init

2024-05-22 12:49:28 -05:00
commit 35b77bb0df
219 changed files with 9997 additions and 0 deletions
--- a/clusters/cl01tl/platform/vault/Chart.yaml
+++ b/clusters/cl01tl/platform/vault/Chart.yaml
@@ -0,0 +1,11 @@
+apiVersion: v2
+name: vault
+version: 0.0.1
+sources:
+  - https://github.com/hashicorp/vault
+  - https://github.com/hashicorp/vault-helm
+dependencies:
+  - name: vault
+    version: "0.28.0"
+    repository: https://helm.releases.hashicorp.com
+appVersion: 1.15.5
--- a/clusters/cl01tl/platform/vault/templates/cron-job.yaml
+++ b/clusters/cl01tl/platform/vault/templates/cron-job.yaml
@@ -0,0 +1,64 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: vault-snapshot-cronjob
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-snapshot-cronjob
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: storage
+    app.kubernetes.io/part-of: {{ .Release.Name }}  
+spec:
+  schedule: "@every 24h"
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3  
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          restartPolicy: OnFailure        
+          containers:
+            - name: snapshot
+              image: hashicorp/vault:1.16.2
+              imagePullPolicy: IfNotPresent
+              command:
+                - /bin/ash
+              args:
+                - -ec
+                - |
+                  apk add --no-cache jq;
+                  export VAULT_TOKEN=$(vault write auth/approle/login role_id=$VAULT_APPROLE_ROLE_ID secret_id=$VAULT_APPROLE_SECRET_ID -format=json | jq -r .auth.client_token);
+                  vault operator raft snapshot save /opt/backup/vault-snapshot-latest.snap;
+                  cp /opt/backup/vault-snapshot-latest.snap /opt/backup/vault-snapshot-$(date +"%Y%m%d-%H-%M").snap;
+                  cp /opt/backup/vault-snapshot-latest.snap /opt/backup/vault-snapshot-s3.snap;
+              envFrom:
+                - secretRef:
+                    name: vault-snapshot-agent-token
+              env:
+                - name: VAULT_ADDR
+                  value: http://vault-active.vault.svc.cluster.local:8200
+              volumeMounts:
+                - mountPath: /opt/backup
+                  name: backup
+            - name: upload
+              image: amazon/aws-cli:2.15.42
+              imagePullPolicy: IfNotPresent
+              command:
+                - /bin/sh
+              args:
+                - -ec
+                - |
+                  until [ -f /opt/backup/vault-snapshot-s3.snap ]; do sleep 5; done;
+                  aws s3 cp /opt/backup/vault-snapshot-s3.snap s3://cl01tl-vault-snapshots/vault-snapshot-$(date +"%Y%m%d-%H-%M").snap;
+                  rm /opt/backup/vault-snapshot-s3.snap;
+              envFrom:
+                - secretRef:
+                    name: vault-snapshot-s3
+              volumeMounts:
+                - mountPath: /opt/backup
+                  name: backup
+          volumes:
+            - name: backup
+              persistentVolumeClaim:
+                claimName: vault-nfs-storage-backup                  
--- a/clusters/cl01tl/platform/vault/templates/ingress.yaml
+++ b/clusters/cl01tl/platform/vault/templates/ingress.yaml
@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: tailscale-cl01tl-vault-ui
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: tailscale-cl01tl-vault-ui
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: tailscale
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  ingressClassName: tailscale
+  tls:
+    - hosts:
+        - vault-cl01tl
+  rules:
+    - http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: vault-ui
+                port:
+                  name: http
--- a/clusters/cl01tl/platform/vault/templates/persistent-volume-claim.yaml
+++ b/clusters/cl01tl/platform/vault/templates/persistent-volume-claim.yaml
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: vault-nfs-storage-backup
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-nfs-storage-backup
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: storage
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  volumeMode: Filesystem
+  storageClassName: nfs-client
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
--- a/clusters/cl01tl/platform/vault/values.yaml
+++ b/clusters/cl01tl/platform/vault/values.yaml
@@ -0,0 +1,170 @@
+vault:
+  global:
+    enabled: true
+    tlsDisable: true
+    psp:
+      enable: false
+    serverTelemetry:
+      prometheusOperator: true
+  injector:
+    enabled: false
+  server:
+    enabled: true
+    image:
+      repository: "hashicorp/vault"
+      tag: "1.16.2"
+    updateStrategyType: "OnDelete"
+    logLevel: debug
+    logFormat: standard
+    resources:
+      requests:
+        memory: 256Mi
+        cpu: 250m
+      limits:
+        memory: 256Mi
+        cpu: 250m
+    ingress:
+      enabled: true
+      annotations:
+        traefik.ingress.kubernetes.io/router.entrypoints: websecure
+        traefik.ingress.kubernetes.io/router.tls: "true"
+        cert-manager.io/cluster-issuer: letsencrypt-issuer
+      ingressClassName: traefik
+      pathType: Prefix
+      activeService: true
+      hosts:
+        - host: vault.alexlebens.net
+          paths:
+            - /
+      tls:
+        - secretName: vault-secret-tls
+          hosts:
+            - vault.alexlebens.net
+    route:
+      enabled: false
+    authDelegator:
+      enabled: false
+    readinessProbe:
+      enabled: true
+      port: 8200
+    livenessProbe:
+      enabled: false
+    volumes:
+      - name: vault-nfs-storage-backup
+        persistentVolumeClaim:
+          claimName: vault-nfs-storage-backup
+    volumeMounts:
+      - mountPath: /opt/backups/
+        name: vault-nfs-storage-backup
+        readOnly: false
+    affinity: |
+      podAntiAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchLabels:
+                app.kubernetes.io/name: {{ template "vault.name" . }}
+                app.kubernetes.io/instance: "{{ .Release.Name }}"
+                component: server
+            topologyKey: kubernetes.io/hostname
+    networkPolicy:
+      enabled: false
+    service:
+      enabled: true
+      active:
+        enabled: true
+      standby:
+        enabled: false
+      type: ClusterIP
+      port: 8200
+      targetPort: 8200
+    dataStorage:
+      enabled: true
+      size: 10Gi
+      mountPath: "/vault/data"
+      accessMode: ReadWriteOnce
+    auditStorage:
+      enabled: false
+      size: 10Gi
+      mountPath: "/vault/audit"
+      accessMode: ReadWriteOnce
+    dev:
+      enabled: false
+    standalone:
+      enabled: false
+    ha:
+      enabled: true
+      replicas: 3
+      raft:
+        enabled: true
+        config: |
+          ui = true
+
+          listener "tcp" {
+            tls_disable = 1
+            address = "[::]:8200"
+            cluster_address = "[::]:8201"
+            telemetry {
+              unauthenticated_metrics_access = "true"
+            }
+          }
+
+          storage "raft" {
+            path = "/vault/data"
+            retry_join {
+              leader_api_addr = "http://vault-0.vault-internal:8200"
+            }
+            retry_join {
+              leader_api_addr = "http://vault-1.vault-internal:8200"
+            }
+            retry_join {
+              leader_api_addr = "http://vault-2.vault-internal:8200"
+            }
+          }
+
+          service_registration "kubernetes" {}
+
+          telemetry {
+            prometheus_retention_time = "30s"
+            disable_hostname = true
+          }
+
+      disruptionBudget:
+        enabled: true
+        maxUnavailable: null
+    serviceAccount:
+      create: true
+      serviceDiscovery:
+        enabled: true
+    hostNetwork: false
+  ui:
+    enabled: true
+    publishNotReadyAddresses: true
+    activeVaultPodOnly: false
+    serviceType: "ClusterIP"
+    serviceNodePort: null
+    externalPort: 8200
+    targetPort: 8200
+  csi:
+    enabled: false
+  serverTelemetry:
+    serviceMonitor:
+      enabled: true
+      interval: 30s
+      scrapeTimeout: 10s
+    prometheusRules:
+      enabled: true
+      rules:
+        - alert: vault-HighResponseTime
+          annotations:
+            message: The response time of Vault is over 500ms on average over the last 5 minutes.
+          expr: vault_core_handle_request{quantile="0.5", namespace="mynamespace"} > 500
+          for: 5m
+          labels:
+            severity: warning
+        - alert: vault-HighResponseTime
+          annotations:
+            message: The response time of Vault is over 1s on average over the last 5 minutes.
+          expr: vault_core_handle_request{quantile="0.5", namespace="mynamespace"} > 1000
+          for: 5m
+          labels:
+            severity: critical