CD: automate vault bootstrapping

[noahehall]

C

• there are a nuimber of bootstrapping steps that need to occur for each env on a green deployment
• bootstrapping vault for a particular env should include configuring vault to match the status quo
• vault bootstrapping and deployments should be immutable

T

• automate each step taken to get it back to a working state
  • root token semi-automation
    • restore vault to a blank state
    • pgp key(s) and root token creation
    • vault initialization and unsealing
    • admin token & policy creation
  • admin token automation
    • policy: create all policies in policy dir
    • token: create all tokens in token dir
    • features: enable all featres in enable_feature dir
      • tested on kv1, kv2, database, and approle
    • secrets engines configuration
      • [ ] kv1 kv1 has no configuration
      • kv2
      • postgres-database-plugin
        • update postgres user-init-file to create user specifically for vault
        • create postgres config
        • rotate vault user creds
        • create 3 roles: readonly, readwrite, readstatic
    • auth schemes configuration
      • approle
      • [ ] github defeats the purpose of using vault
  • update docs

A

• @see vault: complete integration with remaining vault auth schemes and engines scripts#20
• relevant (links)
  • https://developer.hashicorp.com/vault/docs/concepts/policies
  • https://developer.hashicorp.com/vault/docs/commands/policy/write
  • https://developer.hashicorp.com/vault/docs/commands/policy
  • https://github.com/hashicorp/vault-examples
  • https://developer.hashicorp.com/vault/docs/agent
  • https://developer.hashicorp.com/vault/docs/secrets/databases
  • https://developer.hashicorp.com/vault/docs/secrets/databases/postgresql
  • https://developer.hashicorp.com/vault/api-docs/secret/databases
  • https://developer.hashicorp.com/vault/api-docs/secret/databases/postgresql
• irrelevant (links):
  • the vault bootstrap event occurs upstream from both nomad and any future consul integrations
  • even more so, vault bootstrapping process should be airgapped, self contained and isolated from all systems and instantiable with 0 dependencies
  • https://developer.hashicorp.com/nomad/docs/job-specification/template
  • https://github.com/hashicorp/consul-template/blob/main/docs/templating-language.md
• vault github notice

Any valid GitHub access token with the read:org scope for any user belonging to the Vault-configured organization can be used for authentication. If such a token is stolen from a third party service, and the attacker is able to make network calls to Vault, they will be able to log in as the user that generated the access token.