Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: add Hashicorp Vault external secret manager #7658

Merged
merged 41 commits into from
Feb 29, 2024
Merged

fix: add Hashicorp Vault external secret manager #7658

merged 41 commits into from
Feb 29, 2024

Conversation

misba7
Copy link
Contributor

@misba7 misba7 commented Feb 6, 2024

closes #7548

misba7 added 12 commits December 14, 2023 09:46
@misba7
docs: add network traffic notes
fabd77a
@misba7
docs: add network traffic notes
b2978f2 
Signed-off-by: Amro Misbah <amromisba7@gmail.com>
@misba7
Merge branch 'docs-jans-network' of https://github.com/JanssenProject…
2021921 
…/jans into docs-jans-network
@misba7
docs: add external communication
7195082 
Signed-off-by: Amro Misbah <amromisba7@gmail.com>
@misba7
Merge branches 'docs-jans-network' and 'main' of https://github.com/J…
a30b442 
…anssenProject/jans
@misba7
Merge branch 'main' of https://github.com/JanssenProject/jans
a8bd5b3
@misba7
Merge branch 'main' of https://github.com/JanssenProject/jans
7f762f0
@misba7
Merge branch 'main' of https://github.com/JanssenProject/jans
fe691c6
@misba7
Merge branch 'main' of https://github.com/JanssenProject/jans
16ecf9c
@misba7
Merge branch 'main' of https://github.com/JanssenProject/jans
e46e9b0
@misba7
Merge branch 'main' of https://github.com/JanssenProject/jans
3bf764c
@misba7
fix: add Hashicorp Vault external secret manager
5e19aba 
Signed-off-by: Amro Misbah <amromisba7@gmail.com>
@misba7 misba7 requested a review from moabu February 6, 2024 11:27
@misba7 misba7 self-assigned this Feb 6, 2024
@misba7 misba7 requested a review from iromli as a code owner February 6, 2024 11:27
@mo-auto mo-auto added area-documentation Documentation needs to change as part of issue or PR comp-charts-jans kind-bug Issue or PR is a bug in existing functionality labels Feb 6, 2024
iromli
iromli requested changes Feb 11, 2024
View reviewed changes
charts/janssen/charts/config/templates/configmaps.yaml Outdated
{{ if eq .Values.global.configSecretAdapter "vault" }}
CN_SECRET_VAULT_SCHEME: {{ .Values.configmap.cnSecretVaultScheme }}
CN_SECRET_VAULT_HOST: {{ .Values.configmap.cnSecretVaultHost }}
CN_SECRET_VAULT_PORT: {{ .Values.configmap.cnSecretVaultPort }}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These env vars should be quoted to avoid mismatched type.

@iromli iromli self-assigned this Feb 19, 2024
iromli and others added 6 commits February 20, 2024 00:24
@iromli
Merge branch 'main' into fix-jans-vault
5eed790
@misba7
fix: add quote to configmap
6cd0b93 
Signed-off-by: Amro Misbah <amromisba7@gmail.com>
@iromli
chore(docker-jans): update Vault binding in images
83c394d 
Signed-off-by: iromli <isman.firmansyah@gmail.com>
@misba7
fix: update vault envs
69f3c01 
Signed-off-by: Amro Misbah <amromisba7@gmail.com>
@misba7
fix: add new env vault addr
58b56b5 
Signed-off-by: Amro Misbah <amromisba7@gmail.com>
@misba7
feat: mount role and secret id files
b7305b8 
Signed-off-by: Amro Misbah <amromisba7@gmail.com>
iromli
iromli reviewed Feb 21, 2024
View reviewed changes
charts/janssen/values.yaml Outdated
@@ -258,6 +258,30 @@ config:
cnAwsSecretsReplicaRegions: []
# [aws_secret_manager_envs] END
# [aws_envs] END
# [vault_envs] Envs related to Hashicorp vault
# base URL of Vault (default to `http://localhost:8200`).
cnSecretVaultAddr: http://localhost:8200
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@misba7 as this is part of config.configmap, the cnSecretVault* keys need to be defined in sub-chart config as well.

@misba7
fix: add cnVault variables to config subchart
4d079ea 
Signed-off-by: Amro Misbah <amromisba7@gmail.com>
@misba7
docs: add new vars and instruction for required secret
73601e2 
Signed-off-by: Amro Misbah <amromisba7@gmail.com>
iromli
iromli requested changes Feb 22, 2024
View reviewed changes
docs/admin/kubernetes-ops/external-secrets-configmaps.md Outdated
configSecretAdapter: vault
config:
configmap:
# base URL of Vault (default to `http://localhost:8200`).
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@misba7 make a proper comment syntax so helm-docs command can generate/modify README.md automatically.

docs/admin/kubernetes-ops/external-secrets-configmaps.md Outdated
@@ -121,6 +122,52 @@ kubectl get configmap -n <namespace> cn -o json

From the console, Go to `Secret Manager`> Click on `Create Secret` > Add a `name` > Upload a `json` file or add the json to the `Secret value` field > Create

### Vault

You need a secret named `vault` in your namespace storing the `role-id` and `secret-id` so that workloads/services can use it to authenticate to Vault.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@misba7 Probably better to provide attribute in values.yaml to store role-id and secret-id in a secrets so it will be tied to release name.

@misba7
fix: change var name and base64 encode in secret
9c15d48 
Signed-off-by: Amro Misbah <amromisba7@gmail.com>
@misba7
Merge branch 'fix-jans-vault' of https://github.com/JanssenProject/jans…
7936df2 
… into fix-jans-vault
@misba7
fix: jans-aio vault support
8ca3b60 
Signed-off-by: Amro Misbah <amromisba7@gmail.com>
@misba7
fix: vault as an option for secret in jans-aio
c670500 
Signed-off-by: Amro Misbah <amromisba7@gmail.com>
@iromli iromli marked this pull request as ready for review February 26, 2024 21:01
iromli and others added 4 commits February 27, 2024 15:50
@iromli
Merge branch 'main' into fix-jans-vault
fcc8d54
@iromli
fix(chart): resolve attribute for Vault (global is not exist)
7169968 
Signed-off-by: iromli <isman.firmansyah@gmail.com>
@iromli
docs(charts): update Vault docs
8caaad6 
Signed-off-by: iromli <isman.firmansyah@gmail.com>
@iromli
docs: mention about approle path option
24dd02f 
Signed-off-by: iromli <isman.firmansyah@gmail.com>
iromli
iromli previously approved these changes Feb 27, 2024
View reviewed changes
@misba7
docs: update config subchart with new values.yaml
f376e4d 
Signed-off-by: Amro Misbah <amromisba7@gmail.com>
@misba7
docs: update instructions
99a476b 
Signed-off-by: Amro Misbah <amromisba7@gmail.com>
iromli
iromli previously approved these changes Feb 27, 2024
View reviewed changes
moabu
moabu requested changes Feb 28, 2024
View reviewed changes
docs/admin/kubernetes-ops/external-secrets-configmaps.md
@@ -121,6 +122,71 @@ kubectl get configmap -n <namespace> cn -o json

From the console, Go to `Secret Manager`> Click on `Create Secret` > Add a `name` > Upload a `json` file or add the json to the `Secret value` field > Create

### Vault
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Indicate the mode used for Vault installation. This is to clearly state what type of Vault installation was used because the cloud is slightly different

@misba7
docs: mention the vault deployment mode
7374d17 
Signed-off-by: Amro Misbah <amromisba7@gmail.com>
iromli
iromli requested changes Feb 28, 2024
View reviewed changes
docs/admin/kubernetes-ops/external-secrets-configmaps.md Outdated
### Vault

!!! Note
The deployment of Vault is hosted on-premises, not within the Vault Cloud service
Copy link
Contributor

@iromli iromli Feb 28, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The cloud name should be HashiCorp Cloud Platform.

misba7 and others added 2 commits February 28, 2024 20:28
@misba7
docs: remove unneeded vault vars
7f0a602 
Signed-off-by: Amro Misbah <amromisba7@gmail.com>
@iromli
docs: proper name of HashiCorp cloud service
55159dd 
Signed-off-by: iromli <isman.firmansyah@gmail.com>
@moabu moabu merged commit 595e705 into main Feb 29, 2024
2 checks passed
@moabu moabu deleted the fix-jans-vault branch February 29, 2024 15:10
yuriyz pushed a commit that referenced this pull request Nov 7, 2024
@misba7 @iromli @moabu
fix: add Hashicorp Vault external secret manager (#7658)
3a717be 
* docs: add network traffic notes

* docs: add network traffic notes

Signed-off-by: Amro Misbah <amromisba7@gmail.com>

* docs: add external communication

Signed-off-by: Amro Misbah <amromisba7@gmail.com>

* fix: add Hashicorp Vault external secret manager

Signed-off-by: Amro Misbah <amromisba7@gmail.com>

* fix: add quote to configmap

Signed-off-by: Amro Misbah <amromisba7@gmail.com>

* chore(docker-jans): update Vault binding in images

Signed-off-by: iromli <isman.firmansyah@gmail.com>

* fix: update vault envs

Signed-off-by: Amro Misbah <amromisba7@gmail.com>

* fix: add new env vault addr

Signed-off-by: Amro Misbah <amromisba7@gmail.com>

* feat: mount role and secret id files

Signed-off-by: Amro Misbah <amromisba7@gmail.com>

* fix: add cnVault variables to config subchart

Signed-off-by: Amro Misbah <amromisba7@gmail.com>

* docs: add new vars and instruction for required secret

Signed-off-by: Amro Misbah <amromisba7@gmail.com>

* feat: deploy vault secret automatically

Signed-off-by: Amro Misbah <amromisba7@gmail.com>

* docs: comprehensive vault deployment instructions

Signed-off-by: Amro Misbah <amromisba7@gmail.com>

* fix: change var name and base64 encode in secret

Signed-off-by: Amro Misbah <amromisba7@gmail.com>

* fix: jans-aio vault support

Signed-off-by: Amro Misbah <amromisba7@gmail.com>

* fix: vault as an option for secret in jans-aio

Signed-off-by: Amro Misbah <amromisba7@gmail.com>

* fix(chart): resolve attribute for Vault (global is not exist)

Signed-off-by: iromli <isman.firmansyah@gmail.com>

* docs(charts): update Vault docs

Signed-off-by: iromli <isman.firmansyah@gmail.com>

* docs: mention about approle path option

Signed-off-by: iromli <isman.firmansyah@gmail.com>

* docs: update config subchart with new values.yaml

Signed-off-by: Amro Misbah <amromisba7@gmail.com>

* docs: update instructions

Signed-off-by: Amro Misbah <amromisba7@gmail.com>

* chore(charts): remove unused attributes for Vault integration

Signed-off-by: iromli <isman.firmansyah@gmail.com>

* docs: mention the vault deployment mode

Signed-off-by: Amro Misbah <amromisba7@gmail.com>

* docs: remove unneeded vault vars

Signed-off-by: Amro Misbah <amromisba7@gmail.com>

* docs: proper name of HashiCorp cloud service

Signed-off-by: iromli <isman.firmansyah@gmail.com>

---------

Signed-off-by: Amro Misbah <amromisba7@gmail.com>
Signed-off-by: iromli <isman.firmansyah@gmail.com>
Co-authored-by: Isman Firmansyah <iromli@users.noreply.github.com>
Co-authored-by: iromli <isman.firmansyah@gmail.com>
Co-authored-by: Mohammad Abudayyeh <47318409+moabu@users.noreply.github.com>
Former-commit-id: 595e705
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@iromli iromli iromli approved these changes

@moabu moabu moabu approved these changes

Assignees

@iromli iromli

@misba7 misba7

Labels
area-documentation Documentation needs to change as part of issue or PR comp-charts-jans kind-bug Issue or PR is a bug in existing functionality
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

fix: add Hashicorps Vault external secret manager
4 participants
@misba7 @iromli @moabu @mo-auto