Add option to allow TLS termination by load balancers (#437)

Signed-off-by: nathan.ribelin <[email protected]>
bank-vaults · Apr 22, 2024 · 3d710b9 · 3d710b9
1 parent 0c3cd7e
commit 3d710b9
Show file tree

Hide file tree

Showing 4 changed files with 14 additions and 1 deletion.
diff --git a/deploy/charts/vault-operator/crds/crd.yaml b/deploy/charts/vault-operator/crds/crd.yaml
@@ -775,6 +775,8 @@ spec:
                 type: string
               raftLeaderAddress:
                 type: string
+              raftLeaderApiSchemeOverride:
+                type: string
               resources:
                 properties:
                   bankVaults:

diff --git a/deploy/crd/bases/vault.banzaicloud.com_vaults.yaml b/deploy/crd/bases/vault.banzaicloud.com_vaults.yaml
@@ -775,6 +775,8 @@ spec:
                 type: string
               raftLeaderAddress:
                 type: string
+              raftLeaderApiSchemeOverride:
+                type: string
               resources:
                 properties:
                   bankVaults:

diff --git a/pkg/apis/vault/v1alpha1/vault_types.go b/pkg/apis/vault/v1alpha1/vault_types.go
@@ -206,6 +206,11 @@ type VaultSpec struct {
 	// default: ""
 	RaftLeaderAddress string `json:"raftLeaderAddress,omitempty"`
 
+	// RaftLeaderApiSchemeOverride will override the value provided from TLS defined values in order
+	// to handle TLS being terminated by an external reverse proxy, load balancer, etc.
+	// default: ""
+	RaftLeaderApiSchemeOverride string `json:"raftLeaderApiSchemeOverride,omitempty"`
+
 	// ServicePorts is an extra map of ports that should be exposed by the Vault Service.
 	// default:
 	ServicePorts map[string]int32 `json:"servicePorts,omitempty"`

diff --git a/pkg/controller/vault/vault_controller.go b/pkg/controller/vault/vault_controller.go
@@ -1163,11 +1163,15 @@ func statefulSetForVault(v *vaultv1alpha1.Vault, externalSecretsToWatchItems []c
 
 	if v.Spec.IsRaftStorage() {
 		raftLeaderAddress := v.Name
+		raftApiScheme := v.Spec.GetAPIScheme()
 		if v.Spec.IsRaftBootstrapFollower() {
 			raftLeaderAddress = v.Spec.RaftLeaderAddress
+			if v.Spec.RaftLeaderApiSchemeOverride != "" {
+				raftApiScheme = v.Spec.RaftLeaderApiSchemeOverride
+			}
 		}
 
-		unsealCommand = append(unsealCommand, "--raft", "--raft-leader-address", v.Spec.GetAPIScheme()+"://"+raftLeaderAddress+":8200")
+		unsealCommand = append(unsealCommand, "--raft", "--raft-leader-address", raftApiScheme+"://"+raftLeaderAddress+":8200")
 
 		if v.Spec.IsRaftBootstrapFollower() {
 			unsealCommand = append(unsealCommand, "--raft-secondary")