diff --git a/environments/common.yaml.gotmpl b/environments/common.yaml.gotmpl index b4c0907..da617fa 100644 --- a/environments/common.yaml.gotmpl +++ b/environments/common.yaml.gotmpl @@ -79,22 +79,6 @@ orchestrate: issuerUrl: https://consensys.eu.auth0.com/ claims: https://api.orchestrate.network -vaultOperator: - enabled: false - namespace: {{ env "VAULT_OPERATOR_NAMESPACE" | default "vault-operator" }} - -vault: - enabled: true - replicaCount: 1 - namespace: {{ env "VAULT_NAMESPACE" | default ( env "ORCHESTRATE_NAMESPACE" | default $defaultNamespace ) }} - plugin: - name: {{ env "VAULT_PLUGIN_NAME" | default "quorum" }} - tag: {{ env "VAULT_PLUGIN_TAG" | default "v1.1.3" }} - sha256: {{ env "VAULT_PLUGIN_SHA256SUM" | default "e084800c61749a9c7b51f6e91bb89ab6d5a2678cdb707eaa73f9bef0cf73fc61" }} - filename: {{ env "VAULT_PLUGIN_FILENAME" | default "quorum-hashicorp-vault-plugin" }} - envs: - - VAULT_ADDR: "http://localhost:8200" - qkm: orchestrate: storeName: "eth-accounts" diff --git a/environments/staging.yaml b/environments/staging.yaml index fd10290..1fddfbb 100644 --- a/environments/staging.yaml +++ b/environments/staging.yaml @@ -12,8 +12,5 @@ observability: drop: enabled: false -vault: - replicaCount: 3 - qkm: url: https://staging-qkm.ops.consensys.net \ No newline at end of file diff --git a/helmfile-core.yaml b/helmfile-core.yaml index 06bbb1b..b1116da 100644 --- a/helmfile-core.yaml +++ b/helmfile-core.yaml @@ -3,21 +3,10 @@ bases: - helmfile-common.yaml --- releases: -{{- if .Values.vault.enabled }} - - name: vault - namespace: {{ .Values.vault.namespace }} - chart: incubator/raw - version: 0.2.3 - atomic: true - values: - - values/vault.yaml.gotmpl -{{- end }} - name: orchestrate namespace: {{ .Values.orchestrate.namespace }} chart: {{ .Values.orchestrate.chart.name }} atomic: true - version: {{ .Values.orchestrate.chart.version }} - needs: - - {{ .Values.vault.namespace }}/vault + version: {{ .Values.orchestrate.chart.version }} values: - values/orchestrate.yaml.gotmpl diff --git a/values/vault.yaml.gotmpl b/values/vault.yaml.gotmpl deleted file mode 100644 index 4cba97d..0000000 --- a/values/vault.yaml.gotmpl +++ /dev/null @@ -1,193 +0,0 @@ -{{- if .Values.vault.enabled }} -{{ $replicaCount := .Values | get "vault.replicaCount" 1 }} - -templates: -- | - apiVersion: vault.banzaicloud.com/v1alpha1 - kind: Vault - metadata: - name: vault - spec: - size: {{ $replicaCount }} - image: consensys/quorum-hashicorp-vault-plugin:{{ .Values.vault.plugin.tag }} - bankVaultsImage: banzaicloud/bank-vaults:1.14.3 - - - - # Vault Pods , Services and TLS Secret annotations - vaultAnnotations: - type/instance: "vault" - - # Vault Configurer Pods and Services annotations - vaultConfigurerAnnotations: - type/instance: "vaultconfigurer" - - # Specify the ServiceAccount where the Vault Pod and the Bank-Vaults configurer/unsealer is running - serviceAccount: vault - - serviceType: ClusterIP - - - - - - # Use local disk to store Vault file data, see config section. - - volumeMounts: - - name: vault-file - mountPath: /vault/file - - {{- if gt $replicaCount 1 }} - podAntiAffinity: topology.kubernetes.io/zone - {{- end }} - - volumeClaimTemplates: - - metadata: - name: vault-file - spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi - - vaultContainerSpec: - name: "vault" - lifecycle: - postStart: - exec: - command: ["/bin/sh", "-c", "setcap cap_ipc_lock=+ep /vault/plugins/quorum-hashicorp-vault-plugin"] - - - # Describe where you would like to store the Vault unseal keys and root token. - unsealConfig: - options: - # The preFlightChecks flag enables unseal and root token storage tests - # This is true by default - preFlightChecks: true - kubernetes: - secretNamespace: {{ .Values.vault.namespace }} - - # A YAML representation of a final vault config file. - # See https://www.vaultproject.io/docs/configuration/ for more information. - config: - ui: false - storage: - {{- if gt $replicaCount 1 }} - raft: - {{- else }} - file: - {{- end }} - path: /vault/file - listener: - tcp: - address: 0.0.0.0:8200 - tls_disable: true - plugin_directory: /vault/plugins - api_addr: "http://vault.{{ .Values.vault.namespace }}.svc.cluster.local:8200" - cluster_addr: http://${.Env.POD_NAME}:8201 - {{ if .Values.observability.enabled }} - telemetry: - statsd_address: localhost:9125 - {{ end }} - - # See: https://github.com/banzaicloud/bank-vaults#example-external-vault-configuration for more details. - externalConfig: - policies: - {{ if .Values.observability.enabled }} - - name: prometheus - rules: path "sys/metrics" { - capabilities = ["list", "read"] - } - {{ end }} - - name: quorum_key_manager - rules: path "{{ .Values.vault.plugin.name }}/*" { - capabilities = ["create", "read", "update", "list", "delete"] - } - - name: allow_secrets - rules: path "secret/*" { - capabilities = ["create", "read", "update", "list", "delete"] - } - auth: - - type: kubernetes - roles: - - name: {{ .Values.vault.namespace }} - bound_service_account_names: ["quorum_key_manager", "vault-secrets-webhook", "vault"] - bound_service_account_namespaces: ["{{ .Values.vault.namespace }}", "{{ .Values.orchestrate.namespace }}"] - policies: quorum_key_manager, allow_secrets - - {{ if .Values.observability.enabled }} - - type: kubernetes - roles: - - name: prometheus - bound_service_account_names: prometheus - bound_service_account_namespaces: {{ .Values.observability.namespace }} - policies: prometheus - {{ end }} - - secrets: - - path: {{ .Values.vault.plugin.name }} - type: plugin - plugin_name: {{ .Values.vault.plugin.name }} - description: Orchestrate key storage gateway - config: - force_no_cache: true - passthrough_request_headers: ["X-Vault-Namespace"] - - path: secret - type: kv-v2 - description: Orchestrate secrets kvv2 - options: - version: 2 - - plugins: - - plugin_name: {{ .Values.vault.plugin.name }} - command: {{ .Values.vault.plugin.filename }} - sha256: {{ .Values.vault.plugin.sha256 }} - type: secret - - serviceMonitorEnabled: {{ .Values.observability.enabled }} -- | - kind: ServiceAccount - apiVersion: v1 - metadata: - name: vault -- | - kind: Role - apiVersion: rbac.authorization.k8s.io/v1 - metadata: - name: vault-secrets - rules: - - apiGroups: - - "" - resources: - - secrets - verbs: - - "*" -- | - kind: RoleBinding - apiVersion: rbac.authorization.k8s.io/v1 - metadata: - name: vault-secrets - roleRef: - kind: Role - name: vault-secrets - apiGroup: rbac.authorization.k8s.io - subjects: - - kind: ServiceAccount - name: vault -- | - # This binding allows the deployed Vault instance to authenticate clients - # through Kubernetes ServiceAccounts (if configured so). - apiVersion: rbac.authorization.k8s.io/v1 - kind: ClusterRoleBinding - metadata: - name: {{ .Values.orchestrate.namespace }}-vault-auth-delegator - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: system:auth-delegator - subjects: - - kind: ServiceAccount - name: vault - namespace: {{ .Values.vault.namespace }} -{{- end }} \ No newline at end of file