Skip to content

Commit 0daeb7f

Browse files
mrsimonemmsmrsimonemms
committed
feat(kubernetes): install bank vaults operator
1 parent ec880b4 commit 0daeb7f

File tree

5 files changed

+301
-0
lines changed

5 files changed

+301
-0
lines changed

‎registry/clusters/dev/components/vault/operator.yaml

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: vault-operator
5+
namespace: argocd
6+
annotations:
7+
argocd.argoproj.io/sync-wave: "10"
8+
spec:
9+
project: default
10+
source:
11+
chart: vault-operator
12+
repoURL: ghcr.io/bank-vaults/helm-charts
13+
targetRevision: 1.22.3
14+
destination:
15+
server: https://kubernetes.default.svc
16+
namespace: vault
17+
syncPolicy:
18+
automated:
19+
prune: true
20+
selfHeal: true
21+
syncOptions:
22+
- CreateNamespace=true

‎registry/clusters/dev/components/vault/rbac.yaml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: vault-rbac
5+
namespace: argocd
6+
annotations:
7+
argocd.argoproj.io/sync-wave: "20"
8+
spec:
9+
project: default
10+
source:
11+
path: deploy/rbac
12+
repoURL: https://github.com/bank-vaults/vault-operator
13+
targetRevision: HEAD
14+
kustomize:
15+
namespace: vault
16+
destination:
17+
namespace: vault
18+
server: https://kubernetes.default.svc
19+
syncPolicy:
20+
automated:
21+
prune: true
22+
selfHeal: true
23+
syncOptions:
24+
- CreateNamespace=true

‎registry/clusters/dev/components/vault/vault.yaml

+171
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
apiVersion: vault.banzaicloud.com/v1alpha1
2+
kind: Vault
3+
metadata:
4+
name: vault
5+
namespace: vault
6+
labels:
7+
app.kubernetes.io/name: vault
8+
vault_cr: vault
9+
annotations:
10+
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
11+
argocd.argoproj.io/sync-wave: "30"
12+
spec:
13+
size: 3
14+
image: hashicorp/vault:1.18.1
15+
16+
annotations:
17+
common/annotation: "true"
18+
19+
vaultAnnotations:
20+
type/instance: vault
21+
22+
vaultConfigurerAnnotations:
23+
type/instance: vaultconfigurer
24+
25+
vaultLabels:
26+
example.com/log-format: json
27+
28+
vaultConfigurerLabels:
29+
example.com/log-format: string
30+
31+
serviceAccount: vault
32+
33+
serviceType: ClusterIP
34+
35+
ingress:
36+
annotations:
37+
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
38+
nginx.ingress.kubernetes.io/backend-protocol: HTTPS
39+
kubernetes.io/tls-acme: "true"
40+
cert-manager.io/cluster-issuer: letsencrypt-staging
41+
spec:
42+
ingressClassName: nginx
43+
rules:
44+
- host: vault.dev.simonemms.com
45+
http:
46+
paths:
47+
- backend:
48+
service:
49+
name: vault
50+
port:
51+
number: 8200
52+
path: /
53+
pathType: Prefix
54+
tls:
55+
- hosts:
56+
- vault.dev.simonemms.com
57+
secretName: vault-tls
58+
59+
volumeClaimTemplates:
60+
- metadata:
61+
name: vault-raft
62+
spec:
63+
accessModes:
64+
- ReadWriteOnce
65+
volumeMode: Filesystem
66+
resources:
67+
requests:
68+
storage: 1Gi
69+
70+
volumeMounts:
71+
- name: vault-raft
72+
mountPath: /vault/file
73+
74+
# Add Velero fsfreeze sidecar container and supporting hook annotations to Vault Pods:
75+
# https://velero.io/docs/v1.2.0/hooks/
76+
veleroEnabled: true
77+
78+
caNamespaces:
79+
- vswh
80+
81+
unsealConfig:
82+
options:
83+
preFlightChecks: true
84+
storeRootToken: true
85+
secretShares: 5
86+
secretThreshold: 3
87+
kubernetes:
88+
secretNamespace: vault
89+
90+
config:
91+
storage:
92+
raft:
93+
path: "/vault/file"
94+
listener:
95+
tcp:
96+
address: "0.0.0.0:8200"
97+
tls_cert_file: /vault/tls/server.crt
98+
tls_key_file: /vault/tls/server.key
99+
api_addr: https://vault.vault:8200
100+
cluster_addr: "https://${.Env.POD_NAME}:8201"
101+
ui: true
102+
103+
statsdDisabled: true
104+
105+
serviceRegistrationEnabled: true
106+
107+
resources:
108+
# A YAML representation of resource ResourceRequirements for vault container
109+
# Detail can reference: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container
110+
vault:
111+
limits:
112+
memory: "512Mi"
113+
cpu: "200m"
114+
requests:
115+
memory: "256Mi"
116+
cpu: "100m"
117+
118+
# See: https://banzaicloud.com/docs/bank-vaults/cli-tool/#example-external-vault-configuration
119+
# The repository also contains a lot examples in the test/deploy and operator/deploy directories.
120+
externalConfig:
121+
policies:
122+
- name: allow_secrets
123+
rules: path "secret/*" {
124+
capabilities = ["create", "read", "update", "delete", "list"]
125+
}
126+
127+
groups:
128+
- name: admin1
129+
policies:
130+
- allow_secrets
131+
metadata:
132+
privileged: true
133+
type: external
134+
- name: admin2
135+
policies:
136+
- allow_secrets
137+
metadata:
138+
privileged: true
139+
type: external
140+
141+
group-aliases:
142+
- name: admin1
143+
mountpath: token
144+
group: admin1
145+
146+
auth:
147+
- type: kubernetes
148+
roles:
149+
- name: default
150+
bound_service_account_names:
151+
- default
152+
- vault-secrets-webhook
153+
bound_service_account_namespaces:
154+
- vault
155+
- vswh
156+
policies:
157+
- allow_secrets
158+
ttl: 1h
159+
160+
secrets:
161+
- path: secret
162+
type: kv
163+
description: General secrets.
164+
options:
165+
version: 2
166+
167+
startupSecrets: []
168+
169+
vaultEnvsConfig:
170+
- name: VAULT_LOG_LEVEL
171+
value: debug

‎registry/clusters/dev/components/vault/wait.yaml

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: k8s-toolkit
5+
namespace: vault
6+
---
7+
apiVersion: rbac.authorization.k8s.io/v1
8+
kind: Role
9+
metadata:
10+
name: k8s-toolkit
11+
namespace: vault
12+
rules:
13+
- apiGroups:
14+
- ""
15+
- extensions
16+
- apps
17+
resources:
18+
- pods
19+
verbs:
20+
- list
21+
- watch
22+
---
23+
apiVersion: rbac.authorization.k8s.io/v1
24+
kind: RoleBinding
25+
metadata:
26+
name: k8s-toolkit
27+
namespace: vault
28+
roleRef:
29+
apiGroup: rbac.authorization.k8s.io
30+
kind: Role
31+
name: k8s-toolkit
32+
subjects:
33+
- kind: ServiceAccount
34+
name: k8s-toolkit
35+
namespace: vault
36+
---
37+
apiVersion: batch/v1
38+
kind: Job
39+
metadata:
40+
annotations:
41+
argocd.argoproj.io/sync-wave: "99"
42+
name: vault-wait
43+
namespace: vault
44+
spec:
45+
template:
46+
spec:
47+
containers:
48+
- args:
49+
- wait
50+
- -n
51+
- vault
52+
- -l
53+
- app.kubernetes.io/name=vault
54+
- pod
55+
- --for=condition=Ready
56+
- --timeout
57+
- 10m
58+
image: bitnami/kubectl:1.31
59+
imagePullPolicy: IfNotPresent
60+
name: wait
61+
restartPolicy: OnFailure
62+
serviceAccountName: k8s-toolkit

‎registry/clusters/dev/vault.yaml

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: vault-components
5+
namespace: argocd
6+
finalizers:
7+
- resources-finalizer.argocd.argoproj.io
8+
spec:
9+
project: default
10+
source:
11+
repoURL: https://github.com/mrsimonemms/infrastructure
12+
path: registry/clusters/dev/components/vault
13+
targetRevision: HEAD
14+
destination:
15+
server: https://kubernetes.default.svc
16+
namespace: vault
17+
syncPolicy:
18+
automated:
19+
prune: true
20+
selfHeal: true
21+
syncOptions:
22+
- CreateNamespace=true

0 commit comments

Comments
 (0)