ce7cb702218693d08ea6d83464d2457c9250027c

services/ca-sync/k8s/job.yaml

@@ -0,0 +1,88 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: ca-sync
+  namespace: vault
+spec:
+  schedule: "*/15 * * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 1
+  jobTemplate:
+    spec:
+      backoffLimit: 0
+      activeDeadlineSeconds: 120
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/name: ca-sync
+            app.kubernetes.io/instance: ca-sync
+        spec:
+          restartPolicy: Never
+          serviceAccountName: ca-sync
+          imagePullSecrets:
+            - name: ca-sync-pull
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 65532
+            runAsGroup: 65532
+            seccompProfile:
+              type: RuntimeDefault
+          containers:
+            - name: sync
+              image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+              command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
+              args:
+                - /source/run.fsx
+                - pki=ca/internal
+                - pki_postgres=ca/postgres
+                - pki_opnsense=ca/opnsense
+              env:
+                - name: VAULT_ADDR
+                  value: https://vault.vault.svc.cluster.local:8200
+                - name: VAULT_ROLE
+                  value: ca-sync
+                - name: VAULT_MOUNT
+                  value: secret
+                - name: JWT_PATH
+                  value: /var/run/secrets/kubernetes.io/serviceaccount/token
+                - name: HOME
+                  value: /tmp
+                - name: SSL_CERT_FILE
+                  value: /ca/ca.crt
+                - name: DOTNET_NOLOGO
+                  value: "true"
+                - name: DOTNET_CLI_TELEMETRY_OPTOUT
+                  value: "1"
+              resources:
+                requests:
+                  cpu: 50m
+                  memory: 128Mi
+                limits:
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                capabilities:
+                  drop: [ALL]
+              volumeMounts:
+                - name: source
+                  mountPath: /source
+                  readOnly: true
+                - name: ca
+                  mountPath: /ca
+                  readOnly: true
+                - name: tmp
+                  mountPath: /tmp
+          volumes:
+            - name: source
+              configMap:
+                name: ca-sync
+            - name: ca
+              secret:
+                secretName: ca-sync-root
+                items:
+                  - key: ca.crt
+                    path: ca.crt
+            - name: tmp
+              emptyDir: {}

services/ca-sync/k8s/policy.yaml

@@ -0,0 +1,50 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: ca-sync
+  namespace: vault
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: ca-sync
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchName: vault.vault.svc.cluster.local
+    - toEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: vault
+            component: server
+      toPorts:
+        - ports:
+            - port: "8200"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: ca-sync-vault
+  namespace: vault
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: vault
+      component: server
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: ca-sync
+      toPorts:
+        - ports:
+            - port: "8200"
+              protocol: TCP

services/ca-sync/k8s/vault.yaml

@@ -0,0 +1,69 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ca-sync
+  namespace: vault
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ca-sync-vso
+  namespace: vault
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: ca-sync
+  namespace: vault
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: ca-sync-pull
+    serviceAccount: ca-sync-vso
+  vaultConnectionRef: vault/vault
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: ca-sync-pull
+  namespace: vault
+spec:
+  type: kv-v2
+  mount: secret
+  path: quay/robots/cluster_pull
+  refreshAfter: 1h
+  vaultAuthRef: ca-sync
+  destination:
+    name: ca-sync-pull
+    create: true
+    overwrite: true
+    type: kubernetes.io/dockerconfigjson
+    transformation:
+      excludeRaw: true
+      excludes: [.*]
+      templates:
+        .dockerconfigjson:
+          text: '{"auths":{"registry.quorate.internal":{"auth":"{{ printf "%s:%s" (get .Secrets "username") (get .Secrets "token") | b64enc }}"}}}'
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultDynamicSecret
+metadata:
+  name: ca-sync-root
+  namespace: vault
+spec:
+  vaultAuthRef: ca-sync
+  mount: pki
+  path: cert/ca
+  requestHTTPMethod: GET
+  refreshAfter: 1h
+  destination:
+    create: true
+    overwrite: true
+    name: ca-sync-root
+    transformation:
+      excludeRaw: true
+      excludes: [.*]
+      templates:
+        ca.crt:
+          text: '{{ get .Secrets "certificate" }}'