- name: VAULT_K8S_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
- name: VAULT_ADDR
|
||||||
|
value: "https://127.0.0.1:8200"
|
||||||
|
- name: VAULT_API_ADDR
|
||||||
|
value: "https://$(POD_IP):8200"
|
||||||
|
- name: SKIP_CHOWN
|
||||||
|
value: "true"
|
||||||
|
- name: SKIP_SETCAP
|
||||||
|
value: "true"
|
||||||
|
- name: HOSTNAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.name
|
||||||
|
- name: VAULT_CLUSTER_ADDR
|
||||||
|
value: "https://$(HOSTNAME).vault-internal:8201"
|
||||||
|
- name: HOME
|
||||||
|
value: "/home/vault"
|
||||||
|
|
||||||
|
|
||||||
|
- name: "VAULT_CACERT"
|
||||||
|
value: "/vault/userconfig/tls-ca/tls.crt"
|
||||||
|
|
||||||
|
volumeMounts:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- name: config
|
||||||
|
mountPath: /vault/config
|
||||||
|
|
||||||
|
- name: userconfig-tls-server
|
||||||
|
readOnly: true
|
||||||
|
mountPath: /vault/userconfig/tls-server
|
||||||
|
- name: userconfig-tls-ca
|
||||||
|
readOnly: true
|
||||||
|
mountPath: /vault/userconfig/tls-ca
|
||||||
|
- name: home
|
||||||
|
mountPath: /home/vault
|
||||||
|
ports:
|
||||||
|
- containerPort: 8200
|
||||||
|
name: https
|
||||||
|
- containerPort: 8201
|
||||||
|
name: https-internal
|
||||||
|
- containerPort: 8202
|
||||||
|
name: https-rep
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: "/v1/sys/health?standbyok=true&sealedcode=204&uninitcode=204"
|
||||||
|
port: 8200
|
||||||
|
scheme: HTTPS
|
||||||
|
failureThreshold: 2
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 5
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 3
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: "/v1/sys/health?standbyok=true"
|
||||||
|
port: 8200
|
||||||
|
scheme: HTTPS
|
||||||
|
failureThreshold: 2
|
||||||
|
initialDelaySeconds: 60
|
||||||
|
periodSeconds: 5
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 3
|
||||||
|
lifecycle:
|
||||||
|
# Vault container doesn't receive SIGTERM from Kubernetes
|
||||||
|
# and after the grace period ends, Kube sends SIGKILL. This
|
||||||
|
# causes issues with graceful shutdowns such as deregistering itself
|
||||||
|
# from Consul (zombie services).
|
||||||
|
preStop:
|
||||||
|
exec:
|
||||||
|
command: [
|
||||||
|
"/bin/sh", "-c",
|
||||||
|
# Adding a sleep here to give the pod eviction a
|
||||||
|
# chance to propagate, so requests will not be made
|
||||||
|
# to this pod while it's terminating
|
||||||
|
"sleep 5 && kill -SIGTERM $(pidof vault)",
|
||||||
|
]
|
||||||
|
|
||||||
|
|
||||||
|
volumeClaimTemplates:
|
||||||
|
---
|
||||||
|
# Source: vault/templates/injector-mutating-webhook.yaml
|
||||||
|
apiVersion: admissionregistration.k8s.io/v1
|
||||||
|
kind: MutatingWebhookConfiguration
|
||||||
|
metadata:
|
||||||
|
name: vault-agent-injector-cfg
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: vault-agent-injector
|
||||||
|
app.kubernetes.io/instance: vault
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
webhooks:
|
||||||
|
- name: vault.hashicorp.com
|
||||||
|
sideEffects: None
|
||||||
|
admissionReviewVersions:
|
||||||
|
- "v1beta1"
|
||||||
|
- "v1"
|
||||||
|
clientConfig:
|
||||||
|
service:
|
||||||
|
name: vault-agent-injector-svc
|
||||||
|
namespace: vault
|
||||||
|
path: "/mutate"
|
||||||
|
caBundle: ""
|
||||||
|
rules:
|
||||||
|
- operations: ["CREATE", "UPDATE"]
|
||||||
|
apiGroups: [""]
|
||||||
|
apiVersions: ["v1"]
|
||||||
|
resources: ["pods"]
|
||||||
|
failurePolicy: Ignore
|
||||||
|
---
|
||||||
|
# Source: vault/templates/tests/server-test.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Pod
|
||||||
|
metadata:
|
||||||
|
name: "vault-server-test"
|
||||||
|
namespace: vault
|
||||||
|
annotations:
|
||||||
|
"helm.sh/hook": test
|
||||||
|
spec:
|
||||||
|
|
||||||
|
containers:
|
||||||
|
- name: vault-server-test
|
||||||
|
image: hashicorp/vault:1.9.2
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
env:
|
||||||
|
- name: VAULT_ADDR
|
||||||
|
value: https://vault.vault.svc:8200
|
||||||
|
|
||||||
|
- name: "VAULT_CACERT"
|
||||||
|
value: "/vault/userconfig/tls-ca/tls.crt"
|
||||||
|
command:
|
||||||
|
- /bin/sh
|
||||||
|
- -c
|
||||||
|
- |
|
||||||
|
echo "Checking for sealed info in 'vault status' output"
|
||||||
|
ATTEMPTS=10
|
||||||
|
n=0
|
||||||
|
until [ "$n" -ge $ATTEMPTS ]
|
||||||
|
do
|
||||||
|
echo "Attempt" $n...
|
||||||
|
vault status -format yaml | grep -E '^sealed: (true|false)' && break
|
||||||
|
n=$((n+1))
|
||||||
|
sleep 5
|
||||||
|
done
|
||||||
|
if [ $n -ge $ATTEMPTS ]; then
|
||||||
|
echo "timed out looking for sealed info in 'vault status' output"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
exit 0
|
||||||
|
volumeMounts:
|
||||||
|
volumes:
|
||||||
|
restartPolicy: Never
|
||||||
200
hashicorp/vault-2022/readme.md
Normal file
200
hashicorp/vault-2022/readme.md
Normal file
@ -0,0 +1,200 @@
|
|||||||
|
# Hashicorp Vault Guide
|
||||||
|
|
||||||
|
Requirements:
|
||||||
|
|
||||||
|
* Kubernetes 1.21
|
||||||
|
* Kind or Minikube
|
||||||
|
|
||||||
|
For this tutorial, I will be using Kubernetes 1.21.
|
||||||
|
If you are watching the old guide for Kuberentes 1.17, go [here](..\vault\readme.md)
|
||||||
|
|
||||||
|
Lets create a Kubernetes cluster to play with using [kind](https://kind.sigs.k8s.io/docs/user/quick-start/)
|
||||||
|
|
||||||
|
```
|
||||||
|
cd hashicorp/vault-2022
|
||||||
|
|
||||||
|
kind create cluster --name vault --image kindest/node:v1.21.1 --config kind.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
Next up, I will be running a small container where I will be doing all the work from:
|
||||||
|
You can skip this part if you already have `kubectl` and `helm` on your machine.
|
||||||
|
|
||||||
|
```
|
||||||
|
docker run -it --rm --net host -v ${HOME}/.kube/:/root/.kube/ -v ${PWD}:/work -w /work alpine sh
|
||||||
|
```
|
||||||
|
|
||||||
|
Install `kubectl`
|
||||||
|
|
||||||
|
```
|
||||||
|
apk add --no-cache curl
|
||||||
|
curl -LO https://storage.googleapis.com/kubernetes-release/release/`curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt`/bin/linux/amd64/kubectl
|
||||||
|
chmod +x ./kubectl
|
||||||
|
mv ./kubectl /usr/local/bin/kubectl
|
||||||
|
```
|
||||||
|
|
||||||
|
Install `helm`
|
||||||
|
|
||||||
|
```
|
||||||
|
curl -LO https://get.helm.sh/helm-v3.7.2-linux-amd64.tar.gz
|
||||||
|
tar -C /tmp/ -zxvf helm-v3.7.2-linux-amd64.tar.gz
|
||||||
|
rm helm-v3.7.2-linux-amd64.tar.gz
|
||||||
|
mv /tmp/linux-amd64/helm /usr/local/bin/helm
|
||||||
|
chmod +x /usr/local/bin/helm
|
||||||
|
```
|
||||||
|
|
||||||
|
Now we have `helm` and `kubectl` and can access our `kind` cluster:
|
||||||
|
|
||||||
|
```
|
||||||
|
kubectl get nodes
|
||||||
|
NAME STATUS ROLES AGE VERSION
|
||||||
|
vault-control-plane Ready control-plane,master 37s v1.21.1
|
||||||
|
```
|
||||||
|
|
||||||
|
Let's add the Helm repositories, so we can access the Kubernetes manifests
|
||||||
|
|
||||||
|
```
|
||||||
|
helm repo add hashicorp https://helm.releases.hashicorp.com
|
||||||
|
```
|
||||||
|
|
||||||
|
## Storage: Consul
|
||||||
|
|
||||||
|
We will use a very basic Consul cluster for our Vault backend. </br>
|
||||||
|
Let's find what versions of Consul are available:
|
||||||
|
|
||||||
|
```
|
||||||
|
helm search repo hashicorp/consul --versions
|
||||||
|
```
|
||||||
|
|
||||||
|
We can use chart `0.39.0` which is the latest at the time of this demo
|
||||||
|
Let's create a manifests folder and grab the YAML:
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
mkdir manifests
|
||||||
|
|
||||||
|
helm template consul hashicorp/consul \
|
||||||
|
--namespace vault \
|
||||||
|
--version 0.39.0 \
|
||||||
|
-f consul-values.yaml \
|
||||||
|
> ./manifests/consul.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
Deploy the consul services:
|
||||||
|
|
||||||
|
```
|
||||||
|
kubectl create ns vault
|
||||||
|
kubectl -n vault apply -f ./manifests/consul.yaml
|
||||||
|
kubectl -n vault get pods
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
## TLS End to End Encryption
|
||||||
|
|
||||||
|
See steps in [./tls/ssl_generate_self_signed.md](./tls/ssl_generate_self_signed.md)
|
||||||
|
You'll need to generate TLS certs (or bring your own)
|
||||||
|
Remember not to check-in your TLS to GIT :)
|
||||||
|
|
||||||
|
Create the TLS secret
|
||||||
|
|
||||||
|
```
|
||||||
|
kubectl -n vault create secret tls tls-ca \
|
||||||
|
--cert ./tls/ca.pem \
|
||||||
|
--key ./tls/ca-key.pem
|
||||||
|
|
||||||
|
kubectl -n vault create secret tls tls-server \
|
||||||
|
--cert ./tls/vault.pem \
|
||||||
|
--key ./tls/vault-key.pem
|
||||||
|
```
|
||||||
|
|
||||||
|
## Generate Kubernetes Manifests
|
||||||
|
|
||||||
|
|
||||||
|
Let's find what versions of vault are available:
|
||||||
|
|
||||||
|
```
|
||||||
|
helm search repo hashicorp/vault --versions
|
||||||
|
```
|
||||||
|
|
||||||
|
In this demo I will use the `0.19.0` chart </br>
|
||||||
|
|
||||||
|
Let's firstly create a `values` file to customize vault.
|
||||||
|
Let's grab the manifests:
|
||||||
|
|
||||||
|
```
|
||||||
|
helm template vault hashicorp/vault \
|
||||||
|
--namespace vault \
|
||||||
|
--version 0.19.0 \
|
||||||
|
-f vault-values.yaml \
|
||||||
|
> ./manifests/vault.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
## Deployment
|
||||||
|
|
||||||
|
```
|
||||||
|
kubectl -n vault apply -f ./manifests/vault.yaml
|
||||||
|
kubectl -n vault get pods
|
||||||
|
```
|
||||||
|
|
||||||
|
## Initialising Vault
|
||||||
|
|
||||||
|
```
|
||||||
|
kubectl -n vault exec -it vault-0 -- sh
|
||||||
|
kubectl -n vault exec -it vault-1 -- sh
|
||||||
|
kubectl -n vault exec -it vault-2 -- sh
|
||||||
|
|
||||||
|
vault operator init
|
||||||
|
vault operator unseal
|
||||||
|
|
||||||
|
kubectl -n vault exec -it vault-0 -- vault status
|
||||||
|
kubectl -n vault exec -it vault-1 -- vault status
|
||||||
|
kubectl -n vault exec -it vault-2 -- vault status
|
||||||
|
|
||||||
|
```
|
||||||
|
## Web UI
|
||||||
|
|
||||||
|
Let's checkout the web UI:
|
||||||
|
|
||||||
|
```
|
||||||
|
kubectl -n vault get svc
|
||||||
|
kubectl -n vault port-forward svc/vault-ui 443:8200
|
||||||
|
```
|
||||||
|
Now we can access the web UI [here]("https://localhost/")
|
||||||
|
|
||||||
|
## Enable Kubernetes Authentication
|
||||||
|
|
||||||
|
For the injector to be authorised to access vault, we need to enable K8s auth
|
||||||
|
|
||||||
|
```
|
||||||
|
kubectl -n vault exec -it vault-0 -- sh
|
||||||
|
|
||||||
|
vault login
|
||||||
|
vault auth enable kubernetes
|
||||||
|
|
||||||
|
vault write auth/kubernetes/config \
|
||||||
|
token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
|
||||||
|
kubernetes_host=https://${KUBERNETES_PORT_443_TCP_ADDR}:443 \
|
||||||
|
kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||||
|
exit
|
||||||
|
```
|
||||||
|
|
||||||
|
# Summary
|
||||||
|
|
||||||
|
So we have a vault, an injector, TLS end to end, stateful storage.
|
||||||
|
The injector can now inject secrets for pods from the vault.
|
||||||
|
|
||||||
|
Now we are ready to use the platform for different types of secrets:
|
||||||
|
|
||||||
|
## Secret Injection Guides
|
||||||
|
|
||||||
|
### Basic Secrets
|
||||||
|
|
||||||
|
Objective:
|
||||||
|
----------
|
||||||
|
* Let's create a basic secret in vault manually
|
||||||
|
* Application consumes the secret automatically
|
||||||
|
|
||||||
|
[Try it](./example-apps/basic-secret/readme.md)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
13
hashicorp/vault-2022/tls/ca-config.json
Normal file
13
hashicorp/vault-2022/tls/ca-config.json
Normal file
@ -0,0 +1,13 @@
|
|||||||
|
{
|
||||||
|
"signing": {
|
||||||
|
"default": {
|
||||||
|
"expiry": "175200h"
|
||||||
|
},
|
||||||
|
"profiles": {
|
||||||
|
"default": {
|
||||||
|
"usages": ["signing", "key encipherment", "server auth", "client auth"],
|
||||||
|
"expiry": "175200h"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
18
hashicorp/vault-2022/tls/ca-csr.json
Normal file
18
hashicorp/vault-2022/tls/ca-csr.json
Normal file
@ -0,0 +1,18 @@
|
|||||||
|
{
|
||||||
|
"hosts": [
|
||||||
|
"cluster.local"
|
||||||
|
],
|
||||||
|
"key": {
|
||||||
|
"algo": "rsa",
|
||||||
|
"size": 2048
|
||||||
|
},
|
||||||
|
"names": [
|
||||||
|
{
|
||||||
|
"C": "AU",
|
||||||
|
"L": "Melbourne",
|
||||||
|
"O": "Example",
|
||||||
|
"OU": "CA",
|
||||||
|
"ST": "Example"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
40
hashicorp/vault-2022/tls/ssl_generate_self_signed.md
Normal file
40
hashicorp/vault-2022/tls/ssl_generate_self_signed.md
Normal file
@ -0,0 +1,40 @@
|
|||||||
|
# Use CFSSL to generate certificates
|
||||||
|
|
||||||
|
More about [CFSSL here]("https://github.com/cloudflare/cfssl")
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
cd hashicorp\vault-2022\tls
|
||||||
|
|
||||||
|
docker run -it --rm -v ${PWD}:/work -w /work debian bash
|
||||||
|
|
||||||
|
apt-get update && apt-get install -y curl &&
|
||||||
|
curl -L https://github.com/cloudflare/cfssl/releases/download/v1.6.1/cfssl_1.6.1_linux_amd64 -o /usr/local/bin/cfssl && \
|
||||||
|
curl -L https://github.com/cloudflare/cfssl/releases/download/v1.6.1/cfssljson_1.6.1_linux_amd64 -o /usr/local/bin/cfssljson && \
|
||||||
|
chmod +x /usr/local/bin/cfssl && \
|
||||||
|
chmod +x /usr/local/bin/cfssljson
|
||||||
|
|
||||||
|
#generate ca in /tmp
|
||||||
|
cfssl gencert -initca ca-csr.json | cfssljson -bare /tmp/ca
|
||||||
|
|
||||||
|
#generate certificate in /tmp
|
||||||
|
cfssl gencert \
|
||||||
|
-ca=/tmp/ca.pem \
|
||||||
|
-ca-key=/tmp/ca-key.pem \
|
||||||
|
-config=ca-config.json \
|
||||||
|
-hostname="vault,vault.vault.svc.cluster.local,vault.vault.svc,localhost,127.0.0.1" \
|
||||||
|
-profile=default \
|
||||||
|
ca-csr.json | cfssljson -bare /tmp/vault
|
||||||
|
```
|
||||||
|
|
||||||
|
view the files:
|
||||||
|
|
||||||
|
```
|
||||||
|
ls -l /tmp
|
||||||
|
```
|
||||||
|
|
||||||
|
access the files:
|
||||||
|
|
||||||
|
```
|
||||||
|
mv /tmp/* .
|
||||||
|
```
|
||||||
85
hashicorp/vault-2022/vault-values.yaml
Normal file
85
hashicorp/vault-2022/vault-values.yaml
Normal file
@ -0,0 +1,85 @@
|
|||||||
|
# Vault Helm Chart Value Overrides
|
||||||
|
global:
|
||||||
|
enabled: true
|
||||||
|
tlsDisable: false
|
||||||
|
|
||||||
|
injector:
|
||||||
|
enabled: true
|
||||||
|
# Use the Vault K8s Image https://github.com/hashicorp/vault-k8s/
|
||||||
|
image:
|
||||||
|
repository: "hashicorp/vault-k8s"
|
||||||
|
tag: "0.14.1"
|
||||||
|
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: 50Mi
|
||||||
|
cpu: 50m
|
||||||
|
limits:
|
||||||
|
memory: 256Mi
|
||||||
|
cpu: 250m
|
||||||
|
|
||||||
|
server:
|
||||||
|
image:
|
||||||
|
repository: "hashicorp/vault"
|
||||||
|
tag: "1.9.2"
|
||||||
|
|
||||||
|
# These Resource Limits are in line with node requirements in the
|
||||||
|
# Vault Reference Architecture for a Small Cluster
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: 50Mi
|
||||||
|
cpu: 500m
|
||||||
|
limits:
|
||||||
|
memory: 16Gi
|
||||||
|
cpu: 2000m
|
||||||
|
|
||||||
|
# For HA configuration and because we need to manually init the vault,
|
||||||
|
# we need to define custom readiness/liveness Probe settings
|
||||||
|
readinessProbe:
|
||||||
|
enabled: true
|
||||||
|
path: "/v1/sys/health?standbyok=true&sealedcode=204&uninitcode=204"
|
||||||
|
livenessProbe:
|
||||||
|
enabled: true
|
||||||
|
path: "/v1/sys/health?standbyok=true"
|
||||||
|
initialDelaySeconds: 60
|
||||||
|
|
||||||
|
# extraEnvironmentVars is a list of extra environment variables to set with the stateful set. These could be
|
||||||
|
# used to include variables required for auto-unseal.
|
||||||
|
extraEnvironmentVars:
|
||||||
|
VAULT_CACERT: /vault/userconfig/tls-ca/tls.crt
|
||||||
|
|
||||||
|
# extraVolumes is a list of extra volumes to mount. These will be exposed
|
||||||
|
# to Vault in the path `/vault/userconfig/<name>/`.
|
||||||
|
extraVolumes:
|
||||||
|
- type: secret
|
||||||
|
name: tls-server
|
||||||
|
- type: secret
|
||||||
|
name: tls-ca
|
||||||
|
|
||||||
|
standalone:
|
||||||
|
enabled: false
|
||||||
|
|
||||||
|
# Run Vault in "HA" mode.
|
||||||
|
ha:
|
||||||
|
enabled: true
|
||||||
|
replicas: 3
|
||||||
|
config: |
|
||||||
|
ui = true
|
||||||
|
|
||||||
|
listener "tcp" {
|
||||||
|
tls_disable = 0
|
||||||
|
address = "0.0.0.0:8200"
|
||||||
|
tls_cert_file = "/vault/userconfig/tls-server/tls.crt"
|
||||||
|
tls_key_file = "/vault/userconfig/tls-server/tls.key"
|
||||||
|
tls_min_version = "tls12"
|
||||||
|
}
|
||||||
|
|
||||||
|
storage "consul" {
|
||||||
|
path = "vault"
|
||||||
|
address = "consul-consul-server:8500"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Vault UI
|
||||||
|
ui:
|
||||||
|
enabled: true
|
||||||
|
externalPort: 8200
|
||||||
@ -1,4 +1,4 @@
|
|||||||
# Hashicorp Vault Guide
|
# Hashicorp Vault Guide - Deprecated
|
||||||
|
|
||||||
# Vault
|
# Vault
|
||||||
|
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user