unkinben
5a22dd95ef
## Why Follow-up to the cephrgw-operator deploy (#261): source the operator's Ceph dashboard credentials from Vault via VSO instead of a hand-created Secret. ## Changes - Add `apps/base/cephrgw-system/vaultauth.yaml`: `VaultAuth` (mount `k8s/au/syd1`, role `cephrgw-operator`, SA `cephrgw-operator`, `vaultConnectionRef: vso-system/default`). - Add `apps/base/cephrgw-system/vaultstaticsecret.yaml`: renders KV `service/cephrgw/dashboard-credentials` into the `cephrgw-credentials` Secret (keys copied verbatim → consumed by the Deployment via `envFrom`; the reloader annotation restarts the operator on rotation). - Reference both from the base kustomization. ## Dependencies / ordering - Requires the Vault role + policy from **terraform-vault #95** (merge/apply first), and the KV values to be seeded out-of-band: ``` vault kv put kv/service/cephrgw/dashboard-credentials \ CEPH_DASHBOARD_URL=https://dashboard.ceph.unkin.net \ CEPH_DASHBOARD_USERNAME=k8s-cephrgw-operator \ CEPH_DASHBOARD_PASSWORD=... CEPH_RGW_ENDPOINT=https://s3.ceph.unkin.net ``` - Until VSO auth succeeds the `cephrgw-credentials` Secret won't exist and the operator pod stays in `CreateContainerConfigError` (expected). --------- Co-authored-by: benvin <neotheo@gmail.com> Reviewed-on: #262 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
28 lines
1020 B
YAML
28 lines
1020 B
YAML
---
|
|
# Renders the Ceph dashboard credentials from Vault into the cephrgw-credentials
|
|
# Secret the operator Deployment consumes via envFrom. The KV secret's keys
|
|
# (CEPH_DASHBOARD_URL/USERNAME/PASSWORD, optional CEPH_RGW_ENDPOINT/CA) are
|
|
# copied verbatim, so they land as the matching env vars.
|
|
#
|
|
# The path sits under the templated default policy
|
|
# (kv/data/kubernetes/namespace/<ns>/<sa>/*), so it needs no dedicated Vault
|
|
# role or policy. Seed the values with:
|
|
# vault kv put kv/kubernetes/namespace/cephrgw-system/default/cephrgw-credentials \
|
|
# CEPH_DASHBOARD_URL=... CEPH_DASHBOARD_USERNAME=... CEPH_DASHBOARD_PASSWORD=...
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: cephrgw-credentials
|
|
namespace: cephrgw-system
|
|
spec:
|
|
vaultAuthRef: default
|
|
mount: kv
|
|
type: kv-v2
|
|
path: kubernetes/namespace/cephrgw-system/default/cephrgw-credentials
|
|
refreshAfter: 5m
|
|
hmacSecretData: true
|
|
destination:
|
|
name: cephrgw-credentials
|
|
create: true
|
|
overwrite: true
|