Skip to content

Commit 5316705

Browse files
BK1031BK1031
authored
Merge pull request #107 from Gaucho-Racing/bk1031/add-vault-application
feat: add vault kubernetes application
2 parents 2a5339e + 839538d commit 5316705

13 files changed

Lines changed: 401 additions & 42 deletions

File tree

‎infra/environments/prod/.terraform.lock.hcl‎

Lines changed: 42 additions & 40 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎infra/environments/prod/main.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -240,6 +240,15 @@ resource "cloudflare_ruleset" "ssl_overrides" {
240240
ssl = "strict"
241241
}
242242
},
243+
{
244+
description = "vault-strict-mode"
245+
expression = "(http.host eq \"vault.gauchoracing.com\")"
246+
action = "set_config"
247+
enabled = true
248+
action_parameters = {
249+
ssl = "strict"
250+
}
251+
},
243252
]
244253
}
245254

‎infra/modules/eks/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
module "eks" {
1111
source = "terraform-aws-modules/eks/aws"
12-
version = "~> 21.0"
12+
version = "21.24.0"
1313

1414
name = var.name
1515
kubernetes_version = var.kubernetes_version

‎infra/modules/vpc/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88

99
module "vpc" {
1010
source = "terraform-aws-modules/vpc/aws"
11-
version = "~> 6.0"
11+
version = "6.6.1"
1212

1313
name = var.name
1414
cidr = var.cidr

‎kubernetes/apps/vault.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: vault
5+
namespace: argocd
6+
finalizers:
7+
- resources-finalizer.argocd.argoproj.io
8+
spec:
9+
project: default
10+
source:
11+
repoURL: https://github.com/Gaucho-Racing/infrastructure.git
12+
targetRevision: main
13+
path: kubernetes/manifests/vault
14+
destination:
15+
server: https://kubernetes.default.svc
16+
namespace: vault
17+
syncPolicy:
18+
automated:
19+
prune: true
20+
selfHeal: true
21+
syncOptions:
22+
- CreateNamespace=true
23+
- ServerSideApply=true

‎kubernetes/manifests/vault/configmap-kerbecs.yaml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: kerbecs-config
5+
namespace: vault
6+
data:
7+
kerbecs.yaml: |
8+
gateway:
9+
name: vault-gateway
10+
version: 1.0.0
11+
env: ${ENV:PROD}
12+
timeouts:
13+
dial: 5s
14+
headers: 30s
15+
idle: 50s
16+
overall: 0
17+
18+
listeners:
19+
gateway:
20+
port: "10310"
21+
cors:
22+
enabled: true
23+
allowed_origins: ["*"]
24+
allow_credentials: false
25+
admin:
26+
port: "10300"
27+
auth:
28+
type: basic
29+
username: ${KERBECS_USER:admin}
30+
password: ${KERBECS_PASSWORD:admin}
31+
32+
providers:
33+
static:
34+
watch: true
35+
36+
upstreams:
37+
vault:
38+
name: vault
39+
version: 1.0.0
40+
instances:
41+
- http://vault.vault.svc.cluster.local:9999
42+
43+
web:
44+
name: vault-web
45+
version: 1.0.0
46+
instances:
47+
- http://web.vault.svc.cluster.local:80
48+
49+
routes:
50+
- name: vault-api
51+
match:
52+
path: /api/*
53+
upstream: vault
54+
rewrite:
55+
strip_prefix: /api
56+
envelope: passthrough
57+
58+
- name: vault-web
59+
match:
60+
path: /*
61+
upstream: web
62+
envelope: passthrough

‎kubernetes/manifests/vault/ingress.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: Ingress
3+
metadata:
4+
name: vault
5+
namespace: vault
6+
annotations:
7+
alb.ingress.kubernetes.io/scheme: internet-facing
8+
alb.ingress.kubernetes.io/target-type: ip
9+
alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
10+
alb.ingress.kubernetes.io/ssl-redirect: '443'
11+
alb.ingress.kubernetes.io/backend-protocol: HTTP
12+
alb.ingress.kubernetes.io/group.name: gr-prod
13+
external-dns.alpha.kubernetes.io/hostname: vault.gauchoracing.com
14+
external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
15+
spec:
16+
ingressClassName: alb
17+
tls:
18+
- hosts:
19+
- vault.gauchoracing.com
20+
rules:
21+
- host: vault.gauchoracing.com
22+
http:
23+
paths:
24+
- path: /
25+
pathType: Prefix
26+
backend:
27+
service:
28+
name: kerbecs
29+
port:
30+
number: 10310

‎kubernetes/manifests/vault/kerbecs.yaml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: kerbecs
5+
namespace: vault
6+
spec:
7+
replicas: 1
8+
selector:
9+
matchLabels:
10+
app: kerbecs
11+
template:
12+
metadata:
13+
labels:
14+
app: kerbecs
15+
spec:
16+
topologySpreadConstraints:
17+
- maxSkew: 1
18+
minDomains: 2
19+
topologyKey: kubernetes.io/hostname
20+
whenUnsatisfiable: DoNotSchedule
21+
labelSelector:
22+
matchLabels:
23+
app: kerbecs
24+
containers:
25+
- name: kerbecs
26+
image: bk1031/kerbecs:latest
27+
ports:
28+
- containerPort: 10310
29+
name: gateway
30+
- containerPort: 10300
31+
name: admin
32+
resources:
33+
requests:
34+
cpu: 100m
35+
memory: 128Mi
36+
limits:
37+
cpu: 500m
38+
memory: 512Mi
39+
env:
40+
- name: KERBECS_CONFIG
41+
value: /etc/kerbecs/kerbecs.yaml
42+
- name: ENV
43+
value: PROD
44+
- name: KERBECS_USER
45+
value: admin
46+
- name: KERBECS_PASSWORD
47+
valueFrom:
48+
secretKeyRef:
49+
name: vault-secrets
50+
key: KERBECS_PASSWORD
51+
volumeMounts:
52+
- name: kerbecs-config
53+
mountPath: /etc/kerbecs
54+
readOnly: true
55+
volumes:
56+
- name: kerbecs-config
57+
configMap:
58+
name: kerbecs-config
59+
---
60+
apiVersion: v1
61+
kind: Service
62+
metadata:
63+
name: kerbecs
64+
namespace: vault
65+
spec:
66+
selector:
67+
app: kerbecs
68+
ports:
69+
- name: gateway
70+
port: 10310
71+
targetPort: 10310
72+
- name: admin
73+
port: 10300
74+
targetPort: 10300

‎kubernetes/manifests/vault/kustomization.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
4+
resources:
5+
- namespace.yaml
6+
- configmap-kerbecs.yaml
7+
- postgres.yaml
8+
- kerbecs.yaml
9+
- server.yaml
10+
- web.yaml
11+
- ingress.yaml
12+
13+
images:
14+
- name: ghcr.io/gaucho-racing/vault-server
15+
newTag: 1.0.0
16+
- name: ghcr.io/gaucho-racing/vault-web
17+
newTag: 1.0.0
18+
- name: bk1031/kerbecs
19+
newTag: 3.2.0

‎kubernetes/manifests/vault/namespace.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: vault

0 commit comments

Comments
 (0)