Support TLS with Vault for the client snapshot agent deployment #891
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ishustava
requested review from
kschoche,
a team and
t-eckert
and removed request for
a team
kschoche
reviewed
Dec 3, 2021
Comment on lines
+34
to
+35
| "vault.hashicorp.com/agent-inject-secret-serverca": {{ .Values.global.tls.caCert.secretName }} | ||
| "vault.hashicorp.com/agent-inject-template-serverca": {{ template "consul.serverTLSCATemplate" . }} |
There was a problem hiding this comment.
I think we can fix this once the base Server-TLS PR is merged, but the annotation changed slightly like so based on a couple comments in the Server-TLS PR!
Suggested change
| "vault.hashicorp.com/agent-inject-secret-serverca": {{ .Values.global.tls.caCert.secretName }} | |
| "vault.hashicorp.com/agent-inject-template-serverca": {{ template "consul.serverTLSCATemplate" . }} | |
| "vault.hashicorp.com/agent-inject-secret-serverca.crt": {{ .Values.global.tls.caCert.secretName }} | |
| "vault.hashicorp.com/agent-inject-template-serverca.crt": {{ template "consul.serverTLSCATemplate" . }} |
kschoche
reviewed
Dec 3, 2021
| . | tee /dev/stderr | | ||
| yq -r '.spec.template' | tee /dev/stderr) | ||
|
|
||
| # Check annotations |
There was a problem hiding this comment.
I love these comments and we should make them standard practice going forward :)
t-eckert
approved these changes
Dec 6, 2021
kschoche
pushed a commit
that referenced
this pull request
Dec 6, 2021
* Support server TLS with vault for the server-acl-init job * Support server TLS with vault for the sync catalog * Support server TLS with vault for the client snapshot agent deployment (#891)
kschoche
added a commit
that referenced
this pull request
Dec 7, 2021
* Support Vault server running with TLS (#874) * Change vault cluster in acceptance tests to only run with TLS. All tests will run against vault with TLS because that is the use case we think will be the most valuable for users to test * Support adding Vault CA as a secret to pods that will be using vault agent. We need to add two annotations to pods: * vault.hashicorp.com/agent-extra-secret with the value of the vault CA secret name. The secret will be mounted to vault agent at /vault/custom path. See docs here * vault.hashicorp.com/ca-cert - with the path of the ca file inside the vault agent container. This should be /vault/custom/<secret key> * Most pods will only need those annotations. The server pods also need the Vault CA secret to be mounted as a volume because it needs the CA to be on the file system for the vault connect CA provider. * add terminating and ingress gateways TLS support (#894) * Support TLS with vault for the server-acl-init job (#889) * Support TLS with Vault for the sync catalog deployment (#890) * Support server TLS with vault for the client snapshot agent deployment (#891) Co-authored-by: Iryna Shustava <iryna@hashicorp.com> Co-authored-by: Luke Kysow <1034429+lkysow@users.noreply.github.com>
rrondeau
pushed a commit
to rrondeau/consul-k8s
that referenced
this pull request
Dec 21, 2021
…rypt (hashicorp#891) Use consul-ca-cert when sync-catalog is enabled and autoencrypt is enabled but clients are disabled.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes proposed in this PR:
How I've tested this PR:
manually
How I expect reviewers to test this PR:
code review
Checklist: