hashicorp / hashicorp/vault-helm

Add custom variable substitution on config file

Open
#484 1 comment 3 reactions 0 assignees View on GitHub
enhancement
Dominant language
Shell
Stars
1.3k
Forks
898
Avg merge
3d 1h
Merged PRs (30d)
1

Description

**Is your feature request related to a problem? Please describe.**
Not related to a problem but to a limitation. It's not possible to replace placeholders in the `/vault/config/extraconfig-from-values.hcl` beyond those in the `vault.args` template.

I have a `config.yaml` from which I want to remove all sensitive information so to allow auto-unsealing. I tried creating an `initContainer` to replace these information with environment variables' values, obtained from Secrets, but I couldn't accomplish it because the volume is mounted in it as read-only and the filesystem has root ownership.

**Describe the solution you'd like**
Add a config key to the `values.yaml` file that would allow multiple replacements before the execution of the entrypoint.

**Describe alternatives you've considered**
In `values.yaml`:
```
vault:
server:
extraConfigSubstitution:
- placeholder: "PLACEHOLDER1"
envVar: "ENVVALUE1"
- placeholder: "PLACEHOLDER2"
envVar: "ENVVALUE2"
```

In `_helpers.tpl`:
```
{{- define "vault.args" -}}
{{ if or (eq .mode "standalone") (eq .mode "ha") }}
- |
cp /vault/config/extraconfig-from-values.hcl /tmp/storageconfig.hcl;
[ -n "${HOST_IP}" ] && sed -Ei "s|HOST_IP|${HOST_IP?}|g" /tmp/storageconfig.hcl;
[ -n "${POD_IP}" ] && sed -Ei "s|POD_IP|${POD_IP?}|g" /tmp/storageconfig.hcl;
[ -n "${HOSTNAME}" ] && sed -Ei "s|HOSTNAME|${HOSTNAME?}|g" /tmp/storageconfig.hcl;
[ -n "${API_ADDR}" ] && sed -Ei "s|API_ADDR|${API_ADDR?}|g" /tmp/storageconfig.hcl;
[ -n "${TRANSIT_ADDR}" ] && sed -Ei "s|TRANSIT_ADDR|${TRANSIT_ADDR?}|g" /tmp/storageconfig.hcl;
[ -n "${RAFT_ADDR}" ] && sed -Ei "s|RAFT_ADDR|${RAFT_ADDR?}|g" /tmp/storageconfig.hcl;
{{- range .Values.server.extraConfigSubstitution }}
[ -n "${ {{- .placeholder -}} }" ] && sed -Ei "s|{{ .placeholder }}|${ {{- .envVar -}} ?}|g" /tmp/storageconfig.hcl;
unset {{ .envVar }};
{{- end }}
/usr/local/bin/docker-entrypoint.sh vault server -config=/tmp/storageconfig.hcl {{ .Values.server.extraArgs }}
{{ else if eq .mode "dev" }}
- |
/usr/local/bin/docker-entrypoint.sh vault server -dev {{ .Values.server.extraArgs }}
{{ end }}
{{- end -}}
```

This would render:
```
- >
cp /vault/config/extraconfig-from-values.hcl /tmp/storageconfig.hcl;

[ -n "${HOST_IP}" ] && sed -Ei "s|HOST_IP|${HOST_IP?}|g"
/tmp/storageconfig.hcl;

[ -n "${POD_IP}" ] && sed -Ei "s|POD_IP|${POD_IP?}|g"
/tmp/storageconfig.hcl;

[ -n "${HOSTNAME}" ] && sed -Ei "s|HOSTNAME|${HOSTNAME?}|g"
/tmp/storageconfig.hcl;

[ -n "${API_ADDR}" ] && sed -Ei "s|API_ADDR|${API_ADDR?}|g"
/tmp/storageconfig.hcl;

[ -n "${TRANSIT_ADDR}" ] && sed -Ei
"s|TRANSIT_ADDR|${TRANSIT_ADDR?}|g" /tmp/storageconfig.hcl;

[ -n "${RAFT_ADDR}" ] && sed -Ei "s|RAFT_ADDR|${RAFT_ADDR?}|g"
/tmp/storageconfig.hcl;

[ -n "${PLACEHOLDER1}" ] && sed -Ei "s|PLACEHOLDER1|${ENVVALUE1?}|g"
/tmp/storageconfig.hcl;

[ -n "${PLACEHOLDER2}" ] && sed -Ei "s|PLACEHOLDER2|${ENVVALUE2?}|g"
/tmp/storageconfig.hcl;

/usr/local/bin/docker-entrypoint.sh vault server
-config=/tmp/storageconfig.hcl
```

**Additional context**
This change would allow to remove every credential or sensitive information from the config file, allowing the use of environment variables obtained from Kubernetes Secrets objects.

Example:
A `config.hcl` defined in the `values.yaml` file:
```
config: |
ui = true

listener "tcp" {
tls_disable = 1
address = "[::]:8200"
cluster_address = "[::]:8201"
}
storage "file" {
path = "/vault/data"
}

seal "transit" {
address = "TRANSIT_SERVER_VALUE"
token = "TRANSIT_TOKEN_VALUE"
disable_renewal = "false"

// Key configuration
key_name = "TRANSIT_KEY_NAME_VALUE"
mount_path = "transit/"

// TLS Configuration
tls_skip_verify = "true"
}
```

The environment variables created from a Secret:
```
extraSecretEnvironmentVars:
- secretName: transit-auto-unseal
secretKey: server
envName: TRANSIT_SERVER
- secretName: transit-auto-unseal
secretKey: key_name
envName: TRANSIT_KEY_NAME
- secretName: transit-auto-unseal
secretKey: token
envName: TRANSIT_TOKEN
```

How would be the substitution object for these placeholders in `values.yaml`:
```
vault:
server:
extraConfigSubstitution:
- placeholder: "TRANSIT_SERVER_VALUE"
envVar: "TRANSIT_SERVER"
- placeholder: "TRANSIT_KEY_NAME_VALUE"
envVar: "TRANSIT_KEY_NAME"
- placeholder: "TRANSIT_TOKEN_VALUE"
envVar: "TRANSIT_TOKEN"
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.