vault: add support for wan federation with Vault when ACLs are enabled #1025
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ishustava
force-pushed
the
ishustava/vault-wan-fed
branch
from
bf10149 to
1c03ab2
Compare
ishustava
commented
Feb 9, 2022
.circleci/config.yml
Outdated
| @@ -70,7 +70,7 @@ commands: | |||
| type: string | |||
| consul-k8s-image: | |||
| type: string | |||
| default: "docker.mirror.hashicorp.services/hashicorpdev/consul-k8s-control-plane:latest" | |||
| default: "ishustava/consul-k8s-dev:02-08-2022-d21554d8" | |||
There was a problem hiding this comment.
todo: remove before merging
ishustava
commented
Feb 9, 2022
| @@ -4,7 +4,9 @@ | |||
| {{- if and .Values.global.acls.createReplicationToken (not .Values.global.acls.manageSystemACLs) }}{{ fail "if global.acls.createReplicationToken is true, global.acls.manageSystemACLs must be true" }}{{ end -}} | |||
| {{- if .Values.global.bootstrapACLs }}{{ fail "global.bootstrapACLs was removed, use global.acls.manageSystemACLs instead" }}{{ end -}} | |||
| {{- if .Values.global.acls.manageSystemACLs }} | |||
| {{- /* We don't render this job when server.updatePartition > 0 because that | |||
| {{- if and .Values.global.secretsBackend.vault.enabled .Values.global.acls.replicationToken.secretName (not .Values.global.secretsBackend.vault.manageSystemACLsRole) }}{{ fail "global.secretsBackend.vault.manageSystemACLsRole must be set if global.secretsBackend.vault.enabled is true and global.acls.replicationToken is provided" }}{{ end -}} | |||
| {{- if or (and .Values.global.acls.replicationToken.secretName (not .Values.global.acls.replicationToken.secretKey)) (and .Values.global.acls.replicationToken.secretKey (not .Values.global.acls.replicationToken.secretName))}}{{ fail "both global.acls.replicationToken.secretKey and global.acls.replicationToken.secretName must be set if one of them is provided" }}{{ end -}} | |||
There was a problem hiding this comment.
This simplifies logic and testing across our templates since we don't have to test for the combinations when replication token secret name is provided but not secret key and vice versa.
ishustava
force-pushed
the
ishustava/vault-wan-fed-acls
branch
3 times, most recently
from
fe6b041 to
55a28c6
Compare
ishustava
force-pushed
the
ishustava/vault-wan-fed
branch
from
1c03ab2 to
b342d8c
Compare
ishustava
force-pushed
the
ishustava/vault-wan-fed-acls
branch
from
55a28c6 to
9ae1d33
Compare
ishustava
force-pushed
the
ishustava/vault-wan-fed
branch
from
b342d8c to
64cb04f
Compare
ishustava
changed the title
ishustava
force-pushed
the
ishustava/vault-wan-fed-acls
branch
2 times, most recently
from
13c9839 to
ec7e05e
Compare
ishustava
requested review from
a team,
kschoche and
t-eckert
and removed request for
a team
ishustava
force-pushed
the
ishustava/vault-wan-fed
branch
from
64cb04f to
d1c08cd
Compare
kschoche
reviewed
Feb 16, 2022
| @@ -75,6 +75,10 @@ spec: | |||
| "vault.hashicorp.com/agent-inject-secret-serverca.crt": {{ .Values.global.tls.caCert.secretName }} | |||
| "vault.hashicorp.com/agent-inject-template-serverca.crt": {{ include "consul.serverTLSCATemplate" . }} | |||
| {{- end }} | |||
| {{- if (and .Values.global.acls.replicationToken.secretName (not .Values.global.acls.createReplicationToken)) }} | |||
| "vault.hashicorp.com/agent-inject-secret-replication-token-config.hcl": "{{ .Values.global.acls.replicationToken.secretName }}" | |||
| "vault.hashicorp.com/agent-inject-template-replication-token-config.hcl": {{ template "consul.vaultReplicationTokenConfigTemplate" . }} | |||
ishustava
force-pushed
the
ishustava/vault-wan-fed-acls
branch
2 times, most recently
from
8e0e4e3 to
3f5383c
Compare
t-eckert
reviewed
Feb 17, 2022
| @@ -51,7 +51,7 @@ func NewCLICluster( | |||
| ctx environment.TestContext, | |||
| cfg *config.TestConfig, | |||
| releaseName string, | |||
| ) Cluster { | |||
| ) *CLICluster { | |||
t-eckert
reviewed
Feb 17, 2022
ishustava
force-pushed
the
ishustava/vault-wan-fed-acls
branch
from
3f5383c to
43f6307
Compare
t-eckert
approved these changes
Feb 17, 2022
geobeau
pushed a commit
to geobeau/consul-k8s
that referenced
this pull request
May 20, 2022
hashicorp#1025) * Revamp issue template and provide verbiage on +1 for tracking interest
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes proposed in this PR:
How I've tested this PR:
acceptance tests
How I expect reviewers to test this PR:
👀
Checklist: