Skip to content

Commit e1988ba

Browse files
LukasCuperDTLukasCuperDT
committed
Add Vault Helm charts for otcinfra2 production deployment
- upstream/vault: Chart.yaml, VAULT_KUBECTL_COMMANDS.md, values-otcinfra2.yaml - local/vault: NetworkPolicy (improved allowedConsumers design), unsealer RBAC, helpers template, values-otcinfra2.yaml - All files identical to preprod except values files and networkpolicy template (improved: unified allowedConsumers, removed broad label selector, removed allowExternalIPs)
1 parent 5dc00f3 commit e1988ba

9 files changed

Lines changed: 813 additions & 0 deletions

File tree

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,3 +20,4 @@ test_inventory
2020
doc/source/_svg
2121
data/backups
2222
.vscode/
23+
.pre-commit-config.yaml

‎kubernetes/helm_charts/local/vault/Chart.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: v2
2+
name: vault-additional-manifests
3+
description: A custom Helm chart with additional Vault manifests (NetworkPolicy, etc.)
4+
type: application
5+
version: 1.0.0
6+
appVersion: "1.0.0"

‎kubernetes/helm_charts/local/vault/templates/_helpers.tpl‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "vault-additional.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create chart name and version as used by the chart label.
10+
*/}}
11+
{{- define "vault-additional.chart" -}}
12+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
13+
{{- end }}
14+
15+
{{/*
16+
Common labels
17+
*/}}
18+
{{- define "vault-additional.labels" -}}
19+
helm.sh/chart: {{ include "vault-additional.chart" . }}
20+
app.kubernetes.io/managed-by: {{ .Release.Service }}
21+
{{- end }}

‎kubernetes/helm_charts/local/vault/templates/networkpolicy.yaml‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
{{- if .Values.networkPolicy.enabled }}
2+
apiVersion: networking.k8s.io/v1
3+
kind: NetworkPolicy
4+
metadata:
5+
name: vault-network-policy
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
{{- include "vault-additional.labels" . | nindent 4 }}
9+
spec:
10+
podSelector:
11+
{{- with .Values.networkPolicy.podSelector }}
12+
{{- toYaml . | nindent 4 }}
13+
{{- end }}
14+
policyTypes:
15+
- Ingress
16+
- Egress
17+
ingress:
18+
# Allow Vault-to-Vault communication (raft/cluster)
19+
- from:
20+
- podSelector:
21+
{{- with .Values.networkPolicy.podSelector }}
22+
{{- toYaml . | nindent 12 }}
23+
{{- end }}
24+
ports:
25+
- port: {{ .Values.networkPolicy.vaultPort }}
26+
protocol: TCP
27+
- port: {{ .Values.networkPolicy.clusterPort }}
28+
protocol: TCP
29+
# Allow from explicitly listed namespaces (with optional pod selector)
30+
{{- range .Values.networkPolicy.allowedConsumers }}
31+
- from:
32+
- namespaceSelector:
33+
matchLabels:
34+
kubernetes.io/metadata.name: {{ .namespace }}
35+
{{- if .podSelector }}
36+
podSelector:
37+
matchLabels:
38+
{{- toYaml .podSelector | nindent 14 }}
39+
{{- end }}
40+
ports:
41+
- port: {{ $.Values.networkPolicy.vaultPort }}
42+
protocol: TCP
43+
{{- end }}
44+
{{- if .Values.networkPolicy.allowIngress.enabled }}
45+
# Allow ingress controller (for remote cluster vault-agent access via LB)
46+
- from:
47+
- namespaceSelector:
48+
matchLabels:
49+
kubernetes.io/metadata.name: {{ .Values.networkPolicy.allowIngress.namespace }}
50+
podSelector:
51+
matchLabels:
52+
{{- toYaml .Values.networkPolicy.allowIngress.podSelector | nindent 14 }}
53+
ports:
54+
- port: {{ .Values.networkPolicy.vaultPort }}
55+
protocol: TCP
56+
{{- end }}
57+
egress:
58+
# Vault to Vault (raft replication)
59+
- to:
60+
- podSelector:
61+
{{- with .Values.networkPolicy.podSelector }}
62+
{{- toYaml . | nindent 12 }}
63+
{{- end }}
64+
ports:
65+
- port: {{ .Values.networkPolicy.vaultPort }}
66+
protocol: TCP
67+
- port: {{ .Values.networkPolicy.clusterPort }}
68+
protocol: TCP
69+
# DNS resolution
70+
- to:
71+
- namespaceSelector: {}
72+
podSelector:
73+
matchLabels:
74+
k8s-app: coredns
75+
ports:
76+
- port: 53
77+
protocol: UDP
78+
- port: 53
79+
protocol: TCP
80+
# Allow egress to Kubernetes API (for K8s auth)
81+
- to:
82+
- ipBlock:
83+
cidr: 0.0.0.0/0
84+
ports:
85+
- port: 443
86+
protocol: TCP
87+
- port: 6443
88+
protocol: TCP
89+
{{- end }}

‎kubernetes/helm_charts/local/vault/templates/unsealer-rbac.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{{- if .Values.unsealer.enabled }}
2+
---
3+
apiVersion: rbac.authorization.k8s.io/v1
4+
kind: Role
5+
metadata:
6+
name: {{ .Release.Name }}-unsealer-role
7+
namespace: {{ .Release.Namespace }}
8+
labels:
9+
{{- include "vault-additional.labels" . | nindent 4 }}
10+
rules:
11+
- apiGroups: [""]
12+
resources: ["secrets"]
13+
resourceNames: ["{{ .Values.unsealer.secretName }}"]
14+
verbs: ["get"]
15+
---
16+
apiVersion: rbac.authorization.k8s.io/v1
17+
kind: RoleBinding
18+
metadata:
19+
name: {{ .Release.Name }}-unsealer-rolebinding
20+
namespace: {{ .Release.Namespace }}
21+
labels:
22+
{{- include "vault-additional.labels" . | nindent 4 }}
23+
roleRef:
24+
apiGroup: rbac.authorization.k8s.io
25+
kind: Role
26+
name: {{ .Release.Name }}-unsealer-role
27+
subjects:
28+
- kind: ServiceAccount
29+
name: {{ .Values.unsealer.serviceAccountName }}
30+
namespace: {{ .Release.Namespace }}
31+
{{- end }}

‎kubernetes/helm_charts/local/vault/values-prod.yaml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
# Vault additional manifests configuration for otcinfra2 (production)
2+
# This chart provides supplementary resources not available in upstream Vault Helm chart
3+
#
4+
# NetworkPolicy: deny-all by default, only explicitly listed consumers can reach Vault.
5+
# Remote clusters (otcinfra1, otcci) access Vault via ingress-nginx.
6+
7+
networkPolicy:
8+
enabled: true
9+
10+
# Pod selector for Vault pods
11+
podSelector:
12+
matchLabels:
13+
app.kubernetes.io/name: vault
14+
15+
# Explicit list of namespaces/pods allowed to connect to Vault on port 8200.
16+
# Each entry creates a separate ingress rule. All unlisted namespaces are denied.
17+
allowedConsumers:
18+
# ArgoCD repo-server — runs argocd-vault-plugin for secret injection
19+
- namespace: argocd
20+
podSelector:
21+
app.kubernetes.io/name: argocd-repo-server
22+
23+
# Backstage — vault-agent sidecar (auth/kubernetes_otcinfra2)
24+
- namespace: backstage
25+
26+
# Circle Partner Navigator — vault-agent sidecar (auth/kubernetes_otcinfra2)
27+
- namespace: circle-partner-navigator
28+
29+
# Dependency Track — vault-agent sidecar for postgres secrets (auth/kubernetes_otcinfra2)
30+
- namespace: dependencytrack
31+
32+
# Eyes on Docs — vault-agent sidecar (auth/kubernetes_otcinfra2)
33+
- namespace: eyes-on-docs
34+
35+
# mCaptcha — vault-agent sidecar (auth/kubernetes_otcinfra2)
36+
- namespace: mcaptcha
37+
38+
# Prometheus — scrape Vault /v1/sys/metrics
39+
- namespace: monitoring
40+
podSelector:
41+
app.kubernetes.io/name: prometheus
42+
43+
# Ingress controller — required for remote clusters to reach Vault via LB
44+
# Remote consumers:
45+
# otcinfra1: anubis, docsportal, swift-proxy, umami (auth/kubernetes_otcinfra1)
46+
# otcci: zuul (auth/kubernetes_otcci)
47+
allowIngress:
48+
enabled: true
49+
namespace: default
50+
podSelector:
51+
app.kubernetes.io/name: ingress-nginx
52+
53+
# Vault API port
54+
vaultPort: 8200
55+
56+
# Vault cluster port (for raft replication)
57+
clusterPort: 8201
58+
59+
# Auto-unseal configuration
60+
# The unsealer sidecar watches for sealed state and auto-unseals using K8s secret
61+
#
62+
# Required secret format (vault-unseal-keys in vault namespace):
63+
# Create the secret with unseal keys from 'vault operator init':
64+
#
65+
# kubectl -n vault create secret generic vault-unseal-keys \
66+
# --from-literal=vault-root=<root-token> \
67+
# --from-literal=vault-unseal-0=<key1> \
68+
# --from-literal=vault-unseal-1=<key2> \
69+
# --from-literal=vault-unseal-2=<key3> \
70+
# --from-literal=vault-unseal-3=<key4> \
71+
# --from-literal=vault-unseal-4=<key5>
72+
#
73+
# See: https://bank-vaults.dev/docs/unseal-keys/
74+
75+
# Unsealer RBAC - grants access to the vault-unseal-keys secret
76+
unsealer:
77+
enabled: true
78+
secretName: vault-unseal-keys
79+
# The upstream vault chart creates ServiceAccount named after the release
80+
serviceAccountName: vault

‎kubernetes/helm_charts/upstream/vault/Chart.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: v2
2+
name: vault
3+
description: HashiCorp Vault for OTC preprod environment
4+
version: 0.1.0
5+
dependencies:
6+
- name: vault
7+
version: "0.30.0"
8+
repository: "https://helm.releases.hashicorp.com"

0 commit comments

Comments
 (0)