diff --git a/charts/hypo/templates/config/vault-agent-peering-api-cm.yaml b/charts/hypo/templates/config/vault-agent-peering-api-cm.yaml new file mode 100644 index 0000000000000000000000000000000000000000..48d013e14343e6ed9bd8264a861a12770644d4d9 --- /dev/null +++ b/charts/hypo/templates/config/vault-agent-peering-api-cm.yaml @@ -0,0 +1,30 @@ +{{ $vaultServer := index .Values "vault-server" }} +{{ $peeringApi := index .Values "peering-api" }} +{{- if and $peeringApi.enabled $vaultServer.enabled -}} +apiVersion: v1 +kind: ConfigMap +metadata: + name: vault-agent-peering-api-config + namespace: {{ .Release.Namespace }} +data: + agent-config.hcl: | + vault { + address = "http://{{ template "hypo.vault-server.url" . }}:{{ $vaultServer.service.port }}" + } + + auto_auth { + method "kubernetes" { + mount_path = "auth/kubernetes" + config = { + role = "peering-api" + } + } + + sink "file" { + config = { + path = "/vault/secrets/token" + mode = 0644 + } + } + } + {{- end -}} diff --git a/charts/hypo/templates/peering-api/deployment.yaml b/charts/hypo/templates/peering-api/deployment.yaml index a24e6edab8ca092e17198cbd3587adea34907f91..73f6052adc8c7d8c0ae2699e32b38fd00cb4d114 100644 --- a/charts/hypo/templates/peering-api/deployment.yaml +++ b/charts/hypo/templates/peering-api/deployment.yaml @@ -1,6 +1,8 @@ {{ $peeringApi := index .Values "peering-api" }} +{{ $vaultServer := index .Values "vault-server" }} {{ $postgresqlDb := index .Values "postgresql-db" }} {{- if $peeringApi.enabled -}} +{{ $registryApi := index .Values "registry-api" }} apiVersion: apps/v1 kind: Deployment metadata: @@ -28,6 +30,7 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} spec: + serviceAccountName: peering-api initContainers: - name: wait-for-postgres image: busybox:latest @@ -79,20 +82,41 @@ spec: value: {{ template "hypo.kafka.url" . }}:{{ .Values.kafka.service.ports.client }} - name: _PROD_QUARKUS_DATASOURCE_JDBC_URL value: jdbc:postgresql://{{ template "hypo.postgresql.url" . }}:{{ include "hypo.postgresql.port" . }}/PEERING_DB - - name: _PROD_QUARKUS_DATASOURCE_USERNAME + - name: _PROD_QUARKUS_DATASOURCE_USERNAME value: {{ $postgresqlDb.auth.username }} - - name: _PROD_QUARKUS_DATASOURCE_PASSWORD + - name: _PROD_QUARKUS_DATASOURCE_PASSWORD value: {{ $postgresqlDb.auth.password }} - name: _PROD_QUARKUS_OTEL_EXPORTER_OTLP_TRACES_ENDPOINT value: http://{{ template "hypo.otel.url" . }}:{{ include "hypo.otel.port" . }} + - name: PEERING_VAULT_TOKEN_PATH + value: {{ $peeringApi.env.PEERING_VAULT_TOKEN_PATH }} + - name: _PROD_QUARKUS_REST_CLIENT_REGISTRY_API_URL + value: http://{{ template "hypo.registry-api.url" . }}:{{ $registryApi.service.port }} resources: {{- toYaml $peeringApi.resources | nindent 12 }} - {{- with $peeringApi.volumeMounts }} volumeMounts: + - name: vault-secrets + mountPath: /vault/secrets + {{- with $peeringApi.volumeMounts }} {{- toYaml . | nindent 12 }} {{- end }} - {{- with $peeringApi.volumes }} + - name: vault-agent + image: "{{ $vaultServer.image.repository }}:{{ $vaultServer.image.tag }}" + imagePullPolicy: {{ $vaultServer.image.pullPolicy }} + args: [ "agent", "-config=/vault/config/agent-config.hcl" ] + volumeMounts: + - name: vault-agent-peering-api-config + mountPath: /vault/config + - name: vault-secrets + mountPath: /vault/secrets volumes: + - name: vault-secrets + emptyDir: + medium: Memory + - name: vault-agent-peering-api-config + configMap: + name: vault-agent-peering-api-config + {{- with $peeringApi.volumes }} {{- toYaml . | nindent 8 }} {{- end }} {{- end -}} diff --git a/charts/hypo/templates/peering-api/sa.yaml b/charts/hypo/templates/peering-api/sa.yaml new file mode 100644 index 0000000000000000000000000000000000000000..952d63b1e72df191b896068f383fe04c9215b0fe --- /dev/null +++ b/charts/hypo/templates/peering-api/sa.yaml @@ -0,0 +1,8 @@ +{{ $peeringApi := index .Values "peering-api" }} +{{- if $peeringApi.enabled -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: peering-api + namespace: {{ .Release.Namespace }} + {{- end -}} diff --git a/charts/hypo/templates/vault/job.yaml b/charts/hypo/templates/vault/job.yaml index 09943d529495c42bdb6c88e6f54aa2e60fee3821..6bdb1bffdef86d3ad42935535a4bb44a219defee 100644 --- a/charts/hypo/templates/vault/job.yaml +++ b/charts/hypo/templates/vault/job.yaml @@ -25,7 +25,7 @@ spec: fieldRef: fieldPath: status.hostIP args: [ 'sh', '-c', 'until nc -z -w 1 $NODE_IP {{ .Values.keycloak.service.nodePorts.http }}; do echo "Sleeping for Keycloak"; sleep 1; done; echo "ready!";' ] - {{- end }} + {{- end }} containers: - name: vault-unseal image: "{{ $vaultServer.image.repository }}:{{ $vaultServer.image.tag }}" @@ -128,6 +128,22 @@ spec: policies="hypo-fabric-policy" \ ttl=1h + cat > hypo-peering-policy.hcl <