freezer/mareshq-gitops-legacy
Archived
1
0
Fork 0
Code Activity

refactor(cherry/vault): use cert-manager issued CA and certificates to provide in-cluster TLS with trusted CA

Browse source
This commit is contained in:
Vojtěch Mareš 2023-10-01 14:11:02 +02:00
parent 1d48024722
commit eefa81744c
Signed by: vojtech.mares
GPG key ID: C6827B976F17240D
1 changed files with 53 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

57
clusters/cherry/apps/vault.yaml
View file

@ -23,7 +23,7 @@ spec:
valuesObject:
global:
enabled: true
tlsDisable: true
tlsDisable: false
injector:
enabled: true
@ -41,9 +41,12 @@ spec:
ingressClassName: nginx
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
nginx.ingress.kubernetes.io/server-snippet: |
proxy_ssl_verify off;
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
pathType: Prefix
tls:
- secretName: vault-tls
- secretName: vault-ingress-tls
hosts:
- vault.mareshq.com
hosts:
@ -51,6 +54,15 @@ spec:
paths:
- /
extraEnvironmentVars:
VAULT_CACERT: /vault/userconfig/server-ca/ca.crt
extraVolumes:
– type: secret
name: server-tls
– type: secret
name: server-ca
resources:
requests:
memory: 512Mi
@ -81,9 +93,46 @@ spec:
ha:
enabled: true
replicas: 3
disruptionBudget:
enabled: true
raft:
enabled: true
setNodeId: true
disruptionBudget:
enabled: true
config: |
ui = true
listener "tcp" {
address = "[::]:8200"
cluster_address = "[::]:8201"
tls_cert_file = "/vault/userconfig/server-tls/tls.crt"
tls_key_file = "/vault/userconfig/server-tls/tls.key"
tls_client_ca_file = "/vault/userconfig/server-ca/tls-combined.pem"
}
storage "raft" {
path = "/vault/data"
retry_join {
leader_api_addr = "https://vault-0.vault-internal:8200"
leader_ca_cert_file = "/vault/userconfig/server-ca/ca.crt"
leader_client_cert_file = "/vault/userconfig/server-tls/tls.crt"
leader_client_key_file = "/vault/userconfig/server-tls/tls.key"
}
retry_join {
leader_api_addr = "https://vault-1.vault-internal:8200"
leader_ca_cert_file = "/vault/userconfig/server-ca/ca.crt"
leader_client_cert_file = "/vault/userconfig/server-tls/tls.crt"
leader_client_key_file = "/vault/userconfig/server-tls/tls.key"
}
retry_join {
leader_api_addr = "https://vault-2.vault-internal:8200"
leader_ca_cert_file = "/vault/userconfig/server-ca/ca.crt"
leader_client_cert_file = "/vault/userconfig/server-tls/tls.crt"
leader_client_key_file = "/vault/userconfig/server-tls/tls.key"
}
}
service_registration "kubernetes" {}