72 lines
1.9 KiB
Markdown
72 lines
1.9 KiB
Markdown
|
# Vault Bootstrap
|
||
|
|
|
||
|
|
## 1. Deploy
|
||
|
|
|
||
|
|
```bash
|
||
|
|
helm repo add hashicorp https://helm.releases.hashicorp.com
|
||
|
|
helm upgrade --install vault hashicorp/vault \
|
||
|
|
--namespace vault \
|
||
|
|
--create-namespace \
|
||
|
|
-f vendor/platform/vault/values.yaml
|
||
|
|
|
||
|
|
kubectl -n vault apply -f vendor/platform/vault/network-policies.yaml
|
||
|
|
kubectl -n vault wait --for=condition=Ready pod/vault-0 --timeout=120s
|
||
|
|
```
|
||
|
|
|
||
|
|
## 2. Initialize
|
||
|
|
|
||
|
|
```bash
|
||
|
|
kubectl -n vault exec vault-0 -- vault operator init \
|
||
|
|
-key-shares=5 \
|
||
|
|
-key-threshold=3 \
|
||
|
|
-format=json > ./vendor/platform/vault/.secrets/vault-init.json
|
||
|
|
```
|
||
|
|
|
||
|
|
## 3. Unseal
|
||
|
|
|
||
|
|
```bash
|
||
|
|
for pod in vault-0 vault-1 vault-2; do
|
||
|
|
jq -r '.unseal_keys_b64[:3][]' ./vendor/platform/vault/.secrets/vault-init.json | xargs -I{} \
|
||
|
|
kubectl -n vault exec "$pod" -- vault operator unseal {}
|
||
|
|
done
|
||
|
|
```
|
||
|
|
|
||
|
|
This same procedure is required after every cluster restart.
|
||
|
|
|
||
|
|
## 4. Terraform (PKI + auth methods + policies)
|
||
|
|
|
||
|
|
```bash
|
||
|
|
kubectl -n vault port-forward svc/vault 8200:8200
|
||
|
|
|
||
|
|
export VAULT_ADDR=http://127.0.0.1:8200
|
||
|
|
export VAULT_TOKEN=$(jq -r '.root_token' ./vendor/platform/vault/.secrets/vault-init.json)
|
||
|
|
export DOMAIN_NAME='some domain name'
|
||
|
|
export ADMIN_USER='some admin user'
|
||
|
|
|
||
|
|
cd terraform/internal/vault
|
||
|
|
../../scripts/tofu-versitygw-state init
|
||
|
|
../../scripts/tofu-versitygw-state apply \
|
||
|
|
-var="internal_domain=${DOMAIN_NAME}" \
|
||
|
|
-var="users=[\"${ADMIN_USER}\"]" \
|
||
|
|
-var="admin_user=${ADMIN_USER}"
|
||
|
|
|
||
|
|
../../scripts/tofu-versitygw-state output -json user_passwords
|
||
|
|
```
|
||
|
|
|
||
|
|
Required existing secret: `secret/cloudflare/api-token` key `api-token`.
|
||
|
|
|
||
|
|
## 5. Revoke root token
|
||
|
|
|
||
|
|
```bash
|
||
|
|
vault login -method=userpass username=${ADMIN_USER}
|
||
|
|
vault token revoke $(jq -r '.root_token' ./vendor/platform/vault/.secrets/vault-init.json)
|
||
|
|
```
|
||
|
|
|
||
|
|
## 6. Set up Vault Secrets Operator
|
||
|
|
|
||
|
|
```bash
|
||
|
|
helm upgrade --install -n vault \
|
||
|
|
vault-secrets-operator \
|
||
|
|
hashicorp/vault-secrets-operator \
|
||
|
|
-f vendor/platform/vault/vso-values.yaml
|
||
|
|
```
|