cluster

commit de627a60f10d87bce4fea4eaf1a808b2565a2341
parent 4793111e12679c06ca6fdebd850bbeaa2ca8cc13
Author: MTRNord <mtrnord1@gmail.com>
Date:   Tue,  3 Jun 2025 16:41:17 +0200

Vault try 2

Diffstat:
M
apps/2024_cluster/kustomization.yaml
 | 
2
+-
D
apps/base/vault/create_and_sign_tls.sh
 | 
52
----------------------------------------------------
M
apps/base/vault/release.yaml
 | 
26
++++++++------------------

3 files changed, 9 insertions(+), 71 deletions(-)
diff --git a/apps/2024_cluster/kustomization.yaml b/apps/2024_cluster/kustomization.yaml
@@ -40,7 +40,7 @@ resources:
     - ../base/mailserver
     - ../base/miro-neoboard-exporter
     - ../base/envoy-gateway
-    #- ../base/vault
+    - ../base/vault
     # No arm images for rundeck :|
     #- ../base/rundeck
     - ../base/matrix/networkpolicies
diff --git a/apps/base/vault/create_and_sign_tls.sh b/apps/base/vault/create_and_sign_tls.sh
@@ -1,52 +0,0 @@
-#!/bin/bash
-export SERVICE=vault-server-tls
-
-export NAMESPACE=vault
-
-export SECRET_NAME=vault-server-tls
-
-export TMPDIR=/tmp
-
-export CSR_NAME=vault-csr
-
-openssl genrsa -out ${TMPDIR}/vault.key 2048
-
-cat <<EOF >${TMPDIR}/csr.conf
-[req]
-req_extensions = v3_req
-distinguished_name = req_distinguished_name
-[req_distinguished_name]
-[ v3_req ]
-basicConstraints = CA:FALSE
-keyUsage = nonRepudiation, digitalSignature, keyEncipherment
-extendedKeyUsage = serverAuth
-subjectAltName = @alt_names
-[alt_names]
-DNS.1 = *.${SERVICE}
-DNS.2 = *.${SERVICE}.${NAMESPACE}
-DNS.3 = *.${SERVICE}.${NAMESPACE}.svc
-DNS.4 = *.${SERVICE}.${NAMESPACE}.svc.cluster.local
-IP.1 = 127.0.0.1
-EOF
-
-openssl req -new -key ${TMPDIR}/vault.key -subj "/CN=system:node:${SERVICE}.${NAMESPACE}.svc;/O=system:nodes" -out ${TMPDIR}/server.csr -config ${TMPDIR}/csr.conf
-
-cat <<EOF >${TMPDIR}/csr.yaml
-apiVersion: certificates.k8s.io/v1
-kind: CertificateSigningRequest
-metadata:
-  name: ${CSR_NAME}
-spec:
-    signerName: kubernetes.io/kubelet-serving
-    groups:
-    - system:authenticated
-    request: $(base64 ${TMPDIR}/server.csr | tr -d '\n')
-    signerName: kubernetes.io/kubelet-serving
-    usages:
-    - digital signature
-    - key encipherment
-    - server auth
-EOF
-
-kubectl create -f ${TMPDIR}/csr.yaml
-
diff --git a/apps/base/vault/release.yaml b/apps/base/vault/release.yaml
@@ -9,25 +9,16 @@ spec:
     chart:
         spec:
             chart: vault
+            version: "0.30.0"
             sourceRef:
                 kind: HelmRepository
                 name: vault
     values:
         global:
             enabled: true
-            tlsDisable: false
+            # TODO: Correct?
+            tlsDisable: true
         server:
-            #extraEnvironmentVars:
-            #    VAULT_CACERT: "/vault/userconfig/vault-server-tls/vaultca.ca"
-            #volumes:
-            #    - name: userconfig-vault-server-tls
-            #      secret:
-            #          defaultMode: 420
-            #          secretName: vault-server-tls
-            #volumeMounts:
-            #    - mountPath: "/vault/userconfig/vault-server-tls"
-            #      name: userconfig-vault-server-tls
-            #      readOnly: true
             auditStorage:
                 enabled: true
                 size: 10Gi
@@ -35,7 +26,7 @@ spec:
                 accessMode: ReadWriteMany
             dataStorage:
                 enabled: true
-                size: 10Gi
+                size: 5Gi
                 storageClass: ceph-filesystem
                 accessMode: ReadWriteMany
             service:
@@ -43,12 +34,11 @@ spec:
             standalone:
                 enabled: true
                 config: |
+                    ui = true
+
                     listener "tcp" {
                       address = "[::]:8200"
                       cluster_address = "[::]:8201"
-                      #tls_cert_file = "/vault/userconfig/vault-server-tls/vault.crt"
-                      #tls_key_file  = "/vault/userconfig/vault-server-tls/vault.key"
-                      #tls_client_ca_file = "/vault/userconfig/vault-server-tls/vaultca.ca"
                       tls_disable = "true"
                     }
 
@@ -71,5 +61,5 @@ spec:
         - certs.midnightthoughts.space
     rules:
         - backendRefs:
-            - name: vault-ui
-              port: 8200
+              - name: vault-ui
+                port: 8200