feat: tls between vault and vault-operator working

NIAEFEUP · Aug 14, 2024 · 4094ee2 · 4094ee2
1 parent 784cd22
commit 4094ee2
Show file tree

Hide file tree

Showing 6 changed files with 12 additions and 9 deletions.
diff --git a/services/vault/00-namespaces.yaml b/services/vault/00-namespaces.yaml
@@ -2,10 +2,3 @@ kind: Namespace
 apiVersion: v1
 metadata:
   name: vault
-
----
-
-kind: Namespace
-apiVersion: v1
-metadata:
-  name: vault-operator
diff --git a/services/vault/01-certificates.yaml b/services/vault/01-certificates.yaml
@@ -21,6 +21,10 @@ metadata:
 spec:
   isCA: true
   commonName: "*"
+  ipAddresses:
+    - 127.0.0.1
+  dnsNames:
+    - vault.vault.svc.cluster.local
   secretName: vault-cluster-ca-secret
   privateKey:
     algorithm: ECDSA

diff --git a/services/vault/deploy-vault-dev.sh b/services/vault/deploy-vault-dev.sh
@@ -9,4 +9,4 @@ kubectl apply -f "$(dirname "$0")"/02-ingress-routes.yaml
 kubectl apply -f "$(dirname "$0")"/vault-sa.yaml
 
 helm upgrade --install vault hashicorp/vault --namespace vault --values $(dirname $0)/vault-dev-values.yaml
-helm upgrade --install vault-secrets-operator hashicorp/vault-secrets-operator --namespace vault-operator --values $(dirname $0)/vault-operator-dev-values.yaml
+helm upgrade --install vault-secrets-operator hashicorp/vault-secrets-operator --namespace vault --values $(dirname $0)/vault-operator-dev-values.yaml
diff --git a/services/vault/deploy-vault-prod.sh b/services/vault/deploy-vault-prod.sh
@@ -10,4 +10,4 @@ kubectl apply -f "$(dirname "$0")"/03-bundle.yaml
 kubectl apply -f "$(dirname "$0")"/vault-sa.yaml
 
 helm upgrade --install vault hashicorp/vault --namespace vault --values $(dirname $0)/vault-prod-values.yaml
-helm upgrade --install vault-secrets-operator hashicorp/vault-secrets-operator --namespace vault-operator --values $(dirname $0)/vault-operator-prod-values.yaml
+helm upgrade --install vault-secrets-operator hashicorp/vault-secrets-operator --namespace vault --values $(dirname $0)/vault-operator-prod-values.yaml
diff --git a/services/vault/vault-operator-prod-values.yaml b/services/vault/vault-operator-prod-values.yaml
@@ -1,7 +1,9 @@
+# https://github.com/hashicorp/vault-secrets-operator/blob/main/chart/values.yaml
 defaultVaultConnection:
   enabled: true
   address: "https://vault.vault.svc.cluster.local:8200"
   skipTLSVerify: false
+  caCertSecret: "vault-cluster-ca-secret"
 controller:
   manager:
     clientCache:

diff --git a/services/vault/vault-prod-values.yaml b/services/vault/vault-prod-values.yaml
@@ -8,6 +8,10 @@ server:
   dev:
     enabled: false
   logLevel: debug
+  extraEnvironmentVars:
+      VAULT_CACERT: /opt/vault/tls/ca.crt
+      VAULT_TLSCERT: /opt/vault/tls/tls.crt
+      VAULT_TLSKEY: /opt/vault/tls/tls.key
   volumes:
     - name: tls
       secret: