commit 11b9ceb53ae2b97bea240fa10be5df2ee23cbb96
parent d6135179f07821f11896409d25c707f3bec66de3
Author: MTRNord <mtrnord1@gmail.com>
Date: Sat, 25 Jan 2025 17:11:44 +0100
Deploy vault
Diffstat:
8 files changed, 158 insertions(+), 0 deletions(-)
diff --git a/apps/2024_cluster/kustomization.yaml b/apps/2024_cluster/kustomization.yaml
@@ -39,3 +39,4 @@ resources:
- ../base/mailserver
- ../base/miro-neoboard-exporter
- ../base/envoy-gateway
+ - ../base/vault
diff --git a/apps/2024_cluster/namespaces/kustomization.yaml b/apps/2024_cluster/namespaces/kustomization.yaml
@@ -28,3 +28,4 @@ resources:
- mailserver.yaml
- neoboard.yaml
- envoy-gateway.yaml
+ - vault.yaml
diff --git a/apps/2024_cluster/namespaces/vault.yaml b/apps/2024_cluster/namespaces/vault.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+ name: vault
diff --git a/apps/base/envoy-gateway/release.yaml b/apps/base/envoy-gateway/release.yaml
@@ -130,6 +130,18 @@ spec:
certificateRefs:
- kind: Secret
name: miro-export.neoboard.midnightthoughts.space-tls
+ - name: https-midnightthoughts-vault
+ protocol: HTTPS
+ hostname: "vault.midnightthoughts.space"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: vault.midnightthoughts.space-tls
- name: https-midnightthoughts-root
protocol: HTTPS
hostname: "midnightthoughts.space"
diff --git a/apps/base/vault/create_and_sign_tls.sh b/apps/base/vault/create_and_sign_tls.sh
@@ -0,0 +1,52 @@
+#!/bin/bash
+export SERVICE=vault-server-tls
+
+export NAMESPACE=vault
+
+export SECRET_NAME=vault-server-tls
+
+export TMPDIR=/tmp
+
+export CSR_NAME=vault-csr
+
+openssl genrsa -out ${TMPDIR}/vault.key 2048
+
+cat <<EOF >${TMPDIR}/csr.conf
+[req]
+req_extensions = v3_req
+distinguished_name = req_distinguished_name
+[req_distinguished_name]
+[ v3_req ]
+basicConstraints = CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+extendedKeyUsage = serverAuth
+subjectAltName = @alt_names
+[alt_names]
+DNS.1 = *.${SERVICE}
+DNS.2 = *.${SERVICE}.${NAMESPACE}
+DNS.3 = *.${SERVICE}.${NAMESPACE}.svc
+DNS.4 = *.${SERVICE}.${NAMESPACE}.svc.cluster.local
+IP.1 = 127.0.0.1
+EOF
+
+openssl req -new -key ${TMPDIR}/vault.key -subj "/CN=system:node:${SERVICE}.${NAMESPACE}.svc;/O=system:nodes" -out ${TMPDIR}/server.csr -config ${TMPDIR}/csr.conf
+
+cat <<EOF >${TMPDIR}/csr.yaml
+apiVersion: certificates.k8s.io/v1
+kind: CertificateSigningRequest
+metadata:
+ name: ${CSR_NAME}
+spec:
+ signerName: kubernetes.io/kubelet-serving
+ groups:
+ - system:authenticated
+ request: $(base64 ${TMPDIR}/server.csr | tr -d '\n')
+ signerName: kubernetes.io/kubelet-serving
+ usages:
+ - digital signature
+ - key encipherment
+ - server auth
+EOF
+
+kubectl create -f ${TMPDIR}/csr.yaml
+
diff --git a/apps/base/vault/kustomization.yaml b/apps/base/vault/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: vault
+resources:
+ - repository.yaml
+ - release.yaml
diff --git a/apps/base/vault/release.yaml b/apps/base/vault/release.yaml
@@ -0,0 +1,74 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+ name: vault
+ namespace: vault
+spec:
+ releaseName: vault
+ interval: 60m
+ chart:
+ spec:
+ chart: vault
+ sourceRef:
+ kind: HelmRepository
+ name: vault
+ values:
+ global:
+ enabled: true
+ tlsDisable: false
+ server:
+ extraEnvironmentVars:
+ VAULT_CACERT: "/vault/userconfig/vault-server-tls/vaultca.ca"
+ volumes:
+ - name: userconfig-vault-server-tls
+ secret:
+ defaultMode: 420
+ secretName: vault-server-tls
+ volumeMounts:
+ - mountPath: "/vault/userconfig/vault-server-tls"
+ name: userconfig-vault-server-tls
+ readOnly: true
+ auditStorage:
+ enabled: true
+ size: 10Gi
+ storageClass: cepth-filesystem
+ accessMode: ReadWriteMany
+ dataStorage:
+ enabled: true
+ size: 10Gi
+ storageClass: cepth-filesystem
+ accessMode: ReadWriteMany
+ service:
+ enabeled: true
+ standalone:
+ enabled: true
+ config: |
+ listener "tcp" {
+ address = "[::]:8200"
+ cluster_address = "[::]:8201"
+ tls_cert_file = "/vault/userconfig/vault-server-tls/vault.crt"
+ tls_key_file = "/vault/userconfig/vault-server-tls/vault.key"
+ tls_client_ca_file = "/vault/userconfig/vault-server-tls/vaultca.ca"
+ }
+
+ storage "file" {
+ path = "/vault/data"
+ }
+ ui:
+ enabled: true
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+ name: vault
+ namespace: vault
+spec:
+ parentRefs:
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ hostnames:
+ - vault.midnightthoughts.space
+ rules:
+ - backendRefs:
+ - name: vault
+ port: 3000
diff --git a/apps/base/vault/repository.yaml b/apps/base/vault/repository.yaml
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+ name: vault
+ namespace: vault
+spec:
+ interval: 60m
+ url: https://helm.releases.hashicorp.com
