vault-deploy/vault.yaml at master · UrbanOS-Examples/vault-deploy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
kubectl:
  version: "1.14.0"

jq:
  version: "1.6"

authMethod: "ldap"

vault:
  devMode: false
  port: 8200
  clusterPort: 8201
  repository: vault
  tag: 1.2.1
  pullPolicy: IfNotPresent
  volumeSize: 5Gi
  secretsPath: secrets/smart_city
  liveness:
    initialDelaySeconds: 30
    periodSeconds: 10
  readiness:
    initialDelaySeconds: 10
    periodSeconds: 10
  config:
    listener:
      tcp:
        address: "[::]:8200"
        cluster_address: "[::]:8201"
        tls_disable: true
        tls_prefer_server_cipher_suites: true
        tls_cipher_suites: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA
    storage:
      file:
        path: "/keys"
  roles:
    - name: discovery-api-role
      boundServiceAccounts: discovery-api
      boundServiceAccountNamespaces: discovery
      policies: discovery_api_aws
      tokenTtl: 2m
    - name: reaper-role
      boundServiceAccounts: reaper
      boundServiceAccountNamespaces: streaming-services
      policies: reaper_aws,dataset_access_keys
      tokenTtl: 2m
    - name: odo-role
      boundServiceAccounts: odo
      boundServiceAccountNamespaces: streaming-services
      policies: odo_aws
    - name: andi-role
      boundServiceAccounts: andi
      boundServiceAccountNamespaces: admin
      policies: andi_auth0,andi_write_only,andi_aws_keys
      tokenTtl: 2m
    - name: andi-public-role
      boundServiceAccounts: andi-public
      boundServiceAccountNamespaces: admin
      policies: andi_auth0,andi_aws_keys
      tokenTtl: 2m
    - name: doim-role
      boundServiceAccounts: doim-adapter
      boundServiceAccountNamespaces: doim
      policies: doim_access
      tokenTtl: 2m
    - name: parking-prediction-api-role
      boundServiceAccounts: parking-prediction-api
      boundServiceAccountNamespaces: predictive-parking
      policies: parking_prediction_api_aws
      tokenTtl: 2m
    - name: parking-prediction-train-role
      boundServiceAccounts: parking-prediction-train
      boundServiceAccountNamespaces: predictive-parking
      policies: parking_prediction_train_aws
      tokenTtl: 2m

  policies:
    - name: dataset_access_keys
      path: secrets/smart_city/ingestion/*
      capabilities: '["read", "list"]'
    - name: reaper_aws
      path: secrets/smart_city/aws_keys/reaper
      capabilities: '["read", "list"]'
    - name: odo_aws
      path: secrets/smart_city/aws_keys/odo
      capabilities: '["read", "list"]'
    - name: discovery_api_aws
      path: secrets/smart_city/aws_keys/discovery_api
      capabilities: '["read", "list"]'
    - name: doim_access
      path: secrets/smart_city/doim/*
      capabilities: '["read", "list"]'
    - name: parking_prediction_api_aws
      path: secrets/smart_city/aws_keys/parking_prediction_api
      capabilities: '["read", "list"]'
    - name: parking_prediction_train_aws
      path: secrets/smart_city/aws_keys/parking_prediction_train
      capabilities: '["read", "list"]'
    - name: andi_auth0
      path: secrets/smart_city/auth0/andi
      capabilities: '["read", "list"]'
    - name: andi_write_only
      path: secrets/smart_city/ingestion/*
      capabilities: '["create", "update", "list"]'
    - name: andi_aws_keys
      path: secrets/smart_city/aws_keys/andi
      capabilities: '["read", "list"]'