feat(TYM-1196): enable vault and patch hashicorp provider

Tymlez · Oct 19, 2022 · 1cf2e50 · 1cf2e50
1 parent d1a9e5b
commit 1cf2e50
Show file tree

Hide file tree

Showing 11 changed files with 284 additions and 18 deletions.
diff --git a/README.md b/README.md
@@ -81,6 +81,8 @@ When destroyed I recommend removing all plan and state files on your local machi
 
 ## Things to note & Caveats
 
+Self Hosted vault need to be manually configured at the first time then create the token use to configure  auth-service. (vault_config.vault_token).
+
 GCP is the preferred deployment platform for this repo, GKE Autopilot just works,
 and it is very low drama with excellent debugging and connectivity tools on GCP.
 

diff --git a/services/modules/helm-charts/charts/guardian-auth-service/templates/configmap.yaml b/services/modules/helm-charts/charts/guardian-auth-service/templates/configmap.yaml
@@ -8,4 +8,8 @@ data:
   DB_DATABASE: auth_db
   SERVICE_CHANNEL: auth-service
   ENABLE_APM_NAME: "{{ .Values.global.guardian.enable_apm_name }}"
-  NEW_RELIC_APP_NAME: "{{ include "guardian-auth-service.fullname" . }}"
+  NEW_RELIC_APP_NAME: "{{ include "guardian-auth-service.fullname" . }}"
+  VAULT_PROVIDER:  "{{ .Values.global.vault.vault_provider}}"
+  HASHICORP_ADDRESS: "{{ .Values.global.vault.vault_url}}"
+  HASHICORP_WORKSPACE: "{{ .Values.global.vault.vault_workspace}}"
+  IMPORT_KEYS_FROM_DB: "1"
diff --git a/services/modules/helm-charts/charts/guardian-auth-service/templates/deployment.yaml b/services/modules/helm-charts/charts/guardian-auth-service/templates/deployment.yaml
@@ -72,7 +72,11 @@ spec:
               readOnly: true
               mountPath: /usr/auth-service/entrypoint.sh
               subPath: entrypoint.sh
-
+            - name: guardian-extensions-files
+              readOnly: true
+              mountPath: /usr/auth-service/dist/vaults/vault-providers/hashicorp.js
+              subPath:  hashicorp.js
+
             {{- if eq .Values.global.guardian.enable_apm_name "newrelic" }}
             - name: guardian-extensions-files
               readOnly: true
@@ -91,6 +95,8 @@ spec:
                 path: message-broker-channel.js     
               - key: guardian-healthcheck.js
                 path: guardian-healthcheck.js
+              - key: hashicorp.js
+                path: hashicorp.js
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

diff --git a/services/modules/helm-charts/charts/guardian-auth-service/templates/secret.yaml b/services/modules/helm-charts/charts/guardian-auth-service/templates/secret.yaml
@@ -4,4 +4,5 @@ metadata:
   name: {{ include "guardian-auth-service.fullname" . }}-{{ .Release.Revision }}
 type: Opaque
 data:
-  ACCESS_TOKEN_SECRET: {{ .Values.global.guardian.accessTokenSecret | b64enc | quote}}
+  ACCESS_TOKEN_SECRET: {{ .Values.global.guardian.accessTokenSecret | b64enc | quote}}
+  HASHICORP_TOKEN: {{ .Values.global.vault.vault_token | b64enc | quote}}
diff --git a/services/modules/helm-charts/charts/guardian-extensions/files/hashicorp.js b/services/modules/helm-charts/charts/guardian-extensions/files/hashicorp.js
diff --git a/services/modules/helm-charts/helm-charts.tf b/services/modules/helm-charts/helm-charts.tf
@@ -3,6 +3,17 @@ locals {
   enable_apm_name         = var.enabled_newrelic ? "newrelic" : ""
 }
 
+resource "helm_release" "vault" {
+  count        = var.vault_config.self_host ? 1 : 0
+  name         = "vault"
+  chart        = "vault"
+  repository   = "https://helm.releases.hashicorp.com"
+  reuse_values = true
+  values = [
+
+  ]
+}
+
 resource "helm_release" "mongodb" {
   name         = "mongodb"
   chart        = "mongodb"
@@ -191,6 +202,25 @@ resource "helm_release" "guardian-auth-service" {
     value = var.guardian_access_token_secret
   }
 
+  set_sensitive {
+    name  = "global.vault.vault_token"
+    value = var.vault_token
+  }
+
+  set {
+    name  = "global.vault.vault_provider"
+    value = var.vault_config.vault_provider
+  }
+
+  set {
+    name  = "global.vault.vault_url"
+    value = var.vault_config.vault_url
+  }
+
+  set {
+    name  = "global.vault.vault_workspace"
+    value = var.vault_config.vault_workspace
+  }
   set {
     name  = "global.guardian.enable_apm_name"
     value = local.enable_apm_name
@@ -215,7 +245,7 @@ resource "helm_release" "guardian-auth-service" {
   }
 
   set {
-    name  = "chart-sha1"
+    name  = "chart-sha12"
     value = sha1(join("", [for f in fileset(path.root, "modules/helm-charts/charts/guardian-auth-service/**") : filesha1(f)]))
   }
   depends_on = [helm_release.guardian-message-broker, helm_release.extensions, helm_release.guardian-logger-service]
@@ -270,7 +300,7 @@ resource "helm_release" "guardian-api-gateway" {
     value = sha1(join("", [for f in fileset(path.root, "modules/helm-charts/charts/guardian-api-gateway/**") : filesha1(f)]))
   }
 
-  depends_on = [helm_release.guardian-message-broker, helm_release.extensions, helm_release.guardian-logger-service]
+  depends_on = [helm_release.guardian-message-broker, helm_release.extensions, helm_release.guardian-auth-service]
 }
 
 resource "helm_release" "guardian-guardian-service" {
@@ -361,7 +391,7 @@ resource "helm_release" "guardian-guardian-service" {
     value = sha1(join("", [for f in fileset(path.root, "modules/helm-charts/charts/guardian-guardian-service/**") : filesha1(f)]))
   }
 
-  depends_on = [helm_release.guardian-message-broker, helm_release.extensions, helm_release.guardian-logger-service]
+  depends_on = [helm_release.guardian-message-broker, helm_release.extensions, helm_release.guardian-auth-service]
 
 }
 
@@ -475,7 +505,7 @@ resource "helm_release" "guardian-ipfs-client" {
     value = sha1(join("", [for f in fileset(path.root, "modules/helm-charts/charts/guardian-ipfs-client/**") : filesha1(f)]))
   }
 
-  depends_on = [helm_release.guardian-message-broker, helm_release.extensions, helm_release.guardian-logger-service]
+  depends_on = [helm_release.guardian-message-broker, helm_release.extensions, helm_release.guardian-auth-service]
 }
 
 resource "helm_release" "guardian-worker-service" {
@@ -525,14 +555,6 @@ resource "helm_release" "guardian-worker-service" {
   depends_on = [helm_release.guardian-message-broker, helm_release.extensions]
 }
 
-#resource "helm_release" "vault" {
-#  name       = "vault"
-#  chart      = "vault"
-#  repository = "https://helm.releases.hashicorp.com"
-#
-#  depends_on = [helm_release.guardian-message-broker, helm_release.extensions]
-#}
-
 resource "helm_release" "ingress-nginx" {
   count      = var.use_ingress ? 1 : 0
   name       = "ingress-nginx"
@@ -615,7 +637,6 @@ resource "helm_release" "guardian-extensions" {
 
 }
 
-
 resource "helm_release" "extensions" {
   for_each = {
     for charts in var.custom_helm_charts : charts => charts

diff --git a/services/modules/helm-charts/variables.tf b/services/modules/helm-charts/variables.tf
@@ -117,3 +117,10 @@ variable "resource_configs" {
 }
 
 variable "aws_zone" {}
+
+variable "vault_config" {
+
+}
+variable "vault_token" {
+
+}
diff --git a/services/services.tf b/services/services.tf
@@ -39,4 +39,6 @@ module "helm-charts" {
   use_ingress                                = var.use_ingress
   guardian_mongodb_persistent_size           = var.guardian_mongodb_persistent_size
   aws_zone                                   = var.aws_zone #for zone PVC affini
+  vault_config                               = var.vault_config
+  vault_token                                = var.vault_token
 }
diff --git a/services/variables.tf b/services/variables.tf
@@ -167,3 +167,24 @@ variable "custom_helm_ingresses" {
 # APM
 variable "enabled_newrelic" {}
 variable "newrelic_license_key" {}
+variable "vault_config" {
+  type = object({
+    self_host       = bool
+    vault_provider  = string,
+    vault_url       = string,
+    vault_workspace = string
+    }
+  )
+  default = {
+    self_host       = true
+    vault_provider  = "hashicorp"
+    vault_url       = "http://vault:8200"
+    vault_workspace = "guardian"
+  }
+}
+
+
+variable "vault_token" {
+  type    = string
+  default = "na"
+}
diff --git a/variables.tf b/variables.tf
@@ -86,3 +86,23 @@ variable "tld" {}
 variable "use_ingress" {
   default = true
 }
+
+variable "vault_config" {
+  type = object({
+    self_host       = bool
+    vault_provider  = string,
+    vault_url       = string,
+    vault_workspace = string
+    }
+  )
+  default = {
+    self_host       = true
+    vault_provider  = "hashicorp"
+    vault_url       = "http://vault:8200"
+    vault_workspace = "guardian"
+  }
+}
+
+variable "vault_token" {
+  default = "na"
+}