Helm/Vault Secrets Operator: Difference between revisions

From Chorke Wiki
Jump to navigation Jump to search
← Older editNewer edit →
VisualWikitext
Line 237: Line 237:
kubectl -n=shahed-academia get VaultAuth
kubectl -n=shahed-academia get VaultAuth
kubectl -n=shahed-academia get VaultAuth auth-shahed-ab -o=yaml
kubectl -n=shahed-academia get VaultAuth auth-shahed-ab -o=yaml
</syntaxhighlight>
|-
!scope='col'| Secret
!scope='col'| ConfigMap
|-
|valign='top'|
<syntaxhighlight lang='yaml'>
cat <<'YML' | \
kubectl -n shahed-academia apply -f -
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: academia-audit-sec-sync
spec:
  path: shahed/academia/dev/audit
  vaultAuthRef: auth-shahed-ab
  refreshAfter: 30s
  mount: shahed
  type: kv-v2
  destination:
    name: academia-audit
    type: Secret
    create: true
    labels:
      app.kubernetes.io/version: 1.0.0
      app.kubernetes.io/managed-by: vso
      app.kubernetes.io/name: academia-audit-sec-sync
      app.kubernetes.io/instance: academia-audit-sec-sync
YML
</syntaxhighlight>
<syntaxhighlight lang='bash'>
kubectl -n=shahed-academia get VaultStaticSecret academia-audit-sec-sync -o=yaml
kubectl -n=shahed-academia get Secret            academia-audit -o=yaml
</syntaxhighlight>
|valign='top'|
<syntaxhighlight lang='yaml'>
cat <<'YML' | \
kubectl -n shahed-academia apply -f -
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: academia-audit-cfm-sync
spec:
  path: shahed/academia/dev/audit
  vaultAuthRef: auth-shahed-ab
  refreshAfter: 30s
  mount: shahed
  type: kv-v2
  destination:
    name: academia-audit
    type: ConfigMap
    create: true
    labels:
      app.kubernetes.io/version: 1.0.0
      app.kubernetes.io/managed-by: vso
      app.kubernetes.io/name: academia-audit-cfm-sync
      app.kubernetes.io/instance: academia-audit-cfm-sync
YML
</syntaxhighlight>
<syntaxhighlight lang='bash'>
kubectl -n=shahed-academia get VaultStaticSecret academia-audit-cfm-sync -o=yaml
kubectl -n=shahed-academia get ConfigMap        academia-audit -o=yaml
</syntaxhighlight>
</syntaxhighlight>
|}
|}

Revision as of 09:45, 22 January 2026

helm repo add hashicorp https://helm.releases.hashicorp.com
helm repo update && helm repo list
kubectl config get-contexts

Helm » Context

Helm » Context 

export KUBECONFIG="${HOME}/.kube/aws-kubeconfig.yaml"
export KUBECONFIG="${HOME}/.kube/gcp-kubeconfig.yaml"
export KUBECONFIG="${HOME}/.kube/lke-kubeconfig.yaml"
export KUBECONFIG="${HOME}/.kube/config"

Helm » Install

Helm » Install 

helm show   values hashicorp/vault-secrets-operator --version=1.1.0|less
helm show   values hashicorp/vault-secrets-operator --version=1.2.0|less

export KUBECONFIG="${HOME}/.kube/shahed-ab-kubeconfig.yaml"
kubectl create ns   vault-secrets-operator-system || true

kubectl get ns|grep vault-secrets-operator-system
kubectl delete ns   vault-secrets-operator-system || true
Install Notes 
cat <<'YML' | \
helm -n=vault-secrets-operator-system upgrade \
-i vso hashicorp/vault-secrets-operator --version=1.2.0 -f -
---
controller:
  replicas: 1
  kubeRbacProxy:
    image:
      repository: quay.io/brancz/kube-rbac-proxy
      tag: v0.18.1
    resources:
      limits:
        cpu: 500m
        memory: 128Mi
      requests:
        cpu: 5m
        memory: 64Mi
  manager:
    image:
      repository: hashicorp/vault-secrets-operator
      tag: 1.2.0
    resources:
      limits:
        cpu: 500m
        memory: 128Mi
      requests:
        cpu: 10m
        memory: 64Mi

hooks:
  resources:
    limits:
      cpu: 500m
      memory: 128Mi
    requests:
      cpu: 10m
      memory: 64Mi

csi:
  enabled: false
  driver:
    image:
      repository: hashicorp/vault-secrets-operator-csi
      tag: 1.0.1
  livenessProbe:
    image:
      repository: registry.k8s.io/sig-storage/livenessprobe
      tag: v2.16.0
  nodeDriverRegistrar:
    image:
      repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
      tag: v2.14.0
YML
Verify 
helm -n=vault-secrets-operator-system status vso
helm -n=vault-secrets-operator-system get    manifest vso

Helm » Config

Helm » Config

Scale » Down Scale » Up 
kubectl -n=vault-secrets-operator-system \
scale deploy/vso-vault-secrets-operator-controller-manager --replicas=0

kubectl -n=vault-secrets-operator-system \
scale deploy/vso-vault-secrets-operator-controller-manager --replicas=1

Vault » Config

Vault » Config

Context Namespace 
export KUBECONFIG="${HOME}/.kube/shahed-ab-kubeconfig.yaml"
kubectl get service kubernetes -n default
kubectl cluster-info








kubectl get ns shahed-academia -o=yaml
kubectl     -n=shahed-academia get VaultAuth auth-shahed-ab -o=yaml
kubectl     -n=shahed-academia get VaultConnection vault-shahed-ab -o=yaml

cat <<'YML' | \
kubectl apply -f -
---
apiVersion: v1
kind: Namespace
metadata:
  name: shahed-academia
  labels:
    app.kubernetes.io/managed-by: kubectl
    app.kubernetes.io/name: shahed-academia
    kubernetes.io/metadata.name: shahed-academia
YML

kubectl get namespace shahed-academia -o=yaml
VaultConnection VaultAuth 
cat <<'YML' | \
kubectl -n shahed-academia apply -f -
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultConnection
metadata:
  name: vault-shahed-ab
  labels:
    app.kubernetes.io/managed-by: kubectl
    app.kubernetes.io/name: vault-shahed-ab
    kubernetes.io/metadata.name: vault-shahed-ab
spec:
  address: http://vault.vault.svc.cluster.local:8200
YML





kubectl -n=shahed-academia get VaultConnection
kubectl -n=shahed-academia get VaultConnection vault-shahed-ab -o=yaml

cat <<'YML' | \
kubectl -n shahed-academia apply -f -
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
  name: auth-shahed-ab
  labels:
    app.kubernetes.io/managed-by: kubectl
    app.kubernetes.io/name: auth-shahed-ab
    kubernetes.io/metadata.name: auth-shahed-ab
spec:
  method: kubernetes
  mount: kubernetes
  kubernetes:
    serviceAccount: default
  vaultConnectionRef: vault-shahed-ab
YML

kubectl -n=shahed-academia get VaultAuth
kubectl -n=shahed-academia get VaultAuth auth-shahed-ab -o=yaml
Secret ConfigMap 
cat <<'YML' | \
kubectl -n shahed-academia apply -f -
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: academia-audit-sec-sync
spec:
  path: shahed/academia/dev/audit
  vaultAuthRef: auth-shahed-ab
  refreshAfter: 30s
  mount: shahed
  type: kv-v2

  destination:
    name: academia-audit
    type: Secret
    create: true
    labels:
      app.kubernetes.io/version: 1.0.0
      app.kubernetes.io/managed-by: vso
      app.kubernetes.io/name: academia-audit-sec-sync
      app.kubernetes.io/instance: academia-audit-sec-sync
YML

kubectl -n=shahed-academia get VaultStaticSecret academia-audit-sec-sync -o=yaml
kubectl -n=shahed-academia get Secret            academia-audit -o=yaml

cat <<'YML' | \
kubectl -n shahed-academia apply -f -
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: academia-audit-cfm-sync
spec:
  path: shahed/academia/dev/audit
  vaultAuthRef: auth-shahed-ab
  refreshAfter: 30s
  mount: shahed
  type: kv-v2

  destination:
    name: academia-audit
    type: ConfigMap
    create: true
    labels:
      app.kubernetes.io/version: 1.0.0
      app.kubernetes.io/managed-by: vso
      app.kubernetes.io/name: academia-audit-cfm-sync
      app.kubernetes.io/instance: academia-audit-cfm-sync
YML

kubectl -n=shahed-academia get VaultStaticSecret academia-audit-cfm-sync -o=yaml
kubectl -n=shahed-academia get ConfigMap         academia-audit -o=yaml

Helm » Debug

Helm » Debug 

kubectl -n=vault-secrets-operator-system logs -f  svc/vso-vault-secrets-operator-metrics-service -c kube-rbac-proxy
kubectl -n=vault-secrets-operator-system logs -f  svc/vso-vault-secrets-operator-metrics-service -c manager
kubectl -n=vault-secrets-operator-system logs -f  svc/vso-vault-secrets-operator-metrics-service

Helm » Uninstall

Helm » Uninstall 

helm -n=vault-secrets-operator-system status    vso
helm -n=vault-secrets-operator-system get all   vso
helm -n=vault-secrets-operator-system uninstall vso

kubectl -n=vault-secrets-operator-system delete pvc --all
kubectl                                  delete ns  vault-secrets-operator-system
kubectl                                  delete pv  vso-data-vso-0

Playground

Playground 

helm -n=vault-secrets-operator-system install    vso hashicorp/vault-secrets-operator --version=1.1.0
helm -n=vault-secrets-operator-system upgrade -i vso hashicorp/vault-secrets-operator --version=1.2.0
helm show   values                                   hashicorp/vault-secrets-operator --version=1.2.0|less

kubectl -n=vault-secrets-operator-system exec -it svc/vso-vault-secrets-operator-metrics-service -c kube-rbac-proxy -- bash
kubectl -n=vault-secrets-operator-system exec -it svc/vso-vault-secrets-operator-metrics-service -c manager         -- bash

kubectl -n=vault-secrets-operator-system logs -f  svc/vso-vault-secrets-operator-metrics-service -c kube-rbac-proxy
kubectl -n=vault-secrets-operator-system logs -f  svc/vso-vault-secrets-operator-metrics-service -c manager
kubectl -n=vault-secrets-operator-system logs -f  svc/vso-vault-secrets-operator-metrics-service

kubectl -n=vault-secrets-operator-system delete all --all
kubectl -n=vault-secrets-operator-system delete ing --all
kubectl -n=vault-secrets-operator-system delete sts --all

kubectl          delete pv  vault-data-vault-0
kubectl -n=vault-secrets-operator-system delete svc --all
kubectl -n=vault-secrets-operator-system delete pvc --all

kubectl -n=vault-secrets-operator-system rollout history deploy/vso-vault-secrets-operator-controller-manager
kubectl -n=vault-secrets-operator-system rollout restart deploy/vso-vault-secrets-operator-controller-manager
kubectl -n=vault-secrets-operator-system rollout status  deploy/vso-vault-secrets-operator-controller-manager

kubectl -n=vault-secrets-operator-system exec -it svc/vso-vault-secrets-operator-metrics-service -c manager -- ash
kubectl -n=vault-secrets-operator-system logs -f  svc/vso-vault-secrets-operator-metrics-service -c manager
kubectl -n=vault-secrets-operator-system logs -f  svc/vso-vault-secrets-operator-metrics-service

References

References

Retrieved from "https://wiki.chorke.org/index.php?title=Helm/Vault_Secrets_Operator&oldid=16301"