Commit ce248687 authored by Labros Papadopoulos's avatar Labros Papadopoulos Committed by Nikos Psaromanolakis
Browse files

feat: Peering vault sidecar

parent 5e36cbe1

charts/hypo/templates/config/vault-agent-peering-api-cm.yaml

0 → 100644
+30 −0
Original line number Diff line number Diff line 
{{ $vaultServer := index .Values "vault-server" }}

{{ $peeringApi := index .Values "peering-api" }}

{{- if and $peeringApi.enabled $vaultServer.enabled -}}

apiVersion: v1

kind: ConfigMap

metadata:

  name: vault-agent-peering-api-config

  namespace: {{ .Release.Namespace }}

data:

  agent-config.hcl: |

    vault {

      address = "http://{{ template "hypo.vault-server.url" . }}:{{ $vaultServer.service.port }}"

    }



    auto_auth {

      method "kubernetes" {

        mount_path = "auth/kubernetes"

        config = {

          role = "peering-api"

        }

      }



      sink "file" {

        config = {

          path = "/vault/secrets/token"

          mode = 0644

        }

      }

    }

  {{- end -}}

charts/hypo/templates/peering-api/deployment.yaml

+28 −4
Original line number Diff line number Diff line 
{{ $peeringApi := index .Values "peering-api" }}

{{ $vaultServer := index .Values "vault-server" }}

{{ $postgresqlDb := index .Values "postgresql-db" }}

{{- if $peeringApi.enabled -}}

{{ $registryApi := index .Values "registry-api" }}

apiVersion: apps/v1

kind: Deployment

metadata:
@@ -28,6 +30,7 @@ spec: 
        {{- toYaml . | nindent 8 }}

        {{- end }}

    spec:

      serviceAccountName: peering-api

      initContainers:

        - name: wait-for-postgres

          image: busybox:latest
@@ -85,14 +88,35 @@ spec: 
              value: {{ $postgresqlDb.auth.password }}

            - name: _PROD_QUARKUS_OTEL_EXPORTER_OTLP_TRACES_ENDPOINT

              value: http://{{ template "hypo.otel.url" . }}:{{ include "hypo.otel.port" . }}

            - name: PEERING_VAULT_TOKEN_PATH

              value: {{ $peeringApi.env.PEERING_VAULT_TOKEN_PATH }}

            - name: _PROD_QUARKUS_REST_CLIENT_REGISTRY_API_URL

              value: http://{{ template "hypo.registry-api.url" . }}:{{ $registryApi.service.port }}

          resources:

            {{- toYaml $peeringApi.resources | nindent 12 }}

          {{- with $peeringApi.volumeMounts }}

          volumeMounts:

            - name: vault-secrets

              mountPath: /vault/secrets

        {{- with $peeringApi.volumeMounts }}

            {{- toYaml . | nindent 12 }}

          {{- end }}

      {{- with $peeringApi.volumes }}

        - name: vault-agent

          image: "{{ $vaultServer.image.repository }}:{{ $vaultServer.image.tag }}"

          imagePullPolicy: {{ $vaultServer.image.pullPolicy }}

          args: [ "agent", "-config=/vault/config/agent-config.hcl" ]

          volumeMounts:

            - name: vault-agent-peering-api-config

              mountPath: /vault/config

            - name: vault-secrets

              mountPath: /vault/secrets

      volumes:

        - name: vault-secrets

          emptyDir:

            medium: Memory

        - name: vault-agent-peering-api-config

          configMap:

            name: vault-agent-peering-api-config

    {{- with $peeringApi.volumes }}

        {{- toYaml . | nindent 8 }}

      {{- end }}

{{- end -}}

charts/hypo/templates/peering-api/sa.yaml

0 → 100644
+8 −0
Original line number Diff line number Diff line 
{{ $peeringApi := index .Values "peering-api" }}

{{- if $peeringApi.enabled -}}

apiVersion: v1

kind: ServiceAccount

metadata:

  name: peering-api

  namespace: {{ .Release.Namespace }}

  {{- end -}}

charts/hypo/templates/vault/job.yaml

+18 −2
Original line number Diff line number Diff line
@@ -128,6 +128,22 @@ spec: 
                policies="hypo-fabric-policy" \

                ttl=1h



              cat > hypo-peering-policy.hcl <<EOF

              path "secret/data/hypo/tmf-organization/*" {

               capabilities = ["read","list"]

              }

              path "secret/metadata/hypo/tmf-organization/*" {

               capabilities = ["read","list"]

              }

              EOF

              vault policy write hypo-peering-policy hypo-peering-policy.hcl

              

              vault write auth/kubernetes/role/peering-api \

                bound_service_account_names=peering-api \

                bound_service_account_namespaces={{ .Release.Namespace }} \

                policies="hypo-peering-policy" \

                ttl=1h



              vault write -tls-skip-verify auth/jwt/role/default - <<EOF

              {

                "allowed_redirect_uris" : "http://$NODE_IP:{{ $vaultServer.service.nodePort }}/ui/vault/auth/oidc/oidc/callback",

charts/hypo/values.yaml

+15 −14
Original line number Diff line number Diff line
@@ -378,7 +378,8 @@ peering-api: 
      labs.etsi.org:5050/osl/hypo/code/org.etsi.osl.hypo.api/peering/peering-api-jvm

    pullPolicy: Always

    tag: "1.1.0"



  env:

    PEERING_VAULT_TOKEN_PATH: "/vault/secrets/token"

  imagePullSecrets:

  - name: regcred

  nameOverride: ""