Will Anderson
a7a1b6a778
New GCP instance needs dynamic PVC provisioning for registry. Vault now accessible via neuralplatform.ai tunnel.
70 lines
2.8 KiB
YAML
70 lines
2.8 KiB
YAML
---
|
|
# ClusterSecretStore — connects ESO to Vault
|
|
#
|
|
# CURRENT STATE: token auth (root token). This works but the root token
|
|
# has no expiry and full Vault access — it's a single credential that
|
|
# compromises everything if leaked.
|
|
#
|
|
# MIGRATION TO APPROLE (do this before GCP migration):
|
|
# ─────────────────────────────────────────────────────
|
|
# 1. Enable AppRole on Vault (if not already):
|
|
# vault auth enable approle
|
|
#
|
|
# 2. Create a policy scoped to only the paths ESO reads:
|
|
# vault policy write eso-read - <<EOF
|
|
# path "secret/data/neuron-technologies/*" { capabilities = ["read"] }
|
|
# path "secret/data/r2" { capabilities = ["read"] }
|
|
# path "secret/data/slack" { capabilities = ["read"] }
|
|
# path "secret/data/legion-db" { capabilities = ["read"] }
|
|
# EOF
|
|
#
|
|
# 3. Create the AppRole:
|
|
# vault write auth/approle/role/eso \
|
|
# token_policies="eso-read" \
|
|
# token_ttl=1h \
|
|
# token_max_ttl=4h \
|
|
# secret_id_ttl=0 # no expiry for the secretId
|
|
#
|
|
# 4. Get the roleId and secretId:
|
|
# vault read auth/approle/role/eso/role-id → ROLE_ID
|
|
# vault write -f auth/approle/role/eso/secret-id → SECRET_ID
|
|
#
|
|
# 5. Create the k8s secret (one-time bootstrap, same as the root token was):
|
|
# kubectl create secret generic vault-approle \
|
|
# --namespace external-secrets \
|
|
# --from-literal=roleId=<ROLE_ID> \
|
|
# --from-literal=secretId=<SECRET_ID>
|
|
#
|
|
# 6. Flip this file to the appRole stanza below, commit, push.
|
|
# ESO will hot-reload when the manifest changes.
|
|
#
|
|
# 7. Delete the old vault-token secret:
|
|
# kubectl delete secret vault-token -n external-secrets
|
|
# ─────────────────────────────────────────────────────
|
|
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ClusterSecretStore
|
|
metadata:
|
|
name: vault
|
|
spec:
|
|
provider:
|
|
vault:
|
|
server: "https://vault.neuralplatform.ai"
|
|
path: "secret"
|
|
version: "v2"
|
|
auth:
|
|
# ── Current: root token auth ──────────────────────────────────────────
|
|
# TODO: replace with appRole stanza once AppRole is bootstrapped (see above).
|
|
tokenSecretRef:
|
|
name: vault-token
|
|
namespace: external-secrets
|
|
key: token
|
|
# ── Target: AppRole auth (uncomment after bootstrap) ──────────────────
|
|
# appRole:
|
|
# path: "approle"
|
|
# roleId: "eso"
|
|
# secretRef:
|
|
# name: vault-approle
|
|
# namespace: external-secrets
|
|
# key: secretId
|