{"id":18363422,"url":"https://github.com/stuttgart-things/vault-base-setup","last_synced_at":"2026-07-16T16:32:43.715Z","repository":{"id":209875857,"uuid":"725150529","full_name":"stuttgart-things/vault-base-setup","owner":"stuttgart-things","description":"terraform module for base-setup configuration of hashicorp vault.","archived":false,"fork":false,"pushed_at":"2026-05-26T08:16:11.000Z","size":151,"stargazers_count":1,"open_issues_count":2,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-26T10:15:05.833Z","etag":null,"topics":["csi-secrets-store","k8s-auth","terraform","vault","vso"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/stuttgart-things.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2023-11-29T14:43:11.000Z","updated_at":"2026-05-26T08:16:17.000Z","dependencies_parsed_at":"2026-02-20T04:17:09.276Z","dependency_job_id":null,"html_url":"https://github.com/stuttgart-things/vault-base-setup","commit_stats":null,"previous_names":["stuttgart-things/vault-k8s-resources","stuttgart-things/vault-base-setup"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/stuttgart-things/vault-base-setup","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stuttgart-things%2Fvault-base-setup","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stuttgart-things%2Fvault-base-setup/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stuttgart-things%2Fvault-base-setup/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stuttgart-things%2Fvault-base-setup/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/stuttgart-things","download_url":"https://codeload.github.com/stuttgart-things/vault-base-setup/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stuttgart-things%2Fvault-base-setup/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35551282,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-16T02:00:06.687Z","response_time":83,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["csi-secrets-store","k8s-auth","terraform","vault","vso"],"created_at":"2024-11-05T23:06:28.265Z","updated_at":"2026-07-16T16:32:43.710Z","avatar_url":"https://github.com/stuttgart-things.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# stuttgart-things/vault-base-setup\n\nterraform module for base-setup configuration of hashicorp vault.\n\n## EXAMPLE USAGE\n\n\u003cdetails\u003e\u003csummary\u003e\u003cb\u003eKUBECONFIG USAGE EXAMPLES\u003c/b\u003e\u003c/summary\u003e\n\n### Option 1: Using File Path (Existing Method)\n\n```hcl\nmodule \"vault-base-setup\" {\n  source          = \"github.com/stuttgart-things/vault-base-setup\"\n  vault_addr      = \"https://vault.demo-infra.example.com\"\n  cluster_name    = \"kind-dev2\"\n  context         = \"kind-dev2\"\n  skip_tls_verify = true\n  kubeconfig_path = \"/home/sthings/.kube/kind-dev2\"\n  csi_enabled     = true\n  namespace_csi   = \"vault\"\n  vso_enabled     = true\n  namespace_vso   = \"vault\"\n  k8s_auths = [\n    {\n      name           = \"dev\"\n      namespace      = \"default\"\n      token_policies = [\"read-k8s\"]\n      token_ttl      = 3600\n    },\n  ]\n}\n```\n\n### Option 2: Using String Content (New Method)\n\n```hcl\nmodule \"vault-base-setup\" {\n  source             = \"github.com/stuttgart-things/vault-base-setup\"\n  vault_addr         = \"https://vault.demo-infra.example.com\"\n  cluster_name       = \"kind-dev2\"\n  context            = \"kind-dev2\"\n  skip_tls_verify    = true\n  kubeconfig_content = file(\"/home/sthings/.kube/kind-dev2\")\n  csi_enabled        = true\n  namespace_csi      = \"vault\"\n  vso_enabled        = true\n  namespace_vso      = \"vault\"\n  k8s_auths = [\n    {\n      name           = \"dev\"\n      namespace      = \"default\"\n      token_policies = [\"read-k8s\"]\n      token_ttl      = 3600\n    },\n  ]\n}\n```\n\n### Option 2b: Using an Environment Variable\n\n```hcl\nvariable \"kubeconfig_content_from_env\" {\n  type      = string\n  sensitive = true\n}\n\nmodule \"vault-base-setup\" {\n  source             = \"github.com/stuttgart-things/vault-base-setup\"\n  vault_addr         = \"https://vault.demo-infra.example.com\"\n  cluster_name       = \"kind-dev2\"\n  context            = \"kind-dev2\"\n  skip_tls_verify    = true\n  kubeconfig_content = var.kubeconfig_content_from_env\n  csi_enabled        = true\n  namespace_csi      = \"vault\"\n  vso_enabled        = true\n  namespace_vso      = \"vault\"\n  k8s_auths = [\n    {\n      name           = \"dev\"\n      namespace      = \"default\"\n      token_policies = [\"read-k8s\"]\n      token_ttl      = 3600\n    },\n  ]\n}\n```\n\n```bash\nexport TF_VAR_kubeconfig_content_from_env=$(cat /home/sthings/.kube/kind-dev2)\n```\n\n### Option 2c. Using a Heredoc (Inline String)\n\n```hcl\nmodule \"vault-base-setup\" {\n  source             = \"github.com/stuttgart-things/vault-base-setup\"\n  vault_addr         = \"https://vault.demo-infra.example.com\"\n  cluster_name       = \"kind-dev2\"\n  context            = \"kind-dev2\"\n  skip_tls_verify    = true\n  kubeconfig_content = \u003c\u003c-EOT\n    apiVersion: v1\n    clusters:\n    - cluster:\n        certificate-authority-data: LS0tLS1CRUdJTi...\n        server: https://127.0.0.1:6443\n      name: kind-dev2\n    contexts:\n    - context:\n        cluster: kind-dev2\n        user: kind-dev2\n      name: kind-dev2\n    current-context: kind-dev2\n    kind: Config\n    preferences: {}\n    users:\n    - name: kind-dev2\n      user:\n        client-certificate-data: LS0tLS1CRUdJTi...\n        client-key-data: LS0tLS1CRUdJTi...\n  EOT\n  csi_enabled        = true\n  namespace_csi      = \"vault\"\n  vso_enabled        = true\n  namespace_vso      = \"vault\"\n  k8s_auths = [\n    {\n      name           = \"dev\"\n      namespace      = \"default\"\n      token_policies = [\"read-k8s\"]\n      token_ttl      = 3600\n    },\n  ]\n}\n```\n\nImportant Notes:\n* Exactly one of kubeconfig_path or kubeconfig_content must be provided\n* kubeconfig_content is marked as sensitive to prevent accidental exposure in logs\n* Using file() function reads the file at plan time, while kubeconfig_path reads it during data source execution\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003e\u003cb\u003eEXECUTE VAULT CONFIG (VAULT SERVER)\u003c/b\u003e\u003c/summary\u003e\n\n### MODULE CALL\n\n```bash\ncat \u003e vault-base.tf \u003c\u003c'EOF'\nmodule \"vault-secrets-setup\" {\n  source                   = \"github.com/stuttgart-things/vault-base-setup\"\n  kubeconfig_path          = \"/home/sthings/.kube/demo-infra\"\n  vault_addr               = \"https://vault.demo-infra.sthings-vsphere.labul.sva.de\"\n  createDefaultAdminPolicy = true\n  csi_enabled              = false\n  vso_enabled              = false\n  enableApproleAuth        = true\n  skip_tls_verify          = true\n\n  approle_roles = [\n    {\n      name           = \"read-k8s\"\n      token_policies = [\"read-k8s\"]\n    }\n  ]\n\n  secret_engines = [\n    {\n      path        = \"apps\"\n      name        = \"s3\"\n      description = \"minio app secrets\"\n      data_json   = \u003c\u003cEOT\n      {\n        \"accessKey\": \"this\",\n        \"secretKey\": \"andThat\"\n      }\n      EOT\n    },\n    {\n      path        = \"kubeconfigs\"\n      name        = \"kind-dev2\"\n      description = \"kubeconfig for kind-dev2 cluster\"\n      data_json   = jsonencode({\n        kubeconfig = file(\"/home/sthings/.kube/kind-dev2\")\n      })\n    }\n  ]\n\n  kv_policies = [\n    {\n      name         = \"read-k8s\"\n      capabilities = \u003c\u003cCAPS\npath \"apps/s3\" {\n  capabilities = [\"create\", \"read\", \"update\", \"patch\", \"list\"]\n}\npath \"kubeconfigs/data/*\" {\n  capabilities = [\"read\", \"list\"]\n}\nCAPS\n    }\n  ]\n}\n\noutput \"role_ids\" {\n  description = \"Role IDs from the vault approle module\"\n  value       = module.vault-secrets-setup.role_id\n}\n\noutput \"secret_ids\" {\n  description = \"Secret IDs from the vault approle module\"\n  value       = module.vault-secrets-setup.secret_id\n  sensitive   = true\n}\nEOF\n```\n\n### EXECUTION\n\n```bash\nexport VAULT_TOKEN=hvs.#..\nterraform init\nterraform apply --auto-approve\nterraform output -json\n```\n\n### TEST APPROLE w/ ANSIBLE (OPTIONAL)\n\n```bash\ncat \u003c\u003cEOF \u003e test-approle.yaml\n---\n- hosts: localhost\n  become: true\n\n  vars:\n    vault_approle_id: \"INSERT-HERE\"\n    vault_approle_secret: \"INSERT-HERE\" # pragma: allowlist secret\n    vault_url: \"https://vault.demo-infra.example.com\"\n\n    username: \"{{ lookup('community.hashi_vault.hashi_vault', 'secret=apps/data/s3:accessKey validate_certs=false auth_method=approle role_id={{ vault_approle_id }} secret_id={{ vault_approle_secret }} url={{ vault_url }}') }}\"\n    kubeconfig: \"{{ lookup('community.hashi_vault.hashi_vault', 'secret=kubeconfigs/data/kind-dev2:kubeconfig validate_certs=false auth_method=approle role_id={{ vault_approle_id }} secret_id={{ vault_approle_secret }} url={{ vault_url }}') }}\" # pragma: allowlist secret\n\n  tasks:\n    - name: Debug\n      debug:\n        var: username\n    - name: Debug\n      debug:\n        var: kubeconfig\n\nEOF\n\nansible-playbook test-approle.yaml -vv\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003e\u003cb\u003eDEPLOY K8S AUTH ON CLUSTER\u003c/b\u003e\u003c/summary\u003e\n\n```hcl\ncat \u003e vault-k8s.tf \u003c\u003c'EOF'\nmodule \"vault-base-setup\" {\n  source          = \"github.com/stuttgart-things/vault-base-setup\"\n  vault_addr      = \"https://vault.demo-infra.example.com\"\n  cluster_name    = \"kind-dev2\"\n  context         = \"kind-dev2\"\n  skip_tls_verify = true\n  kubeconfig_path = \"/home/sthings/.kube/kind-dev2\"\n  csi_enabled     = true\n  namespace_csi   = \"vault\"\n  vso_enabled     = true\n  namespace_vso   = \"vault\"\n  k8s_auths = [\n    {\n      name           = \"dev\"\n      namespace      = \"default\"\n      token_policies = [\"read-k8s\"]\n      token_ttl      = 3600\n    },\n  ]\n}\nEOF\n```\n\n```bash\n# ONLY APPLY IF VSO IS ENABLED\nkubectl apply -f https://raw.githubusercontent.com/hashicorp/vault-secrets-operator/main/chart/crds/secrets.hashicorp.com_vaultconnections.yaml\nkubectl apply -f https://raw.githubusercontent.com/hashicorp/vault-secrets-operator/main/chart/crds/secrets.hashicorp.com_vaultauths.yaml\n\nexport VAULT_TOKEN=\u003cTOKEN\u003e\nterraform init --upgrade\nterraform apply\n```\n\n```yaml\n---\napiVersion: secrets.hashicorp.com/v1beta1\nkind: VaultStaticSecret\nmetadata:\n  name: demo-infra\n  namespace: default\nspec:\n  vaultAuthRef: dev            # Reference to a VaultAuth CRD, e.g., token or approle\n  mount: kubeconfigs                  # The KV mount path in Vault\n  type: kv-v2                  # KV engine version\n  path: demo-infra             # Path under the mount\n  refreshAfter: 10s            # How often to sync from Vault\n  destination:\n    create: true\n    name: demo-infra-kube # Name of the Kubernetes Secret to create\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003e\u003cb\u003eVAULT PKI CA WITH CERT-MANAGER\u003c/b\u003e\u003c/summary\u003e\n\n### Module Call\n\n```hcl\nmodule \"vault-base-setup\" {\n  source          = \"github.com/stuttgart-things/vault-base-setup\"\n  vault_addr      = \"https://vault.demo-infra.example.com\"\n  cluster_name    = \"kind-dev2\"\n  context         = \"kind-dev2\"\n  skip_tls_verify = true\n  kubeconfig_path = \"/home/sthings/.kube/kind-dev2\"\n  csi_enabled     = false\n  vso_enabled     = false\n\n  # PKI CA configuration\n  pki_enabled     = true\n  pki_path        = \"pki\"\n  pki_common_name = \"example.com\"\n  pki_organization = \"My Org\"\n  pki_root_ttl    = \"87600h\"\n  pki_roles = [\n    {\n      name             = \"example-dot-com\"\n      allowed_domains  = [\"example.com\"]\n      allow_subdomains = true\n      max_ttl          = \"720h\"\n    }\n  ]\n\n  k8s_auths = [\n    {\n      name           = \"dev\"\n      namespace      = \"default\"\n      token_policies = [\"pki-issue\"]\n      token_ttl      = 3600\n    },\n  ]\n}\n```\n\n### cert-manager ClusterIssuer\n\n```yaml\napiVersion: cert-manager.io/v1\nkind: ClusterIssuer\nmetadata:\n  name: vault-issuer\nspec:\n  vault:\n    path: pki/sign/example-dot-com\n    server: https://vault.demo-infra.example.com\n    auth:\n      kubernetes:\n        role: dev\n        mountPath: /v1/auth/kind-dev2-dev\n        serviceAccountRef:\n          name: dev\n```\n\n### cert-manager Certificate\n\n```yaml\napiVersion: cert-manager.io/v1\nkind: Certificate\nmetadata:\n  name: my-app-tls\n  namespace: default\nspec:\n  secretName: my-app-tls\n  issuerRef:\n    name: vault-issuer\n    kind: ClusterIssuer\n  commonName: myapp.example.com\n  dnsNames:\n    - myapp.example.com\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003e\u003cb\u003eDEPLOY VAULT SERVER IN DEV MODE\u003c/b\u003e\u003c/summary\u003e\n\nDeploys a Vault server in dev mode — automatically initialized and unsealed with in-memory storage. No auto-unseal operator needed. Useful for development and testing.\n\n\u003e **Note:** Dev mode uses in-memory storage — all data is lost on pod restart. Do not use in production.\n\n```hcl\nmodule \"vault-base-setup\" {\n  source                 = \"github.com/stuttgart-things/vault-base-setup\"\n  vault_addr             = \"https://vault.example.com\"\n  cluster_name           = \"my-cluster\"\n  context                = \"default\"\n  skip_tls_verify        = true\n  kubeconfig_path        = \"/home/sthings/.kube/my-cluster\"\n  vault_enabled          = true\n  vault_dev_mode         = true\n  vault_dev_root_token   = \"root\"\n  vault_injector_enabled = false\n  namespace_vault        = \"vault\"\n  vault_storage_class    = \"openebs-hostpath\"\n  csi_enabled            = false\n  vso_enabled            = false\n}\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003e\u003cb\u003eDEPLOY VAULT SERVER (BITNAMI)\u003c/b\u003e\u003c/summary\u003e\n\nDeploys a Vault server using the Bitnami Helm chart. When `vault_autounseal_enabled` is set to `true`, the [vault-autounseal](https://github.com/pytoshka/vault-autounseal) chart is deployed alongside Vault to automatically initialize and unseal the server. Unseal keys and root token are stored as Kubernetes secrets (`vault-keys` and `vault-root-token`) in the Vault namespace.\n\n```hcl\nmodule \"vault-base-setup\" {\n  source                   = \"github.com/stuttgart-things/vault-base-setup\"\n  vault_addr               = \"https://vault.example.com\"\n  cluster_name             = \"my-cluster\"\n  context                  = \"default\"\n  skip_tls_verify          = true\n  kubeconfig_path          = \"/home/sthings/.kube/my-cluster\"\n  vault_enabled            = true\n  vault_injector_enabled   = false\n  namespace_vault          = \"vault\"\n  vault_storage_class      = \"openebs-hostpath\"\n  vault_autounseal_enabled = true\n  csi_enabled              = false\n  vso_enabled              = false\n}\n```\n\nRetrieve the root token after deployment:\n\n```bash\nkubectl get secret vault-root-token -n vault -o jsonpath='{.data.root_token}' | base64 -d\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003e\u003cb\u003eDEPLOY VAULT SERVER WITH INGRESS/TLS\u003c/b\u003e\u003c/summary\u003e\n\n```hcl\nmodule \"vault-base-setup\" {\n  source                    = \"github.com/stuttgart-things/vault-base-setup\"\n  vault_addr                = \"https://vault.demo-infra.example.com\"\n  cluster_name              = \"my-cluster\"\n  context                   = \"default\"\n  skip_tls_verify           = true\n  kubeconfig_path           = \"/home/sthings/.kube/my-cluster\"\n  vault_enabled             = true\n  vault_injector_enabled    = false\n  namespace_vault           = \"vault\"\n  vault_storage_class       = \"openebs-zfs\"\n  vault_autounseal_enabled  = true\n  vault_ingress_enabled     = true\n  vault_ingress_class       = \"nginx\"\n  vault_ingress_hostname    = \"vault.demo-infra.example.com\"\n  vault_ingress_issuer_name = \"cluster-issuer-approle\"\n  vault_ingress_issuer_kind = \"ClusterIssuer\"\n  csi_enabled               = false\n  vso_enabled               = false\n}\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003e\u003cb\u003eDEPLOY VAULT SERVER WITH GATEWAY API\u003c/b\u003e\u003c/summary\u003e\n\n```hcl\nmodule \"vault-base-setup\" {\n  source                   = \"github.com/stuttgart-things/vault-base-setup\"\n  vault_addr               = \"https://vault.whatever.sthings-vsphere.labul.sva.de\"\n  cluster_name             = \"my-cluster\"\n  context                  = \"default\"\n  skip_tls_verify          = true\n  kubeconfig_path          = \"/home/sthings/.kube/my-cluster\"\n  vault_enabled            = true\n  vault_injector_enabled   = false\n  namespace_vault          = \"vault\"\n  vault_storage_class      = \"openebs-hostpath\"\n  vault_autounseal_enabled = true\n  vault_gateway_enabled    = true\n  vault_gateway_hostname   = \"vault.whatever.sthings-vsphere.labul.sva.de\"\n  vault_gateway_name       = \"whatever-gateway\"\n  vault_gateway_namespace  = \"default\"\n  vault_gateway_section    = \"https\"\n  csi_enabled              = false\n  vso_enabled              = false\n}\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003e\u003cb\u003ePKI CA BOOTSTRAP WORKFLOW\u003c/b\u003e\u003c/summary\u003e\n\nWhen Vault is the PKI CA but needs TLS on its own ingress, use the bootstrap workflow: deploy cert-manager with a self-signed CA first, then configure Vault PKI and create a Vault-backed ClusterIssuer.\n\n**Two-phase apply required:** Phase 1 deploys cert-manager + bootstrap CA + Vault. Phase 2 configures PKI + Vault ClusterIssuer.\n\n```hcl\nmodule \"vault-base-setup\" {\n  source          = \"github.com/stuttgart-things/vault-base-setup\"\n  vault_addr      = \"https://vault.demo-infra.example.com\"\n  cluster_name    = \"my-cluster\"\n  context         = \"default\"\n  skip_tls_verify = true\n  kubeconfig_path = \"/home/sthings/.kube/my-cluster\"\n\n  # Vault with auto-unseal + ingress\n  vault_enabled            = true\n  vault_injector_enabled   = false\n  namespace_vault          = \"vault\"\n  vault_storage_class      = \"openebs-zfs\"\n  vault_autounseal_enabled = true\n  vault_ingress_enabled    = true\n  vault_ingress_class      = \"nginx\"\n  vault_ingress_hostname   = \"vault.demo-infra.example.com\"\n\n  # cert-manager + bootstrap CA (auto-wires ingress issuer)\n  certmanager_enabled           = true\n  certmanager_bootstrap_enabled = true\n\n  # PKI + Vault ClusterIssuer (second apply)\n  pki_enabled      = true\n  pki_common_name  = \"example.com\"\n  pki_organization = \"My Org\"\n  pki_roles = [\n    {\n      name             = \"example-dot-com\"\n      allowed_domains  = [\"example.com\"]\n      allow_subdomains = true\n      max_ttl          = \"720h\"\n    }\n  ]\n  certmanager_vault_issuer_enabled  = true\n  certmanager_vault_issuer_pki_role = \"example-dot-com\"\n\n  csi_enabled = false\n  vso_enabled = false\n}\n```\n\n```bash\n# Phase 1\nterraform apply \\\n  -target=helm_release.cert_manager \\\n  -target=kubectl_manifest.bootstrap_ca_clusterissuer \\\n  -target=helm_release.vault \\\n  -target=helm_release.vault_autounseal\n\n# Phase 2 (after Vault is unsealed)\nexport VAULT_TOKEN=$(kubectl get secret vault-root-token -n vault -o jsonpath='{.data.root_token}' | base64 -d)\nterraform apply\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003e\u003cb\u003eVAULT CLUSTERISSUER (FLUX-MANAGED CERT-MANAGER / CROSS-CLUSTER)\u003c/b\u003e\u003c/summary\u003e\n\nUse the Vault ClusterIssuer without deploying cert-manager or the PKI engine through this module. This is useful when:\n\n- cert-manager is managed by Flux (or another GitOps tool)\n- The PKI engine already exists on a remote Vault instance\n- You want to issue certificates on an edge cluster from a central Vault\n\n### Same-cluster with Flux-managed cert-manager\n\nWhen Vault runs in the same cluster and cert-manager is deployed externally (e.g. via Flux), use the internal cluster URL to avoid TLS/caBundle requirements:\n\n```hcl\nmodule \"vault-base-setup\" {\n  source          = \"github.com/stuttgart-things/vault-base-setup\"\n  vault_addr      = \"https://vault.example.com\"\n  skip_tls_verify = true\n  kubeconfig_path = \"/path/to/kubeconfig\"\n  cluster_name    = \"my-cluster\"\n\n  csi_enabled = false\n  vso_enabled = false\n\n  pki_enabled      = true\n  pki_path         = \"pki\"\n  pki_common_name  = \"example.com\"\n  pki_organization = \"My Org\"\n  pki_roles = [\n    {\n      name             = \"example-dot-com\"\n      allowed_domains  = [\"example.com\"]\n      allow_subdomains = true\n      max_ttl          = \"720h\"\n    }\n  ]\n\n  certmanager_vault_issuer_enabled  = true\n  certmanager_vault_issuer_pki_role = \"example-dot-com\"\n  certmanager_vault_issuer_server   = \"http://vault-server.vault.svc.cluster.local:8200\"\n}\n```\n\n### Cross-cluster (edge cluster → remote Vault)\n\nWhen the PKI engine already exists on a remote Vault, set `pki_enabled = false` and provide the policy name and CA bundle explicitly:\n\n```hcl\nmodule \"vault-base-setup\" {\n  source          = \"github.com/stuttgart-things/vault-base-setup\"\n  vault_addr      = \"https://vault.k3s-infra.example.com\"\n  skip_tls_verify = true\n  kubeconfig_path = \"/path/to/edge-kubeconfig\"\n  cluster_name    = \"edge-cluster\"\n\n  csi_enabled = false\n  vso_enabled = false\n  pki_enabled = false\n\n  certmanager_vault_issuer_enabled     = true\n  certmanager_vault_issuer_pki_role    = \"k3s-infra\"\n  certmanager_vault_issuer_server      = \"https://vault.k3s-infra.example.com\"\n  certmanager_vault_issuer_ca_bundle   = var.vault_ca_bundle\n  certmanager_vault_issuer_policy_name = \"pki-issue\"\n}\n```\n\nThe `vault_ca_bundle` variable should contain the base64-encoded PEM of the CA that signed the Vault ingress TLS certificate.\n\n### Variables Reference\n\n| Variable | Type | Default | Description |\n|----------|------|---------|-------------|\n| `certmanager_vault_issuer_enabled` | bool | `false` | Create Vault-backed ClusterIssuer |\n| `certmanager_vault_issuer_name` | string | `\"vault-pki\"` | ClusterIssuer name |\n| `certmanager_vault_issuer_pki_role` | string | `\"\"` | PKI role for certificate issuance |\n| `certmanager_vault_issuer_server` | string | `\"\"` | Vault URL (defaults to `vault_addr`) |\n| `certmanager_vault_issuer_ca_bundle` | string | `\"\"` | Base64-encoded CA bundle (falls back to bootstrap CA, then omitted) |\n| `certmanager_vault_issuer_policy_name` | string | `\"\"` | Vault policy name (defaults to `pki_policy_name`) |\n| `certmanager_vault_issuer_namespace` | string | `\"cert-manager\"` | Namespace for the token secret |\n| `certmanager_vault_token_ttl` | string | `\"720h\"` | Vault token TTL |\n| `certmanager_vault_token_secret_name` | string | `\"vault-pki-token\"` | K8s secret name for the token |\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003e\u003cb\u003eCSI PROVIDER EXAMPLE APPLICATION\u003c/b\u003e\u003c/summary\u003e\n\n### SecretProviderClass\n\n```yaml\napiVersion: secrets-store.csi.x-k8s.io/v1\nkind: SecretProviderClass\nmetadata:\n  name: vault-lab-creds\n  namespace: default\nspec:\n  provider: vault\n  parameters:\n    objects: |\n      - objectName: \"lab\"\n        secretPath: \"env/data/labul\"\n        secretKey: \"lab\"\n    roleName: dev\n    vaultAddress: https://vault.dev11.4sthings.tiab.ssc.sva.de\n    vaultKubernetesMountPath: utah-dev\n    vaultSkipTLSVerify: \"true\"\n```\n\n### Example Deployment\n\n```yaml\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: app3\n  labels:\n    app: demo\nspec:\n  selector:\n    matchLabels:\n      app: demo\n  replicas: 1\n  template:\n    metadata:\n      labels:\n        app: demo\n    spec:\n      serviceAccountName: dev\n      containers:\n        - name: app\n          image: nginx\n          volumeMounts:\n            - name: 'vault-user-creds'\n              mountPath: '/mnt/secrets-store'\n              readOnly: true\n      volumes:\n        - name: vault-user-creds\n          csi:\n            driver: 'secrets-store.csi.k8s.io'\n            readOnly: true\n            volumeAttributes:\n              secretProviderClass: 'vault-lab-creds'\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003eCALL MODULE W/ VALUES\u003c/summary\u003e\n\n```hcl\nmodule \"vault-base-setup\" {\n  source = \"github.com/stuttgart-things/vault-base-setup\"\n  createDefaultAdminPolicy = true\n  secret_engines = [\n    {\n      path         = \"cloud\"\n      name         = \"vsphere\"\n      description  = \"vsphere secrets\",\n      data_json    = \u003c\u003cEOT\n      {\n        \"ip\": \"10.31.101.51\"\n      }\n      EOT\n    },\n    {\n      path         = \"apps\"\n      name         = \"s3\"\n      description  = \"minio s3 secrets\"\n      data_json    = \u003c\u003cEOT\n      {\n        \"accessKey\": \"this\",\n        \"secretKey\": \"andThat\" # pragma: allowlist secret\n      }\n      EOT\n    }\n  ]\n  kv_policies = [\n    {\n      name         = \"read-all-s3-kvv2\"\n      capabilities = \u003c\u003cEOF\npath \"s3-*/*\" {\n    capabilities = [\"list\", \"read\"]\n}\nEOF\n    },\n    {\n      name         = \"read-write-all-s3-kvv2\"\n      capabilities = \u003c\u003cEOF\npath \"s3-*/*\" {\n    capabilities = [\"create\", \"read\", \"update\", \"patch\", \"list\"]\n}\nEOF\n    }\n  ]\n  enableApproleAuth = true\n  approle_roles = [\n    {\n      name         = \"s3\"\n      token_policies = [\"read-all-s3-kvv2\", \"read-write-all-s3-kvv2\"]\n    },\n    {\n      name         = \"s4\"\n      token_policies = [\"read-all-s3-kvv2\"]\n    }\n  ]\n  enableUserPass = true\n  user_list = [\n    {\n      path         = \"auth/userpass/users/user1\"\n      data_json    = \u003c\u003cEOT\n      {\n        \"password\": \"helloGitHub\", # pragma: allowlist secret\n        \"policies\": \"\"read-all-s3-kvv2\", \"read-write-all-s3-kvv2\", \"admin\"\n      }\n      EOT\n  }\n  ]\n  kubeconfig_path = \"/home/sthings/.kube/labda-app\"\n  k8s_auths = [\n    {\n      name = \"dev\"\n      namespace = \"default\"\n      token_policies = [\"read-all-s3-kvv2\", \"read-write-all-s3-kvv2\"]\n      token_ttl = 3600\n    },\n    {\n      name = \"cicd\"\n      namespace = \"tektoncd\"\n      token_policies = [\"read-all-tektoncd-kvv2\"]\n      token_ttl = 3600\n    }\n  ]\n}\n\noutput \"role_id\" {\n    value = module.vault-base-setup.role_id\n}\n\noutput \"secret_id\" {\n    value = module.vault-base-setup.secret_id\n}\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003eEXECUTE TERRAFORM\u003c/summary\u003e\n\n```bash\nexport VAULT_ADDR=${VAULT_ADDR}\nexport VAULT_TOKEN=${VAULT_TOKEN}\n\nterraform init\nterraform validate\nterraform plan\nterraform apply\n```\n\n\u003c/details\u003e\n\n## Author Information\n\n```bash\nXiaomin Lai, stuttgart-things 10/2023\nPatrick Hermann, stuttgart-things 12/2023\n```\n\n## License\n\nLicensed under the Apache License, Version 2.0 (the \"License\").\n\nYou may obtain a copy of the License at [apache.org/licenses/LICENSE-2.0](http://www.apache.org/licenses/LICENSE-2.0).\n\nUnless required by applicable law or agreed to in writing, software distributed under the License is distributed on an _\"AS IS\"_ basis, without WARRANTIES or conditions of any kind, either express or implied.\n\nSee the License for the specific language governing permissions and limitations under the License.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstuttgart-things%2Fvault-base-setup","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstuttgart-things%2Fvault-base-setup","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstuttgart-things%2Fvault-base-setup/lists"}