Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix Vault installation for setup without K8s #1766

Merged
merged 2 commits into from
Oct 14, 2020
Merged

Fix Vault installation for setup without K8s #1766

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
20ff45f
Install Vault on first master
to-bar Oct 9, 2020
6dc4d5a
Update changelog
to-bar Oct 14, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions CHANGELOG-0.8.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,11 @@
# Changelog 0.8

## [0.8.0] 2020-10-XX

### Fixed

- [#1754](https://github.com/epiphany-platform/epiphany/issues/1754) - Fix Vault installation for setup without K8s

## [0.8.0rc1] 2020-10-08

### Added
Expand Down
7 changes: 1 addition & 6 deletions core/src/epicli/data/common/ansible/playbooks/roles/vault/tasks/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,12 +34,7 @@
dest: /tmp/vault_helm_chart_values.yaml
when: vault_helm_chart_values_bool

- name: Install and configure Hashicorp Vault if enabled and no cloud service is used
when:
- specification.vault_enabled
- k8s_as_cloud_service is defined
- not k8s_as_cloud_service
- groups.kubernetes_master | length == 1
- name: Install and configure Hashicorp Vault
block:
- name: Create Vault system group
group:
Expand Down
2 changes: 1 addition & 1 deletion ...ata/common/ansible/playbooks/roles/vault/templates/kubernetes/vault-default-policy.yml.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ spec:
- Egress
egress:
- to:
{% for server in groups['vault'] %}- ipBlock:
{% for server in ansible_play_hosts_all %}- ipBlock:
cidr: {{ hostvars[server]['ansible_default_ipv4']['address'] }}/32
{% endfor %}ports:
- protocol: TCP
Expand Down
12 changes: 10 additions & 2 deletions core/src/epicli/data/common/ansible/playbooks/vault.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,15 @@
---
# Ansible playbook that installs Hashicorp Vault
- hosts: vault
# Installing Vault on multi-master K8s is not supported so install only on the first host
- hosts: >-
{{ 'vault[0]' if (groups.kubernetes_master is defined and
groups.vault is defined and
groups.vault | intersect(groups.kubernetes_master)) else
'vault' }}
become: true
become_method: sudo
roles:
- vault
- role: vault
when:
- specification.vault_enabled
- k8s_as_cloud_service is undefined or not k8s_as_cloud_service
2 changes: 1 addition & 1 deletion docs/home/howto/SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -379,7 +379,7 @@ that right now can be configured manually according to Hashicorp Vault [document

At the moment only installation on Kubernetes Master is supported, but we are also planning separate installation with no
other components. Also at this moment we are not providing clustered option for Vault deployment, but this will be part
of the future releases. For multi-master (HA) Kubernetes, Vault is not installed.
of the future releases. For multi-master (HA) Kubernetes, Vault is installed only on the first master defined in Ansible inventory.

Below you can find sample configuration for Vault with description of all options.

Expand Down