ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/vault/bootstrap.md

@@ -0,0 +1,72 @@
+# Vault Bootstrap
+
+## 1. Deploy
+
+```bash
+helm repo add hashicorp https://helm.releases.hashicorp.com
+helm upgrade --install vault hashicorp/vault \
+  --namespace vault \
+  --create-namespace \
+  -f vendor/platform/vault/values.yaml
+
+kubectl -n vault apply -f vendor/platform/vault/network-policies.yaml
+kubectl -n vault wait --for=condition=Ready pod/vault-0 --timeout=120s
+```
+
+## 2. Initialize
+
+```bash
+kubectl -n vault exec vault-0 -- vault operator init \
+  -key-shares=5 \
+  -key-threshold=3 \
+  -format=json > ./vendor/platform/vault/.secrets/vault-init.json
+```
+
+## 3. Unseal
+
+```bash
+for pod in vault-0 vault-1 vault-2; do
+  jq -r '.unseal_keys_b64[:3][]' ./vendor/platform/vault/.secrets/vault-init.json | xargs -I{} \
+    kubectl -n vault exec "$pod" -- vault operator unseal {}
+done
+```
+
+This same procedure is required after every cluster restart.
+
+## 4. Terraform (PKI + auth methods + policies)
+
+```bash
+kubectl -n vault port-forward svc/vault 8200:8200
+
+export VAULT_ADDR=http://127.0.0.1:8200
+export VAULT_TOKEN=$(jq -r '.root_token' ./vendor/platform/vault/.secrets/vault-init.json)
+export DOMAIN_NAME='some domain name'
+export ADMIN_USER='some admin user'
+
+cd terraform/internal/vault
+../../scripts/tofu-versitygw-state init
+../../scripts/tofu-versitygw-state apply \
+  -var="internal_domain=${DOMAIN_NAME}" \
+  -var="users=[\"${ADMIN_USER}\"]" \
+  -var="admin_user=${ADMIN_USER}"
+
+../../scripts/tofu-versitygw-state output -json user_passwords
+```
+
+Required existing secret: `secret/cloudflare/api-token` key `api-token`.
+
+## 5. Revoke root token
+
+```bash
+vault login -method=userpass username=${ADMIN_USER}
+vault token revoke $(jq -r '.root_token' ./vendor/platform/vault/.secrets/vault-init.json)
+```
+
+## 6. Set up Vault Secrets Operator
+
+```bash
+helm upgrade --install -n vault \
+    vault-secrets-operator \
+    hashicorp/vault-secrets-operator \
+    -f vendor/platform/vault/vso-values.yaml
+```