heqet/docs/vault.md

Vault

This are some quick notes I took on how to setup a simple Vault for usage with heqet. For a more detailed documentation on how to configure Vault, check out the Official Vault Docs.

Note: Most of this commands can be executed either using the vault command on your local device or the inside the vault pod itself.

Init Vault using GPG

Copy GPG Public Key

cat > nold.pub << EOF
-----BEGIN PGP PUBLIC KEY BLOCK-----

mQENBGBXTjkBCAC7qZU1cz7RWYbAb838ypRLJZKLWfVBvry4XYwWPN0Rcj55dPN+
...
5of4H66FzNwJxYrunmM5KTeUxZiLPC1JoKMF5uvKoo59TD0IuAPq735QDjWbS4vb
dMtSqTCinZSd
=wuZw
-----END PGP PUBLIC KEY BLOCK-----
EOF

Init Vault

vault operator init -key-shares=1 -key-threshold=1 -pgp-keys="nold.pub"

Save Unseal Key somewhere sage e.g. Keepass

Decode Unseal Key

$ echo $unseal-key | base64 -d | gpg -dq

Unseal Vault

vault operator unseal

Enable Kubernetes Auth

vault auth enable kubernetes

vault write auth/kubernetes/config \
    token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
    kubernetes_host="https://$KUBERNETES_PORT_443_TCP_ADDR:443" \
    [email protected]/var/run/secrets/kubernetes.io/serviceaccount/ca.crt \
    disable_iss_validation=true

Create Secret Store

vault secrets enable -path=heqet kv-v2

Add Secrets-Operator Role & Policy

Create Policy

vault policy write heqet-app << EOF
path "heqet/+/*" {
  capabilities = ["read"]
}
EOF

Add Auth Role

vault write auth/kubernetes/role/heqet-app \
  bound_service_account_names=vault-secrets-operator \
  bound_service_account_namespaces=vault-secrets-operator \
  policies=heqet-app \
  ttl=6h

Add Secrets

Remember, Secret path: heqet/<APP-NAME>/<SECRET-NAME>

vault kv put heqet/argocd/argocd-secret admin.password='$2y$12$FP8OlsVj5pOOqRAhI4XPoev1STaW01uUEZGcNPQtVZmpacebNhj9i' server.secretkey="pDYAWK2mHa68GwwVPAsQOsG/SUT8iIo3S3FXYUWf2qM="
vault kv put heqet/loki-stack/loki-stack-grafana admin-user=admin admin-password='grafana'
vault kv put heqet/pihole/pihole-admin password=pihole
vault kv put heqet/minio/minio-secret secret-key=secret access-key=access

Vault-Issuer Cert-Manager via Kubernetes Service Account

We expect you already have setup a PKI & Intermediate PKI. You will need a policy to allow your approle to create new certs:

And a role: [dc = my local domain]

vault write pki_int/roles/dc \
    allowed_domains=.dc \
    allow_subdomains=true \
    max_ttl=72h

Policy:

vault policy write pki_int - <<EOF
path "pki_int*" { capabilities = ["read", "list"] }
path "pki_int/roles/dc"   { capabilities = ["create", "update"] }
path "pki_int/sign/dc"    { capabilities = ["create", "update"] }
path "pki_int/issue/dc"   { capabilities = ["create"] }
EOF

Authorize Service Account

vault write auth/kubernetes/role/vault-issuer \
  bound_service_account_names=vault-issuer \
  bound_service_account_namespaces=cert-manager \
  policies=pki_int \
  ttl=6h