From 477c65cb4e3370ece3aaf4654d5370cedc92ebcf Mon Sep 17 00:00:00 2001 From: benvin Date: Sat, 18 Jul 2026 16:13:55 +1000 Subject: [PATCH 1/2] cephrgw-system: source cephrgw-credentials from Vault via VSO Replace the out-of-band cephrgw-credentials Secret with a VSO-managed one so the operator's Ceph dashboard credentials come from Vault. - Add apps/base/cephrgw-system/vaultauth.yaml: VaultAuth (k8s/au/syd1 mount, role cephrgw-operator, SA cephrgw-operator, connection vso-system/default). - Add apps/base/cephrgw-system/vaultstaticsecret.yaml: renders the KV path service/cephrgw/dashboard-credentials into the cephrgw-credentials Secret (keys copied verbatim, consumed by the Deployment via envFrom). - Reference both from the base kustomization. Requires the Vault role/policy from terraform-vault #95 and the KV values to be seeded (see the operator's docs/ceph-setup.md). --- apps/base/cephrgw-system/kustomization.yaml | 2 ++ apps/base/cephrgw-system/vaultauth.yaml | 18 ++++++++++++++++ .../cephrgw-system/vaultstaticsecret.yaml | 21 +++++++++++++++++++ 3 files changed, 41 insertions(+) create mode 100644 apps/base/cephrgw-system/vaultauth.yaml create mode 100644 apps/base/cephrgw-system/vaultstaticsecret.yaml diff --git a/apps/base/cephrgw-system/kustomization.yaml b/apps/base/cephrgw-system/kustomization.yaml index c3558d4..8087c3e 100644 --- a/apps/base/cephrgw-system/kustomization.yaml +++ b/apps/base/cephrgw-system/kustomization.yaml @@ -9,3 +9,5 @@ resources: - https://git.unkin.net/unkin/cephrgw-operator/raw/tag/v0.1.0/config/crd/install.yaml - rbac.yaml - deployment.yaml + - vaultauth.yaml + - vaultstaticsecret.yaml diff --git a/apps/base/cephrgw-system/vaultauth.yaml b/apps/base/cephrgw-system/vaultauth.yaml new file mode 100644 index 0000000..fe747e6 --- /dev/null +++ b/apps/base/cephrgw-system/vaultauth.yaml @@ -0,0 +1,18 @@ +--- +apiVersion: secrets.hashicorp.com/v1beta1 +kind: VaultAuth +metadata: + name: default + namespace: cephrgw-system +spec: + method: kubernetes + mount: k8s/au/syd1 + vaultConnectionRef: vso-system/default + allowedNamespaces: + - cephrgw-system + kubernetes: + role: cephrgw-operator + serviceAccount: cephrgw-operator + audiences: + - vault + tokenExpirationSeconds: 600 diff --git a/apps/base/cephrgw-system/vaultstaticsecret.yaml b/apps/base/cephrgw-system/vaultstaticsecret.yaml new file mode 100644 index 0000000..6de026a --- /dev/null +++ b/apps/base/cephrgw-system/vaultstaticsecret.yaml @@ -0,0 +1,21 @@ +--- +# Renders the Ceph dashboard credentials from Vault into the cephrgw-credentials +# Secret the operator Deployment consumes via envFrom. The KV secret's keys +# (CEPH_DASHBOARD_URL/USERNAME/PASSWORD, optional CEPH_RGW_ENDPOINT/CA) are +# copied verbatim, so they land as the matching env vars. +apiVersion: secrets.hashicorp.com/v1beta1 +kind: VaultStaticSecret +metadata: + name: cephrgw-credentials + namespace: cephrgw-system +spec: + vaultAuthRef: default + mount: kv + type: kv-v2 + path: service/cephrgw/dashboard-credentials + refreshAfter: 5m + hmacSecretData: true + destination: + name: cephrgw-credentials + create: true + overwrite: true -- 2.47.3 From 395099b9a1daecd7a3a811598de1db8eba27e549 Mon Sep 17 00:00:00 2001 From: benvin Date: Sat, 18 Jul 2026 16:25:30 +1000 Subject: [PATCH 2/2] cephrgw VSO: use shared default role + templated KV path Per review, reuse the existing shared 'default' k8s auth role and its templated policy (kv/data/kubernetes/namespace///*) instead of a dedicated Vault role/policy, so no terraform-vault change is required. - VaultAuth: role default, serviceAccount default. - VaultStaticSecret: path kubernetes/namespace/cephrgw-system/default/cephrgw-credentials. --- apps/base/cephrgw-system/vaultauth.yaml | 7 +++++-- apps/base/cephrgw-system/vaultstaticsecret.yaml | 8 +++++++- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/apps/base/cephrgw-system/vaultauth.yaml b/apps/base/cephrgw-system/vaultauth.yaml index fe747e6..ceb64b7 100644 --- a/apps/base/cephrgw-system/vaultauth.yaml +++ b/apps/base/cephrgw-system/vaultauth.yaml @@ -11,8 +11,11 @@ spec: allowedNamespaces: - cephrgw-system kubernetes: - role: cephrgw-operator - serviceAccount: cephrgw-operator + # Shared "default" role: binds the namespace's default ServiceAccount and + # grants the templated kv/kubernetes/namespace///* read policy, so + # no per-app terraform-vault change is needed. + role: default + serviceAccount: default audiences: - vault tokenExpirationSeconds: 600 diff --git a/apps/base/cephrgw-system/vaultstaticsecret.yaml b/apps/base/cephrgw-system/vaultstaticsecret.yaml index 6de026a..142cc74 100644 --- a/apps/base/cephrgw-system/vaultstaticsecret.yaml +++ b/apps/base/cephrgw-system/vaultstaticsecret.yaml @@ -3,6 +3,12 @@ # Secret the operator Deployment consumes via envFrom. The KV secret's keys # (CEPH_DASHBOARD_URL/USERNAME/PASSWORD, optional CEPH_RGW_ENDPOINT/CA) are # copied verbatim, so they land as the matching env vars. +# +# The path sits under the templated default policy +# (kv/data/kubernetes/namespace///*), so it needs no dedicated Vault +# role or policy. Seed the values with: +# vault kv put kv/kubernetes/namespace/cephrgw-system/default/cephrgw-credentials \ +# CEPH_DASHBOARD_URL=... CEPH_DASHBOARD_USERNAME=... CEPH_DASHBOARD_PASSWORD=... apiVersion: secrets.hashicorp.com/v1beta1 kind: VaultStaticSecret metadata: @@ -12,7 +18,7 @@ spec: vaultAuthRef: default mount: kv type: kv-v2 - path: service/cephrgw/dashboard-credentials + path: kubernetes/namespace/cephrgw-system/default/cephrgw-credentials refreshAfter: 5m hmacSecretData: true destination: -- 2.47.3