cephrgw-system: source cephrgw-credentials from Vault via VSO #262

Merged

benvin merged 2 commits from benvin/cephrgw-vault-vso into main 2026-07-18 23:18:01 +10:00

Conversation 1 Commits 2 Files Changed 3

+50

unkinben commented 2026-07-18 16:14:10 +10:00

Owner

Copy Link

Copy Source

Why

Follow-up to the cephrgw-operator deploy (#261): source the operator's Ceph dashboard credentials from Vault via VSO instead of a hand-created Secret.

Changes

• Add apps/base/cephrgw-system/vaultauth.yaml: VaultAuth (mount k8s/au/syd1, role cephrgw-operator, SA cephrgw-operator, vaultConnectionRef: vso-system/default).
• Add apps/base/cephrgw-system/vaultstaticsecret.yaml: renders KV service/cephrgw/dashboard-credentials into the cephrgw-credentials Secret (keys copied verbatim → consumed by the Deployment via envFrom; the reloader annotation restarts the operator on rotation).
• Reference both from the base kustomization.

Dependencies / ordering

• Requires the Vault role + policy from terraform-vault #95 (merge/apply first), and the KV values to be seeded out-of-band:

  vault kv put kv/service/cephrgw/dashboard-credentials \
    CEPH_DASHBOARD_URL=https://dashboard.ceph.unkin.net \
    CEPH_DASHBOARD_USERNAME=k8s-cephrgw-operator \
    CEPH_DASHBOARD_PASSWORD=... CEPH_RGW_ENDPOINT=https://s3.ceph.unkin.net
  

• Until VSO auth succeeds the cephrgw-credentials Secret won't exist and the operator pod stays in CreateContainerConfigError (expected).

## Why Follow-up to the cephrgw-operator deploy (#261): source the operator's Ceph dashboard credentials from Vault via VSO instead of a hand-created Secret. ## Changes - Add `apps/base/cephrgw-system/vaultauth.yaml`: `VaultAuth` (mount `k8s/au/syd1`, role `cephrgw-operator`, SA `cephrgw-operator`, `vaultConnectionRef: vso-system/default`). - Add `apps/base/cephrgw-system/vaultstaticsecret.yaml`: renders KV `service/cephrgw/dashboard-credentials` into the `cephrgw-credentials` Secret (keys copied verbatim → consumed by the Deployment via `envFrom`; the reloader annotation restarts the operator on rotation). - Reference both from the base kustomization. ## Dependencies / ordering - Requires the Vault role + policy from **terraform-vault #95** (merge/apply first), and the KV values to be seeded out-of-band: ``` vault kv put kv/service/cephrgw/dashboard-credentials \ CEPH_DASHBOARD_URL=https://dashboard.ceph.unkin.net \ CEPH_DASHBOARD_USERNAME=k8s-cephrgw-operator \ CEPH_DASHBOARD_PASSWORD=... CEPH_RGW_ENDPOINT=https://s3.ceph.unkin.net ``` - Until VSO auth succeeds the `cephrgw-credentials` Secret won't exist and the operator pod stays in `CreateContainerConfigError` (expected).

unkinben added 1 commit 2026-07-18 16:14:11 +10:00

cephrgw-system: source cephrgw-credentials from Vault via VSO ... 477c65cb4e

Replace the out-of-band cephrgw-credentials Secret with a VSO-managed one so
the operator's Ceph dashboard credentials come from Vault.

- Add apps/base/cephrgw-system/vaultauth.yaml: VaultAuth (k8s/au/syd1 mount,
  role cephrgw-operator, SA cephrgw-operator, connection vso-system/default).
- Add apps/base/cephrgw-system/vaultstaticsecret.yaml: renders the KV path
  service/cephrgw/dashboard-credentials into the cephrgw-credentials Secret
  (keys copied verbatim, consumed by the Deployment via envFrom).
- Reference both from the base kustomization.

Requires the Vault role/policy from terraform-vault #95 and the KV values to
be seeded (see the operator's docs/ceph-setup.md).

unkinben added 1 commit 2026-07-18 16:25:34 +10:00

cephrgw VSO: use shared default role + templated KV path ... 395099b9a1

Per review, reuse the existing shared 'default' k8s auth role and its templated
policy (kv/data/kubernetes/namespace/<ns>/<sa>/*) instead of a dedicated Vault
role/policy, so no terraform-vault change is required.

- VaultAuth: role default, serviceAccount default.
- VaultStaticSecret: path kubernetes/namespace/cephrgw-system/default/cephrgw-credentials.

unkinben commented 2026-07-18 16:25:52 +10:00

Author

Owner

Copy Link

Copy Source

Updated per review: now uses the shared default k8s auth role + templated KV path kubernetes/namespace/cephrgw-system/default/cephrgw-credentials, so terraform-vault #95 is no longer needed (closed). No terraform-vault change required. Seed values with:

vault kv put kv/kubernetes/namespace/cephrgw-system/default/cephrgw-credentials \
  CEPH_DASHBOARD_URL=... CEPH_DASHBOARD_USERNAME=... CEPH_DASHBOARD_PASSWORD=... CEPH_RGW_ENDPOINT=...

Updated per review: now uses the shared `default` k8s auth role + templated KV path `kubernetes/namespace/cephrgw-system/default/cephrgw-credentials`, so **terraform-vault #95 is no longer needed** (closed). No terraform-vault change required. Seed values with: ``` vault kv put kv/kubernetes/namespace/cephrgw-system/default/cephrgw-credentials \ CEPH_DASHBOARD_URL=... CEPH_DASHBOARD_USERNAME=... CEPH_DASHBOARD_PASSWORD=... CEPH_RGW_ENDPOINT=... ```

benvin merged commit 5a22dd95ef into main 2026-07-18 23:18:01 +10:00

benvin deleted branch benvin/cephrgw-vault-vso 2026-07-18 23:18:02 +10:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/argocd-apps#262