quorate/vendor/platform/vault/bootstrap.md

Vault Bootstrap

1. Deploy

helm repo add hashicorp https://helm.releases.hashicorp.com
helm upgrade --install vault hashicorp/vault \
  --namespace vault \
  --create-namespace \
  -f vendor/platform/vault/values.yaml

kubectl -n vault apply -f vendor/platform/vault/network-policies.yaml
kubectl -n vault wait --for=condition=Ready pod/vault-0 --timeout=120s

2. Initialize

kubectl -n vault exec vault-0 -- vault operator init \
  -key-shares=5 \
  -key-threshold=3 \
  -format=json > ./vendor/platform/vault/.secrets/vault-init.json

3. Unseal

for pod in vault-0 vault-1 vault-2; do
  jq -r '.unseal_keys_b64[:3][]' ./vendor/platform/vault/.secrets/vault-init.json | xargs -I{} \
    kubectl -n vault exec "$pod" -- vault operator unseal {}
done

This same procedure is required after every cluster restart.

4. Terraform (PKI + auth methods + policies)

kubectl -n vault port-forward svc/vault 8200:8200

export VAULT_ADDR=http://127.0.0.1:8200
export VAULT_TOKEN=$(jq -r '.root_token' ./vendor/platform/vault/.secrets/vault-init.json)
export DOMAIN_NAME='some domain name'
export ADMIN_USER='some admin user'

cd terraform/internal/vault
../../scripts/tofu-versitygw-state init
../../scripts/tofu-versitygw-state apply \
  -var="internal_domain=${DOMAIN_NAME}" \
  -var="users=[\"${ADMIN_USER}\"]" \
  -var="admin_user=${ADMIN_USER}"

../../scripts/tofu-versitygw-state output -json user_passwords

Required existing secret: secret/cloudflare/api-token key api-token.

5. Revoke root token

vault login -method=userpass username=${ADMIN_USER}
vault token revoke $(jq -r '.root_token' ./vendor/platform/vault/.secrets/vault-init.json)

6. Set up Vault Secrets Operator

helm upgrade --install -n vault \
    vault-secrets-operator \
    hashicorp/vault-secrets-operator \
    -f vendor/platform/vault/vso-values.yaml