hashicorp / hashicorp/vault-helm

Support for Consul ACL

Open
#189 0 comments 18 reactions 0 assignees View on GitHub
consul enhancement vault-server
Dominant language
Shell
Stars
1.3k
Forks
898
Avg merge
3d 1h
Merged PRs (30d)
1

Description

We are using Consul as storage backend for Vault. When combining `vault-helm` with `consul-helm` we have noticed there currently is no support for Consul ACLs in the Vault helm chart.

### Problem description
In `consul-helm` you can enable ACLs by setting [bootstrapACLs](https://github.com/hashicorp/consul-helm/blob/b1432ccd385736bd5add687894dfa9bfa69ab30e/values.yaml#L78) to `true`. Obviously this requires Vault to be configured with a `token` within the storage stanza for Consul. Currently, we first install `consul-helm`, then manually create a policy and Consul token for Vault, add the token to the config in `server.ha.config` in the values.yaml, and finally install `vault-helm`.

### Proposal
Add automation for this process to `vault-helm`

We are open to any solution and we would be happy to contribute to this ourselves. How about we add an initContainer to the Vault stateful set, with a script which checks if there is already an existing Secret object with the Consul token for Vault.

If not, it will read the Consul bootstrap token from the respective Secret object, create the required Consul policy and token, store the token in a new Secret, and finally do a search and replace on the Vault config file to set the token within the storage stanza block for Consul.

Any feedback is appreciated.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing values.yaml, especially server.ha.config, and the Consul and Vault Secret objects described in the issue. Determine how the chart currently configures Consul storage and StatefulSet initialization. Done means Vault can use Consul with ACLs enabled without manually creating the policy, token, Secret, or storage configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes
Domain
authorization, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.