diff --git a/.dockerignore b/.dockerignore index cb98ac78..b37722de 100644 --- a/.dockerignore +++ b/.dockerignore @@ -1,4 +1,6 @@ Dockerfile +/.devenv/ +/.direnv/ /.github/ /bin/ build/ diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 7005516c..4c835cd3 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -161,6 +161,42 @@ jobs: - name: Dependency Review uses: actions/dependency-review-action@1360a344ccb0ab6e9475edef90ad2f46bf8003b1 # v3.0.6 + e2e-test: + name: E2E test + runs-on: ubuntu-latest + needs: [artifacts] + strategy: + matrix: + k8s_version: ["v1.24.13", "v1.25.9", "v1.26.4", "v1.27.1" ] + # vault_version: ["1.10.11", "1.11.10", "1.12.6", "1.13.2"] + + steps: + - name: Checkout repository + uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 + + - name: Set up Nix + uses: cachix/install-nix-action@4b933aa7ebcc94a6174cf1364864e957b4910265 # v21 + with: + extra_nix_config: | + access-tokens = github.com=${{ secrets.GITHUB_TOKEN }} + + - name: Prepare Nix shell + run: nix develop --impure .#ci + + - name: Download operator docker image + uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 + with: + name: "[container-image] Docker tarball" + + - name: Test + run: nix develop --impure .#ci -c make test-e2e + env: + KIND_K8S_VERSION: ${{ matrix.k8s_version }} + LOAD_IMAGE_ARCHIVE: ${{ github.workspace }}/docker.tar + # VAULT_VERSION: ${{ matrix.vault_version }} + WEBHOOK_VERSION: ${{ needs.artifacts.outputs.container-image-tag }} + LOG_VERBOSE: "true" + acceptance-test: name: Acceptance test runs-on: ubuntu-latest diff --git a/Makefile b/Makefile index 1b72543a..1ac5197f 100644 --- a/Makefile +++ b/Makefile @@ -2,6 +2,8 @@ export PATH := $(abspath bin/):${PATH} +CONTAINER_IMAGE_REF = ghcr.io/bank-vaults/vault-secrets-webhook:dev + # Dependency versions GOLANGCI_VERSION = 1.53.1 LICENSEI_VERSION = 0.8.0 @@ -52,7 +54,7 @@ artifacts: ## Build artifacts .PHONY: container-image container-image: ## Build container image - docker build . + docker build -t ${CONTAINER_IMAGE_REF} . .PHONY: check check: test lint ## Run checks (tests and linters) @@ -65,6 +67,14 @@ test: ## Run tests test-acceptance: ## Run acceptance tests go test -race -v -timeout 900s -tags kubeall ./test +.PHONY: test-e2e +test-e2e: ## Run e2e tests + go test -race -v -timeout 900s -tags e2e ./e2e/ + +.PHONY: test-e2e-local +test-e2e-local: container-image ## Run e2e tests locally + LOAD_IMAGE=${CONTAINER_IMAGE_REF} WEBHOOK_VERSION=dev ${MAKE} test-e2e + .PHONY: lint lint: ## Run linter golangci-lint run ${LINT_ARGS} diff --git a/charts/vault-secrets-webhook/templates/_helpers.tpl b/charts/vault-secrets-webhook/templates/_helpers.tpl index d5e4b6d8..12d43133 100644 --- a/charts/vault-secrets-webhook/templates/_helpers.tpl +++ b/charts/vault-secrets-webhook/templates/_helpers.tpl @@ -57,9 +57,6 @@ Overrideable version for container image tags. {{- define "vault-secrets-webhook.bank-vaults.version" -}} {{- .Values.image.tag | default (printf "%s" .Chart.AppVersion) -}} {{- end -}} -{{- define "vault-secrets-webhook.vault-env.version" -}} -{{- .Values.vaultEnv.tag | default (printf "%s" .Chart.AppVersion) -}} -{{- end -}} {{/* Create the name of the service account to use diff --git a/charts/vault-secrets-webhook/templates/webhook-deployment.yaml b/charts/vault-secrets-webhook/templates/webhook-deployment.yaml index 2f6a46bf..b33236b6 100644 --- a/charts/vault-secrets-webhook/templates/webhook-deployment.yaml +++ b/charts/vault-secrets-webhook/templates/webhook-deployment.yaml @@ -80,7 +80,7 @@ spec: value: "debug" {{- end }} - name: VAULT_ENV_IMAGE - value: "{{ .Values.vaultEnv.repository }}:{{ include "vault-secrets-webhook.vault-env.version" . }}" + value: "{{ .Values.vaultEnv.repository }}:{{ .Values.vaultEnv.tag }}" {{- range $key, $value := .Values.env }} - name: {{ $key }} value: {{ $value | quote }} diff --git a/charts/vault-secrets-webhook/values.yaml b/charts/vault-secrets-webhook/values.yaml index cbbcc098..b9ca4d2b 100644 --- a/charts/vault-secrets-webhook/values.yaml +++ b/charts/vault-secrets-webhook/values.yaml @@ -49,10 +49,10 @@ webhookClientConfig: vaultEnv: repository: ghcr.io/bank-vaults/vault-env - # tag: "" + tag: "v1.20.1" env: - VAULT_IMAGE: vault:1.6.2 + VAULT_IMAGE: vault:1.13.2 # VAULT_CAPATH: /vault/tls # # Used when the pod that should get secret injected does not # # specify an imagePullSecret diff --git a/e2e/deploy/vault-secrets-webhook/values.yaml b/e2e/deploy/vault-secrets-webhook/values.yaml new file mode 100644 index 00000000..674c1126 --- /dev/null +++ b/e2e/deploy/vault-secrets-webhook/values.yaml @@ -0,0 +1,12 @@ +replicaCount: 1 + +image: + pullPolicy: Never + +configMapMutation: true +configmapFailurePolicy: "Fail" +podsFailurePolicy: "Fail" +secretsFailurePolicy: "Fail" + +env: + VAULT_IMAGE: vault:1.13.2 diff --git a/e2e/deploy/vault/rbac.yaml b/e2e/deploy/vault/rbac.yaml new file mode 100644 index 00000000..235cc0d2 --- /dev/null +++ b/e2e/deploy/vault/rbac.yaml @@ -0,0 +1,46 @@ +kind: ServiceAccount +apiVersion: v1 +metadata: + name: vault + +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: vault +rules: + - apiGroups: [""] + resources: ["secrets"] + verbs: ["*"] + - apiGroups: [""] + resources: ["pods"] + verbs: ["get", "update", "patch"] + +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: vault +roleRef: + kind: Role + name: vault + apiGroup: rbac.authorization.k8s.io +subjects: + - kind: ServiceAccount + name: vault + +--- +# This binding allows the deployed Vault instance to authenticate clients +# through Kubernetes ServiceAccounts (if configured so). +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: vault-auth-delegator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: system:auth-delegator +subjects: + - kind: ServiceAccount + name: vault + namespace: default diff --git a/e2e/deploy/vault/vault.yaml b/e2e/deploy/vault/vault.yaml new file mode 100644 index 00000000..6cd91d38 --- /dev/null +++ b/e2e/deploy/vault/vault.yaml @@ -0,0 +1,172 @@ +apiVersion: "vault.banzaicloud.com/v1alpha1" +kind: "Vault" +metadata: + name: "vault" +spec: + size: 1 + image: vault:1.13.2 + + # Specify the ServiceAccount where the Vault Pod and the Bank-Vaults configurer/unsealer is running + serviceAccount: vault + + # Specify the Service's type where the Vault Service is exposed + # Please note that some Ingress controllers like https://github.com/kubernetes/ingress-gce + # forces you to expose your Service on a NodePort + serviceType: ClusterIP + + # Use local disk to store Vault file data, see config section. + volumes: + - name: vault-file + persistentVolumeClaim: + claimName: vault-file + + volumeMounts: + - name: vault-file + mountPath: /vault/file + + # Support for distributing the generated CA certificate Secret to other namespaces. + # Define a list of namespaces or use ["*"] for all namespaces. + caNamespaces: + - "vault-secrets-webhook" + + # Describe where you would like to store the Vault unseal keys and root token. + unsealConfig: + options: + # The preFlightChecks flag enables unseal and root token storage tests + # This is true by default + preFlightChecks: true + # The storeRootToken flag enables storing of root token in chosen storage + # This is true by default + storeRootToken: true + kubernetes: + secretNamespace: default + + # A YAML representation of a final vault config file. + # See https://www.vaultproject.io/docs/configuration/ for more information. + config: + storage: + file: + path: "${ .Env.VAULT_STORAGE_FILE }" # An example how Vault config environment interpolation can be used + listener: + tcp: + address: "0.0.0.0:8200" + # Uncommenting the following line and deleting tls_cert_file and tls_key_file disables TLS + # tls_disable: true + tls_cert_file: /vault/tls/server.crt + tls_key_file: /vault/tls/server.key + telemetry: + statsd_address: localhost:9125 + ui: true + + # See: https://banzaicloud.com/docs/bank-vaults/cli-tool/#example-external-vault-configuration + # The repository also contains a lot examples in the test/deploy and operator/deploy directories. + externalConfig: + policies: + - name: allow_secrets + rules: path "secret/*" { + capabilities = ["create", "read", "update", "delete", "list"] + } + - name: allow_pki + rules: path "pki/*" { + capabilities = ["create", "read", "update", "delete", "list"] + } + + groups: + - name: admin1 + policies: + - allow_secrets + metadata: + privileged: true + type: external + - name: admin2 + policies: + - allow_secrets + metadata: + privileged: true + type: external + + group-aliases: + - name: admin1 + mountpath: token + group: admin1 + + + auth: + - type: kubernetes + roles: + # Allow every pod in the default namespace to use the secret kv store + - name: default + bound_service_account_names: ["default", "vault-secrets-webhook", "vault"] + bound_service_account_namespaces: ["default", "vault-secrets-webhook"] + policies: ["allow_secrets", "allow_pki"] + ttl: 1h + + secrets: + - path: secret + type: kv + description: General secrets. + options: + version: 2 + + - path: pki + type: pki + description: Vault PKI Backend + config: + default_lease_ttl: 168h + max_lease_ttl: 720h + configuration: + config: + - name: urls + issuing_certificates: https://vault.default:8200/v1/pki/ca + crl_distribution_points: https://vault.default:8200/v1/pki/crl + root/generate: + - name: internal + common_name: vault.default + roles: + - name: default + allowed_domains: localhost,pod,svc,default + allow_subdomains: true + generate_lease: true + ttl: 1m + + # Allows writing some secrets to Vault (useful for development purposes). + # See https://www.vaultproject.io/docs/secrets/kv/index.html for more information. + startupSecrets: + - type: kv + path: secret/data/accounts/aws + data: + data: + AWS_ACCESS_KEY_ID: secretId + AWS_SECRET_ACCESS_KEY: s3cr3t + - type: kv + path: secret/data/dockerrepo + data: + data: + DOCKER_REPO_USER: dockerrepouser + DOCKER_REPO_PASSWORD: dockerrepopassword + - type: kv + path: secret/data/mysql + data: + data: + MYSQL_ROOT_PASSWORD: s3cr3t + MYSQL_PASSWORD: 3xtr3ms3cr3t + + vaultEnvsConfig: + - name: VAULT_LOG_LEVEL + value: debug + - name: VAULT_STORAGE_FILE + value: "/vault/file" + +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: vault-file +spec: + # https://kubernetes.io/docs/concepts/storage/persistent-volumes/#class-1 + # storageClassName: "" + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi diff --git a/e2e/kind.yaml b/e2e/kind.yaml new file mode 100644 index 00000000..18eb9ae2 --- /dev/null +++ b/e2e/kind.yaml @@ -0,0 +1,2 @@ +kind: Cluster +apiVersion: kind.x-k8s.io/v1alpha4 diff --git a/e2e/main_test.go b/e2e/main_test.go new file mode 100644 index 00000000..d0675af3 --- /dev/null +++ b/e2e/main_test.go @@ -0,0 +1,295 @@ +// Copyright © 2023 Bank-Vaults Maintainers +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +//go:build e2e +// +build e2e + +package e2e + +import ( + "context" + "flag" + "fmt" + "os" + "testing" + "time" + + appsv1 "k8s.io/api/apps/v1" + v1 "k8s.io/api/core/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/klog/v2" + "sigs.k8s.io/controller-runtime/pkg/log" + "sigs.k8s.io/e2e-framework/klient/conf" + "sigs.k8s.io/e2e-framework/klient/decoder" + "sigs.k8s.io/e2e-framework/klient/k8s/resources" + "sigs.k8s.io/e2e-framework/klient/wait" + "sigs.k8s.io/e2e-framework/klient/wait/conditions" + "sigs.k8s.io/e2e-framework/pkg/env" + "sigs.k8s.io/e2e-framework/pkg/envconf" + "sigs.k8s.io/e2e-framework/pkg/envfuncs" + "sigs.k8s.io/e2e-framework/third_party/helm" +) + +// Upgrade this when a new version is released +const vaultOperatorVersion = "1.20.0" + +var testenv env.Environment + +func TestMain(m *testing.M) { + // See https://github.com/kubernetes-sigs/e2e-framework/issues/269 + // testenv = env.New() + testenv = &reverseFinishEnvironment{Environment: env.New()} + + if os.Getenv("LOG_VERBOSE") == "true" { + flags := flag.NewFlagSet("", flag.ContinueOnError) + klog.InitFlags(flags) + flags.Parse([]string{"-v", "4"}) + } + log.SetLogger(klog.NewKlogr()) + + // Set up cluster + if os.Getenv("USE_REAL_CLUSTER") == "true" { + path := conf.ResolveKubeConfigFile() + cfg := envconf.NewWithKubeConfig(path) + + if context := os.Getenv("USE_CONTEXT"); context != "" { + cfg.WithKubeContext(context) + } + + // See https://github.com/kubernetes-sigs/e2e-framework/issues/269 + // testenv = env.NewWithConfig(cfg) + testenv = &reverseFinishEnvironment{Environment: env.NewWithConfig(cfg)} + } else { + clusterName := envconf.RandomName("vault-secrets-webhook-test", 32) + + if v := os.Getenv("KIND_K8S_VERSION"); v != "" { + testenv.Setup(envfuncs.CreateKindClusterWithConfig(clusterName, "kindest/node:"+v, "kind.yaml")) + } else { + testenv.Setup(envfuncs.CreateKindCluster(clusterName)) + } + + testenv.Finish(envfuncs.DestroyKindCluster(clusterName)) + + if image := os.Getenv("LOAD_IMAGE"); image != "" { + testenv.Setup(envfuncs.LoadDockerImageToCluster(clusterName, image)) + } + + if imageArchive := os.Getenv("LOAD_IMAGE_ARCHIVE"); imageArchive != "" { + testenv.Setup(envfuncs.LoadImageArchiveToCluster(clusterName, imageArchive)) + } + } + + // Install vault-operator + testenv.Setup(installVaultOperator) + testenv.Finish(uninstallVaultOperator, envfuncs.DeleteNamespace("vault-operator")) + + testenv.Setup(envfuncs.CreateNamespace("vault-secrets-webhook"), installVaultSecretsWebhook) + testenv.Finish(uninstallVaultSecretsWebhook, envfuncs.DeleteNamespace("vault-secrets-webhook")) + + // Set up test namespace + // ns := envconf.RandomName("webhook-test", 16) + // testenv.Setup(envfuncs.CreateNamespace(ns)) + // testenv.Finish(envfuncs.DeleteNamespace(ns)) + + // Unsealing and Vault access only works in the default namespace at the moment + testenv.Setup(useNamespace("default")) + + testenv.Setup(installVault, waitForVaultTLS) + testenv.Finish(uninstallVault) + + os.Exit(testenv.Run(m)) +} + +func installVaultOperator(ctx context.Context, cfg *envconf.Config) (context.Context, error) { + manager := helm.New(cfg.KubeconfigFile()) + + err := manager.RunInstall( + helm.WithName("vault-operator"), // This is weird that ReleaseName works differently, but it is what it is + helm.WithChart("oci://ghcr.io/bank-vaults/helm-charts/vault-operator"), + helm.WithNamespace("vault-operator"), + helm.WithArgs("--create-namespace"), + helm.WithVersion(vaultOperatorVersion), + helm.WithWait(), + helm.WithTimeout("2m"), + ) + if err != nil { + return ctx, fmt.Errorf("installing vault-operator: %w", err) + } + + return ctx, nil +} + +func uninstallVaultOperator(ctx context.Context, cfg *envconf.Config) (context.Context, error) { + manager := helm.New(cfg.KubeconfigFile()) + + err := manager.RunUninstall( + helm.WithName("vault-operator"), + helm.WithNamespace("vault-operator"), + helm.WithWait(), + helm.WithTimeout("2m"), + ) + if err != nil { + return ctx, fmt.Errorf("uninstalling vault-operator: %w", err) + } + + return ctx, nil +} + +func installVaultSecretsWebhook(ctx context.Context, cfg *envconf.Config) (context.Context, error) { + manager := helm.New(cfg.KubeconfigFile()) + + webhookVersion := "latest" + if v := os.Getenv("WEBHOOK_VERSION"); v != "" { + webhookVersion = v + } + + err := manager.RunInstall( + helm.WithName("vault-secrets-webhook"), // This is weird that ReleaseName works differently, but it is what it is + helm.WithChart("../charts/vault-secrets-webhook/"), + helm.WithNamespace("vault-secrets-webhook"), + helm.WithArgs("-f", "deploy/vault-secrets-webhook/values.yaml", "--set", "image.tag="+webhookVersion), + helm.WithWait(), + helm.WithTimeout("2m"), + ) + if err != nil { + return ctx, fmt.Errorf("installing vault-secrets-webhook: %w", err) + } + + return ctx, nil +} + +func uninstallVaultSecretsWebhook(ctx context.Context, cfg *envconf.Config) (context.Context, error) { + manager := helm.New(cfg.KubeconfigFile()) + + err := manager.RunUninstall( + helm.WithName("vault-secrets-webhook"), + helm.WithNamespace("vault-secrets-webhook"), + helm.WithWait(), + helm.WithTimeout("2m"), + ) + if err != nil { + return ctx, fmt.Errorf("uninstalling vault-secrets-webhook: %w", err) + } + + return ctx, nil +} + +func useNamespace(ns string) env.Func { + return func(ctx context.Context, cfg *envconf.Config) (context.Context, error) { + cfg.WithNamespace(ns) + + return ctx, nil + } +} + +func installVault(ctx context.Context, cfg *envconf.Config) (context.Context, error) { + r, err := resources.New(cfg.Client().RESTConfig()) + if err != nil { + return ctx, err + } + + err = decoder.DecodeEachFile( + ctx, os.DirFS("deploy/vault"), "*", + decoder.CreateHandler(r), + decoder.MutateNamespace(cfg.Namespace()), + ) + if err != nil { + return ctx, err + } + + statefulSets := &appsv1.StatefulSetList{ + Items: []appsv1.StatefulSet{ + { + ObjectMeta: metav1.ObjectMeta{Name: "vault", Namespace: cfg.Namespace()}, + }, + }, + } + + // wait for the statefulSet to become available + err = wait.For(conditions.New(r).ResourcesFound(statefulSets), wait.WithTimeout(1*time.Minute)) + if err != nil { + return ctx, err + } + + time.Sleep(5 * time.Second) + + pod := v1.Pod{ + ObjectMeta: metav1.ObjectMeta{Name: "vault-0", Namespace: cfg.Namespace()}, + } + + // wait for the pod to become available + err = wait.For(conditions.New(r).PodReady(&pod), wait.WithTimeout(1*time.Minute)) + if err != nil { + return ctx, err + } + + return ctx, nil +} + +func waitForVaultTLS(ctx context.Context, cfg *envconf.Config) (context.Context, error) { + vaultTLSSecrets := &v1.SecretList{ + Items: []v1.Secret{ + { + ObjectMeta: metav1.ObjectMeta{Name: "vault-tls", Namespace: cfg.Namespace()}, + }, + }, + } + + // wait for the vault-tls secret to become available + err := wait.For(conditions.New(cfg.Client().Resources()).ResourcesFound(vaultTLSSecrets), wait.WithTimeout(1*time.Minute)) + if err != nil { + return ctx, err + } + + return ctx, nil +} + +func uninstallVault(ctx context.Context, cfg *envconf.Config) (context.Context, error) { + r, err := resources.New(cfg.Client().RESTConfig()) + if err != nil { + return ctx, err + } + + err = decoder.DecodeEachFile( + ctx, os.DirFS("deploy/vault"), "*", + decoder.DeleteHandler(r), + decoder.MutateNamespace(cfg.Namespace()), + ) + + if err != nil { + return ctx, err + } + + return ctx, nil +} + +type reverseFinishEnvironment struct { + env.Environment + + finishFuncs []env.Func +} + +// Finish registers funcs that are executed at the end of the test suite in a reverse order. +func (e *reverseFinishEnvironment) Finish(f ...env.Func) env.Environment { + e.finishFuncs = append(f[:], e.finishFuncs...) + + return e +} + +// Run launches the test suite from within a TestMain. +func (e *reverseFinishEnvironment) Run(m *testing.M) int { + e.Environment.Finish(e.finishFuncs...) + + return e.Environment.Run(m) +} diff --git a/e2e/test/configmap.yaml b/e2e/test/configmap.yaml new file mode 100644 index 00000000..6e264bb6 --- /dev/null +++ b/e2e/test/configmap.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: test-configmap + annotations: + vault.security.banzaicloud.io/vault-addr: "https://vault.default.svc.cluster.local:8200" + vault.security.banzaicloud.io/vault-role: "default" + vault.security.banzaicloud.io/vault-tls-secret: vault-tls + # vault.security.banzaicloud.io/vault-skip-verify: "true" + vault.security.banzaicloud.io/vault-path: "kubernetes" +data: + aws-access-key-id: vault:secret/data/accounts/aws#AWS_ACCESS_KEY_ID + aws-access-key-id-formatted: "vault:secret/data/accounts/aws#AWS key in base64: ${.AWS_ACCESS_KEY_ID | b64enc}" + aws-access-key-id-inline: "AWS_ACCESS_KEY_ID: ${vault:secret/data/accounts/aws#AWS_ACCESS_KEY_ID} AWS_SECRET_ACCESS_KEY: ${vault:secret/data/accounts/aws#AWS_SECRET_ACCESS_KEY}" +binaryData: + aws-access-key-id-binary: dmF1bHQ6c2VjcmV0L2RhdGEvYWNjb3VudHMvYXdzI0FXU19BQ0NFU1NfS0VZX0lE diff --git a/e2e/test/deployment-seccontext.yaml b/e2e/test/deployment-seccontext.yaml new file mode 100644 index 00000000..d3fb96ae --- /dev/null +++ b/e2e/test/deployment-seccontext.yaml @@ -0,0 +1,45 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: test-deployment-seccontext +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: test-deployment-seccontext + template: + metadata: + labels: + app.kubernetes.io/name: test-deployment-seccontext + annotations: + vault.security.banzaicloud.io/vault-addr: "https://vault.default.svc.cluster.local:8200" + vault.security.banzaicloud.io/vault-role: "default" + vault.security.banzaicloud.io/vault-tls-secret: vault-tls + # vault.security.banzaicloud.io/vault-skip-verify: "true" + vault.security.banzaicloud.io/vault-path: "kubernetes" + # vault.security.banzaicloud.io/vault-agent: "true" + spec: + securityContext: + runAsUser: 1000 + initContainers: + - name: init-ubuntu + image: ubuntu + command: ["sh", "-c", "echo $AWS_SECRET_ACCESS_KEY && echo initContainers ready"] + env: + - name: AWS_SECRET_ACCESS_KEY + value: vault:secret/data/accounts/aws#AWS_SECRET_ACCESS_KEY + resources: + limits: + memory: "128Mi" + cpu: "100m" + containers: + - name: alpine + image: alpine + command: ["sh", "-c", "echo $AWS_SECRET_ACCESS_KEY && echo going to sleep... && sleep 10000"] + env: + - name: AWS_SECRET_ACCESS_KEY + value: vault:secret/data/accounts/aws#AWS_SECRET_ACCESS_KEY + resources: + limits: + memory: "128Mi" + cpu: "100m" diff --git a/e2e/test/deployment-template.yaml b/e2e/test/deployment-template.yaml new file mode 100644 index 00000000..09b8bdd6 --- /dev/null +++ b/e2e/test/deployment-template.yaml @@ -0,0 +1,75 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/name: my-app + my-app.kubernetes.io/name: my-app-vault-agent + branches: "true" + name: my-app-vault-agent +data: + config.hcl: | + vault { + // This is needed until https://github.com/hashicorp/vault/issues/7889 + // gets fixed, otherwise it is automated by the webhook. + ca_cert = "/vault/tls/ca.crt" + } + auto_auth { + method "kubernetes" { + mount_path = "auth/kubernetes" + config = { + role = "default" + } + } + sink "file" { + config = { + path = "/vault/.vault-token" + } + } + } + template { + contents = <