73 lines
2.0 KiB
Markdown
73 lines
2.0 KiB
Markdown
# Bank-vault (от banzai-cloud)
|
||
|
||
[почитать тут](https://bank-vaults.dev/docs/mutating-webhook/)
|
||
|
||
1. helm upgrade --install --create-namespace -n vault vault helm/vault
|
||
|
||
**Vaults webhooks**
|
||
|
||
```bash
|
||
helm upgrade --install --create-namespace --namespace vswh --wait vault-secrets-webhook oci://ghcr.io/bank-vaults/helm-charts/vault-secrets-webhook --set configMapMutation=true
|
||
kubectl kustomize https://github.com/bank-vaults/vault-operator/deploy/rbac | kubectl apply -f -
|
||
```
|
||
|
||
2. после запуска идем в первый vault-0 и инитим его (и открываем сразу)
|
||
|
||
```bash
|
||
vault operator init -key-shares=1 -key-threshold=1
|
||
vault operator unseal <key1>
|
||
vault login <key1>
|
||
```
|
||
|
||
3. настроим k8s для работы с вольтом
|
||
|
||
```bash
|
||
vault auth enable kubernetes
|
||
vault write auth/kubernetes/config \
|
||
token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
|
||
kubernetes_host="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}" \
|
||
kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||
```
|
||
|
||
4. создаем политику доступа
|
||
|
||
```bash
|
||
vault policy write vault-test - <<EOF
|
||
path "kv/data/myenvs" {
|
||
capabilities = ["read"]
|
||
}
|
||
EOF
|
||
```
|
||
|
||
5. создаем роль
|
||
|
||
```bash
|
||
vault write auth/kubernetes/role/vault-test \
|
||
bound_service_account_names=vault \
|
||
bound_service_account_namespaces=vault-test,vswh \
|
||
policies=vault-test \
|
||
ttl=2h
|
||
```
|
||
|
||
```bash
|
||
vault write auth/kubernetes/role/default \
|
||
bound_service_account_names=* \
|
||
bound_service_account_namespaces=* \
|
||
policies=vault-test \
|
||
ttl=2h
|
||
```
|
||
|
||
6. импортируем секрет и запускаем деплой
|
||
|
||
создаем kv
|
||
|
||
```bash
|
||
vault secrets enable -path=kv -version=2 kv
|
||
```
|
||
|
||
создаем секрет `myenvs`, содержимое можно взять из примера keys.json
|
||
|
||
```bash
|
||
kubectl bank-vaults/vault-test.yaml
|
||
```
|