k8s/helm/setup/007-vault-config-operator/install.sh

52 lines
1.4 KiB
Bash
Executable file

#!/bin/bash
CHART_VERSION=0.8.4
VAULT_AUTH_NAMESPACE="k8s-teapot"
NAMESPACE=vco
helm repo add vault-config-operator https://redhat-cop.github.io/vault-config-operator
helm repo update
kubectl create ns ${NAMESPACE}
kubectl create serviceaccount -n ${NAMESPACE} vault-config-operator
cat << EOH > vault-config-operator.hcl
path "kv/data/vault-config-operator" {
capabilities = ["read"]
}
# List existing policies
path "sys/policy"
{
capabilities = ["list"]
}
path "sys/policy/*"
{
capabilities = ["create", "read", "update", "delete", "list"]
}
EOH
vault policy write vault-config-operator vault-config-operator.hcl
rm vault-config-operator.hcl
kubectl apply -n ${NAMESPACE} -f external-secrets.yaml
HOST_IP=$(ip addr show eth0 | grep -Po 'inet \K[\d.]+')
TOKEN="$(kubectl get secret serviceaccounttoken -n ${NAMESPACE} -o go-template='{{ .data.token }}' | base64 -d)"
vault write auth/${VAULT_AUTH_NAMESPACE}/role/vault-config-operator \
bound_service_account_names=vault-config-operator,controller-manager,default \
bound_service_account_namespaces=${NAMESPACE} \
policies=vault-config-operator \
ttl=24h
vault write auth/${VAULT_AUTH_NAMESPACE}/login role=vault-config-operator jwt=${TOKEN} iss=https://${HOST_IP}:6443
helm upgrade --install \
vault-config-operator \
vault-config-operator/vault-config-operator \
-n ${NAMESPACE} \
--version ${CHART_VERSION} \
--create-namespace \
--values values.yaml \
--cleanup-on-fail