Skip to content
This repository was archived by the owner on Jul 7, 2026. It is now read-only.

feat: Vault POC #226

Open
matmut7 wants to merge 8 commits into
base: hasura
Choose a base branch
from
Open

feat: Vault POC #226

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
99f4952
feat: init Vault POC
matmut7 Dec 18, 2023
d0683a9
remove needs
matmut7 Dec 18, 2023
65f1aff
feat: poc vault v0
malo-octo Dec 18, 2023
65e0094
feat: vault agent injector for nextauth_secret
malo-octo Dec 19, 2023
fd77add
feat: add service account for vault
malo-octo Dec 19, 2023
60e9e0f
feat: add SA in patch
malo-octo Dec 20, 2023
26867bb
feat:remove nextauth from k secretes
malo-octo Dec 21, 2023
d70e88f
feat: raw env variable name
malo-octo Dec 21, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .idea/.gitignore
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 6 additions & 0 deletions .idea/inspectionProfiles/Project_Default.xml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 6 additions & 0 deletions .idea/misc.xml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 8 additions & 0 deletions .idea/modules.xml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

9 changes: 9 additions & 0 deletions .idea/template.iml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 6 additions & 0 deletions .idea/vcs.xml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion .kontinuous/env/dev/templates/app.sealed.secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ metadata:
name: app
spec:
encryptedData:
NEXTAUTH_SECRET: AgBdDOpKTwHKWU2g0+hGyGZpP0LC6f3sEtw1ejLkk72Rhip/Soia+/4gKzXHb938u0YE1FQsz8tntM2/mmCv6+hmtgvsE+aaNWEBqTMkOby/bbChrxhw50es06cWBK7ts0m6NGNvyNfdEWHWWrOTDmO7m/4f0oS9KAaXjeFdNlOEU8kq7Fe5W5/hdNpH7u8MF7MwWwGrQyO9QHHNp3Ojyc5i/PIEBjE4VgxnLlX/B3i+sPjymIQhI8bsd9HXwvqM3V8TK/AI5JceYodz7UkBlPipgS4Bg2ldmK8xgXkYuRrehh+sTo8faiuMwVAYmdFYJYRwhMMg04IZ4yGsHu0NxmFuVAUvQL+5ksoDoJTGjWxrwR4+LT7NiGPRma65ARpFD0iDj/n+pKODkXA/ol+2p9I4gEHzWVwECIEjKMXVuOGAfHVjklZWj6+qYY74w9yF/P+QsWsK68p2igjFb1RfXszeujAQyF25vhNB5MXCFkeuLaEyU1yNFULc6vyc0HJO1Y/8zNWXmqqDSUMlc/mGrO/TojkMKwDrfbMhIhegW0JcgcHJSpPnXpReYKp77PH8ElavbqmjVN1SXXlA1kCHX9QzERHvoIMzJFXCryOSXIVq3LkYiNeKCNJKEHpIB9exuOdwqJXBb/lnPponkZOh4JpyGgjARc6HoQsGr0mzpYkIIRYny/tSvW6vrIT1Yak+VWcNTlw+1+nu7av1dax7HDVkZ3AnepD6zsHSEnoNp0zy7ZkZPJZtN7E8vEEf8Q==
# NEXTAUTH_SECRET: AgBdDOpKTwHKWU2g0+hGyGZpP0LC6f3sEtw1ejLkk72Rhip/Soia+/4gKzXHb938u0YE1FQsz8tntM2/mmCv6+hmtgvsE+aaNWEBqTMkOby/bbChrxhw50es06cWBK7ts0m6NGNvyNfdEWHWWrOTDmO7m/4f0oS9KAaXjeFdNlOEU8kq7Fe5W5/hdNpH7u8MF7MwWwGrQyO9QHHNp3Ojyc5i/PIEBjE4VgxnLlX/B3i+sPjymIQhI8bsd9HXwvqM3V8TK/AI5JceYodz7UkBlPipgS4Bg2ldmK8xgXkYuRrehh+sTo8faiuMwVAYmdFYJYRwhMMg04IZ4yGsHu0NxmFuVAUvQL+5ksoDoJTGjWxrwR4+LT7NiGPRma65ARpFD0iDj/n+pKODkXA/ol+2p9I4gEHzWVwECIEjKMXVuOGAfHVjklZWj6+qYY74w9yF/P+QsWsK68p2igjFb1RfXszeujAQyF25vhNB5MXCFkeuLaEyU1yNFULc6vyc0HJO1Y/8zNWXmqqDSUMlc/mGrO/TojkMKwDrfbMhIhegW0JcgcHJSpPnXpReYKp77PH8ElavbqmjVN1SXXlA1kCHX9QzERHvoIMzJFXCryOSXIVq3LkYiNeKCNJKEHpIB9exuOdwqJXBb/lnPponkZOh4JpyGgjARc6HoQsGr0mzpYkIIRYny/tSvW6vrIT1Yak+VWcNTlw+1+nu7av1dax7HDVkZ3AnepD6zsHSEnoNp0zy7ZkZPJZtN7E8vEEf8Q==
KEYCLOAK_CLIENT_ID: AgB8KATkspkNplsty+H4bBjm7Ce4pxmy3/s0h0KFnO69dFj5Xwy36nJ5H7g4oTE8xQBDEPWX/YyF5/rqFGTeN5Btybk3yRRQoS+j5OyMruUOdvwthN2RQlma6IMeHp65UwIFuOrYn44w4kZBYbXM9teinH3qI/IvLs+8s5D3NxbD6TYTPcUVOxfiuI21atN35qgVCrMtWBy7w1VjcA9Trjwv3nc0fOUkKWZNNmc7S5zh/UneJJC0Wlf96x1OkYNbSm1GB6H5T80ayPDB1d5nT2598Hz1BFhsxbsqfoABQYcQIOULggMkQaAGHkgGk4lCF4U83b4m3lIb7il6W7UmANMW4ZdFUsftA3o37WUq2rfasIjHLrZuNka97SkU9ZJKm4axb5bNRz+xCxwv6FaWQTfvrI/qYUAsuFpgMPRphEyxngOoHLqyrBa2fN+ahNYyniIXBp2TmUhzfjybXt56QWwNUEDeMGesk9FTw3ssCAgu3PwrJv4REYpMKzdszuGlCd9v21XtWxnABDLIme9WxapM9AXZhWm+ftJTHbSSlHwDdJPHCulh05dLrJ63C3AtsnncyeMNl0nkMHqN51yB2cus6qeE4LL5zErK/f4fmp31HuzfAveR6zzZKJ+tXPvkg//mABaFhfMMHpvPo4oqU8wOyqKFZU6mDfA5DsYWgsMiU4kpePkaXbAUUxYw8N5CY/s7ic8+wT+lGWwO
KEYCLOAK_CLIENT_SECRET: AgAiI7KGxjFjhjSY3hYrlQ30oQ7eNE2jkaEcO3gOAQhlWMFvSu1b51rhl3htkPO5YTkAsfbC7EIZkdSTEjjF6eFUKua5Z51jbKf8wmmW3VfWky26yzzyazUJ7Sv/rAPwr4ialLUivvoYLrJECE49GasHm9mosBEuvuqpFYYmiJlSOrG9kM8RdybaZmGLiUZBUIRN1bIrC9ix7kdndaCQ8ysRVH76xQ2wpXYJU4rVn2bOJgbvR4T4q/pe6TeT/H7yUZ9ritgVPH9tFCuGK0xZ3CXFnUFwQsdsB9c0aB2jwoi2YmsK0XRasRAmu7PxsqD34xGkwtopVTvLsuKhCcN/V1x81gB/8+pW1Ox6yhQKH06GNsIruamhVxeIOXP7vt0/B93+cnZQUuFL7xt7rxnZEKq/1Ja0av/2UkxAUNYNc+kdRvLJbm8TVkWUuoWbMLUrsg3S6fItRHMG1M1t9MvdeihVlTyBThadnIfKSS3RiBKi/7Maozpa2g/ATsYX15qbDeONMgRZmo6itKGtmm6RBJpluSsGmPjBBO30oSdIV8gNEzdQuboSB86XjrDgQbGPj4Mn2aeQSEoNlxS0pjXB8/jOzp68YIh7by0LVrTA8su60oNrQCA5SVXTrO/PQJpXsC998iuohL1CvWIbxkP+GxXptwoRbrNy4lYPtxYGSCFH/rdEgPElLlHy4EMpfnVr+1NWvTWsusg6fgJXtcovXz+2aYQ42yhYVg5dS26xeX6cAg==
template:
Expand Down
4 changes: 4 additions & 0 deletions .kontinuous/env/dev/templates/app.vault.serviceaccount.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: vault
2 changes: 1 addition & 1 deletion .kontinuous/env/preprod/templates/app.sealed.secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ metadata:
name: app
spec:
encryptedData:
NEXTAUTH_SECRET: AgBdDOpKTwHKWU2g0+hGyGZpP0LC6f3sEtw1ejLkk72Rhip/Soia+/4gKzXHb938u0YE1FQsz8tntM2/mmCv6+hmtgvsE+aaNWEBqTMkOby/bbChrxhw50es06cWBK7ts0m6NGNvyNfdEWHWWrOTDmO7m/4f0oS9KAaXjeFdNlOEU8kq7Fe5W5/hdNpH7u8MF7MwWwGrQyO9QHHNp3Ojyc5i/PIEBjE4VgxnLlX/B3i+sPjymIQhI8bsd9HXwvqM3V8TK/AI5JceYodz7UkBlPipgS4Bg2ldmK8xgXkYuRrehh+sTo8faiuMwVAYmdFYJYRwhMMg04IZ4yGsHu0NxmFuVAUvQL+5ksoDoJTGjWxrwR4+LT7NiGPRma65ARpFD0iDj/n+pKODkXA/ol+2p9I4gEHzWVwECIEjKMXVuOGAfHVjklZWj6+qYY74w9yF/P+QsWsK68p2igjFb1RfXszeujAQyF25vhNB5MXCFkeuLaEyU1yNFULc6vyc0HJO1Y/8zNWXmqqDSUMlc/mGrO/TojkMKwDrfbMhIhegW0JcgcHJSpPnXpReYKp77PH8ElavbqmjVN1SXXlA1kCHX9QzERHvoIMzJFXCryOSXIVq3LkYiNeKCNJKEHpIB9exuOdwqJXBb/lnPponkZOh4JpyGgjARc6HoQsGr0mzpYkIIRYny/tSvW6vrIT1Yak+VWcNTlw+1+nu7av1dax7HDVkZ3AnepD6zsHSEnoNp0zy7ZkZPJZtN7E8vEEf8Q==
# NEXTAUTH_SECRET: AgBdDOpKTwHKWU2g0+hGyGZpP0LC6f3sEtw1ejLkk72Rhip/Soia+/4gKzXHb938u0YE1FQsz8tntM2/mmCv6+hmtgvsE+aaNWEBqTMkOby/bbChrxhw50es06cWBK7ts0m6NGNvyNfdEWHWWrOTDmO7m/4f0oS9KAaXjeFdNlOEU8kq7Fe5W5/hdNpH7u8MF7MwWwGrQyO9QHHNp3Ojyc5i/PIEBjE4VgxnLlX/B3i+sPjymIQhI8bsd9HXwvqM3V8TK/AI5JceYodz7UkBlPipgS4Bg2ldmK8xgXkYuRrehh+sTo8faiuMwVAYmdFYJYRwhMMg04IZ4yGsHu0NxmFuVAUvQL+5ksoDoJTGjWxrwR4+LT7NiGPRma65ARpFD0iDj/n+pKODkXA/ol+2p9I4gEHzWVwECIEjKMXVuOGAfHVjklZWj6+qYY74w9yF/P+QsWsK68p2igjFb1RfXszeujAQyF25vhNB5MXCFkeuLaEyU1yNFULc6vyc0HJO1Y/8zNWXmqqDSUMlc/mGrO/TojkMKwDrfbMhIhegW0JcgcHJSpPnXpReYKp77PH8ElavbqmjVN1SXXlA1kCHX9QzERHvoIMzJFXCryOSXIVq3LkYiNeKCNJKEHpIB9exuOdwqJXBb/lnPponkZOh4JpyGgjARc6HoQsGr0mzpYkIIRYny/tSvW6vrIT1Yak+VWcNTlw+1+nu7av1dax7HDVkZ3AnepD6zsHSEnoNp0zy7ZkZPJZtN7E8vEEf8Q==
KEYCLOAK_CLIENT_ID: AgB8KATkspkNplsty+H4bBjm7Ce4pxmy3/s0h0KFnO69dFj5Xwy36nJ5H7g4oTE8xQBDEPWX/YyF5/rqFGTeN5Btybk3yRRQoS+j5OyMruUOdvwthN2RQlma6IMeHp65UwIFuOrYn44w4kZBYbXM9teinH3qI/IvLs+8s5D3NxbD6TYTPcUVOxfiuI21atN35qgVCrMtWBy7w1VjcA9Trjwv3nc0fOUkKWZNNmc7S5zh/UneJJC0Wlf96x1OkYNbSm1GB6H5T80ayPDB1d5nT2598Hz1BFhsxbsqfoABQYcQIOULggMkQaAGHkgGk4lCF4U83b4m3lIb7il6W7UmANMW4ZdFUsftA3o37WUq2rfasIjHLrZuNka97SkU9ZJKm4axb5bNRz+xCxwv6FaWQTfvrI/qYUAsuFpgMPRphEyxngOoHLqyrBa2fN+ahNYyniIXBp2TmUhzfjybXt56QWwNUEDeMGesk9FTw3ssCAgu3PwrJv4REYpMKzdszuGlCd9v21XtWxnABDLIme9WxapM9AXZhWm+ftJTHbSSlHwDdJPHCulh05dLrJ63C3AtsnncyeMNl0nkMHqN51yB2cus6qeE4LL5zErK/f4fmp31HuzfAveR6zzZKJ+tXPvkg//mABaFhfMMHpvPo4oqU8wOyqKFZU6mDfA5DsYWgsMiU4kpePkaXbAUUxYw8N5CY/s7ic8+wT+lGWwO
KEYCLOAK_CLIENT_SECRET: AgAiI7KGxjFjhjSY3hYrlQ30oQ7eNE2jkaEcO3gOAQhlWMFvSu1b51rhl3htkPO5YTkAsfbC7EIZkdSTEjjF6eFUKua5Z51jbKf8wmmW3VfWky26yzzyazUJ7Sv/rAPwr4ialLUivvoYLrJECE49GasHm9mosBEuvuqpFYYmiJlSOrG9kM8RdybaZmGLiUZBUIRN1bIrC9ix7kdndaCQ8ysRVH76xQ2wpXYJU4rVn2bOJgbvR4T4q/pe6TeT/H7yUZ9ritgVPH9tFCuGK0xZ3CXFnUFwQsdsB9c0aB2jwoi2YmsK0XRasRAmu7PxsqD34xGkwtopVTvLsuKhCcN/V1x81gB/8+pW1Ox6yhQKH06GNsIruamhVxeIOXP7vt0/B93+cnZQUuFL7xt7rxnZEKq/1Ja0av/2UkxAUNYNc+kdRvLJbm8TVkWUuoWbMLUrsg3S6fItRHMG1M1t9MvdeihVlTyBThadnIfKSS3RiBKi/7Maozpa2g/ATsYX15qbDeONMgRZmo6itKGtmm6RBJpluSsGmPjBBO30oSdIV8gNEzdQuboSB86XjrDgQbGPj4Mn2aeQSEoNlxS0pjXB8/jOzp68YIh7by0LVrTA8su60oNrQCA5SVXTrO/PQJpXsC998iuohL1CvWIbxkP+GxXptwoRbrNy4lYPtxYGSCFH/rdEgPElLlHy4EMpfnVr+1NWvTWsusg6fgJXtcovXz+2aYQ42yhYVg5dS26xeX6cAg==
template:
Expand Down
35 changes: 35 additions & 0 deletions .kontinuous/patches/secrets.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
/*
Patch manifests
*/
module.exports = (manifests) => {
for (const manifest of manifests) {
const { kind } = manifest;
if (kind === "Deployment" && manifest.metadata.name === "app") {
manifest.spec.template.metadata.annotations = {
...manifest.spec.template.metadata.annotations,
"vault.hashicorp.com/service": "http://vault.vault-dev.svc:8200",
"vault.hashicorp.com/agent-inject": "true",
"vault.hashicorp.com/role": "dev",
"vault.hashicorp.com/agent-inject-secret-nextauth": 'kv/data/dev/nextauth_secret',
"vault.hashicorp.com/agent-inject-secret-keycloak_client_id": 'kv/data/dev/keycloak_client_id',
"vault.hashicorp.com/agent-inject-secret-keycloak_client_secret": 'kv/data/dev/keycloak_client_secret',
"vault.hashicorp.com/agent-inject-template-dev": '\
{{- with secret "kv/dev/nextauth_secret" -}} \
{{- range $key, $value := .Data.data }} \
export {{ $key | upper }}={{ $value }} \
{{- end }} \
{{- end }}'
};
manifest.spec.template.spec = {
...manifest.spec.template.spec,
serviceAccountName: "vault"
};
manifest.spec.template.spec.containers[0] = {
...manifest.spec.template.spec.containers[0],
command: ['sh', '-c'],
args: ['source /vault/secrets/dev && yarn start']
}
}
}
return manifests;
};
9 changes: 6 additions & 3 deletions .kontinuous/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,7 @@ app:
annotations:
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"


jobs:
runs:
build-app:
Expand All @@ -65,7 +66,6 @@ jobs:

build-hasura:
use: build
~needs: [build-app]
with:
imagePackage: hasura
registrySecretRefName: harbor
Expand All @@ -87,7 +87,9 @@ hasura:
- name: HASURA_GRAPHQL_UNAUTHORIZED_ROLE
value: anonymous
- name: HASURA_GRAPHQL_JWT_SECRET
value: '{"jwk_url": "http://keycloakx-http:8080/realms/app-realm/protocol/openid-connect/certs"}'
value:
'{"jwk_url":
"http://keycloakx-http:8080/realms/app-realm/protocol/openid-connect/certs"}'
envFrom:
- secretRef:
name: pg-hasura-app
Expand Down Expand Up @@ -137,7 +139,8 @@ keycloakx:
statefulsetAnnotations:
kapp.k14s.io/nonce: ""
kapp.k14s.io/update-strategy: fallback-on-replace
kapp.k14s.io/change-group.keycloakx: "kontinuous/keycloakx.{{ .Values.global.namespace }}"
kapp.k14s.io/change-group.keycloakx:
"kontinuous/keycloakx.{{ .Values.global.namespace }}"
kapp.k14s.io/disable-original: ""
kapp.k14s.io/create-strategy: fallback-on-update

Expand Down
2 changes: 1 addition & 1 deletion src/pages/index.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ const Home: NextPage = () => {
<div className="fr-grid-row fr-grid-row--center fr-grid-row--middle fr-mb-8w fr-mt-8w">
<div className="fr-col-12 fr-col-md-6">
<h1>
Template
POC VAULT v0
<span className="fr-text--lead d-block fr-mt-3w">
<p>Template de la fabrique des ministères sociaux.</p>
</span>
Expand Down