hashicorp / hashicorp/vault-helm
Support for Consul ACL
- Dominant language
- Shell
- Stars
- 1.3k
- Forks
- 898
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 1
Description
We are using Consul as storage backend for Vault. When combining `vault-helm` with `consul-helm` we have noticed there currently is no support for Consul ACLs in the Vault helm chart.
### Problem description
In `consul-helm` you can enable ACLs by setting [bootstrapACLs](https://github.com/hashicorp/consul-helm/blob/b1432ccd385736bd5add687894dfa9bfa69ab30e/values.yaml#L78) to `true`. Obviously this requires Vault to be configured with a `token` within the storage stanza for Consul. Currently, we first install `consul-helm`, then manually create a policy and Consul token for Vault, add the token to the config in `server.ha.config` in the values.yaml, and finally install `vault-helm`.
### Proposal
Add automation for this process to `vault-helm`
We are open to any solution and we would be happy to contribute to this ourselves. How about we add an initContainer to the Vault stateful set, with a script which checks if there is already an existing Secret object with the Consul token for Vault.
If not, it will read the Consul bootstrap token from the respective Secret object, create the required Consul policy and token, store the token in a new Secret, and finally do a search and replace on the Vault config file to set the token within the storage stanza block for Consul.
Any feedback is appreciated.
Contributor guide
Research direction
Start by reviewing values.yaml, especially server.ha.config, and the Consul and Vault Secret objects described in the issue. Determine how the chart currently configures Consul storage and StatefulSet initialization. Done means Vault can use Consul with ACLs enabled without manually creating the policy, token, Secret, or storage configuration.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm, kubernetes
- Domain
- authorization, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100