Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Improve Agent Injector Vault Address Environment Variable Options #789

Open
rgarcia6520 opened this issue Sep 21, 2022 · 2 comments · May be fixed by #790
Open

Improve Agent Injector Vault Address Environment Variable Options #789

rgarcia6520 opened this issue Sep 21, 2022 · 2 comments · May be fixed by #790
Labels
bug Something isn't working

Comments

@rgarcia6520
Copy link

rgarcia6520 commented Sep 21, 2022 •
edited
Loading

Describe the bug
In environments where we are utilizing vault as part of this helm-chart but using Istio LoadBalancers, or AWS ELBs forwarding traffic to the Vault server the included agent injector deployment is not able to get the correct VAULT_ADDR with the existing options to set AGENT_INJECT_VAULT_ADDR

To Reproduce
Steps to reproduce the behavior:

  1. Install chart
  2. Create secret and serviceAccount and all included options to configure another deployment to utilize a secret from Vault.
  3. Add kubernetes labels to inject deployment so it can utilize vault secrets
  4. Pod is never able to communicate with Vault because we use our own cert and (E)LB and VAULT_ADDR is set to https://vault-vault.vault.svc:8200

Expected behavior
Agent Injector VAULT_ADDR endpoint is configurable

Environment

  • Kubernetes version: 1.23.8
    • Distribution or cloud vendor (OpenShift, EKS, GKE, AKS, etc.): RKE2
    • Other configuration options or runtime services (istio, etc.): istio 1.14.2
  • vault-helm version: 0.21.0

Chart values:

global:
  tlsDisable: false
server:
  extraEnvironmentVars:
    VAULT_SKIP_VERIFY: "true"
    VAULT_LOG_FORMAT: "json"
  ha:
    enabled: true 
    replicas: 3
    apiAddr: "https://vault.example.com"
    raft:
      enabled: true
      setNodeId: true
      config: |
        ui = true
        seal "awskms" {
          region     = "us-gov-west-1"
          kms_key_id = "XXXXXXXXXXXX"
          endpoint   = "https://kms.us-gov-west-1.amazonaws.com"
        }
        listener "tcp" {
          tls_disable = false
          address = "[::]:8200"
          cluster_address = "[::]:8201"
          tls_cert_file = "/vault/tls/tls.crt"
          tls_key_file  = "/vault/tls/tls.key"
          telemetry {
            unauthenticated_metrics_access = true
          }
        }

        storage "raft" {
          path = "/vault/data"

          retry_join {
            leader_api_addr = "https://vault-vault-0.vault-vault-internal:8200"
            leader_client_cert_file = "/vault/tls/tls.crt"
            leader_client_key_file = "/vault/tls/tls.key"
            leader_tls_servername = "example.com"
          }
  
          retry_join {
            leader_api_addr = "https://vault-vault-1.vault-vault-internal:8200"
            leader_client_cert_file = "/vault/tls/tls.crt"
            leader_client_key_file = "/vault/tls/tls.key"
            leader_tls_servername = "vault.example.com"
          }
  
          retry_join {
            leader_api_addr = "https://vault-vault-2.vault-vault-internal:8200"
            leader_client_cert_file = "/vault/tls/tls.crt"
            leader_client_key_file = "/vault/tls/tls.key"
            leader_tls_servername = "vault.example.com"
          }
        }

        telemetry {
          prometheus_retention_time = "24h"
          disable_hostname = true
        }

        service_registration "kubernetes" 
  volumes:
  - name: tls
    secret:
      secretName: vault-tls
  volumeMounts:
  - name: tls
    mountPath: "/vault/tls"
    readOnly: true
  dataStorage:
    enabled: true
    size: 50Gi
    mountPath: "/vault/data"
    accessMode: ReadWriteOnce

Additional context
Add any other context about the problem here.
@rgarcia6520 rgarcia6520 added the bug Something isn't working label Sep 21, 2022
@rgarcia6520 rgarcia6520 linked a pull request Sep 21, 2022 that will close this issue
Open
@dtrts
Copy link
Contributor

dtrts commented Nov 8, 2023

+1 on this .We are facing a similar issue as we need to customize the AGENT_INJECT_VAULT_ADDR value to support our TLS setup but without disabling the vault server deployment!

@jr200
Copy link

jr200 commented Aug 14, 2024 •
edited
Loading

+1 here too.

Looking at the helm chart manifest, I see:

            - name: AGENT_INJECT_VAULT_ADDR
            {{- if .Values.global.externalVaultAddr }}
              value: "{{ .Values.global.externalVaultAddr }}"
            {{- else if .Values.injector.externalVaultAddr }}
              value: "{{ .Values.injector.externalVaultAddr }}"
            {{- else }}
              value: {{ include "vault.scheme" . }}://{{ template "vault.fullname" . }}.{{ include "vault.namespace" . }}.svc:{{ .Values.server.service.port }}
            {{- end }}

But in the values.yaml,

section injector:

  # Deprecated: Please use global.externalVaultAddr instead.
  externalVaultAddr: ""

section global:

  # External vault server address for the injector and CSI provider to use.
  # Setting this will disable deployment of a vault server.
  externalVaultAddr: ""

At some point I guess the plan is to remove injector.externalVaultAddr. When this is done, can you provide an alternative method of setting the address of vault in the injector.

I want to set the external Vault Addr for the injector (for tls/cert reasons), and also deploy the server. There are cases where its not a mutually exclusive setting.

Thanks,

Edit:
I think its not currently possible to deploy vault server set and set an externalVaultAddr (i.e., configure AGENT_INJECT_VAULT_ADDR . I had to amend my ansible role to post-json-patch the AGENT_INJECT_VAULT_ADDR env variable.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Adding new option to agent deployment AGENT_INJECT_VAULT_ADDR section rgarcia6520/vault-helm
3 participants
@jr200 @rgarcia6520 @dtrts