https://github.com/upbound/platform-ref-multi-vault
Crossplane configuration for running Vault on Google Kubernetes Engine (GKE)
https://github.com/upbound/platform-ref-multi-vault
Last synced: about 1 year ago
JSON representation
Crossplane configuration for running Vault on Google Kubernetes Engine (GKE)
- Host: GitHub
- URL: https://github.com/upbound/platform-ref-multi-vault
- Owner: upbound
- Created: 2021-04-06T09:11:03.000Z (about 5 years ago)
- Default Branch: main
- Last Pushed: 2024-01-22T21:48:39.000Z (over 2 years ago)
- Last Synced: 2025-05-08T07:41:00.937Z (about 1 year ago)
- Homepage: https://www.youtube.com/watch?v=vYQY_ej7AfI&t=770s
- Size: 48.8 KB
- Stars: 12
- Watchers: 23
- Forks: 4
- Open Issues: 5
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Crossplane Configuration for HashiCorp Vault
This Crossplane Configuration defines compositions to run
a highly available Vault.
Currently, this configuration only supports GCP. It provides a control plane API to provision fully configured GKE clusters,
with secure networking, and a highly available Vault backed by a GCS bucket and
configured to auto unseal with Cloud KMS using GCP workload identity -- all
composed using cloud service primitives from the [Crossplane GCP
Provider](https://doc.crds.dev/github.com/crossplane/provider-gcp). App
deployments can securely connect to the infrastructure they need using
secrets distributed directly to the app namespace.
## Quick Start
#### Install the Crossplane kubectl extension (for convenience)
```console
curl -sL https://raw.githubusercontent.com/crossplane/crossplane/master/install.sh | sh
cp kubectl-crossplane /usr/local/bin
```
#### Install the Platform Configuration
```console
CONFIGURATION_PACKAGE=registry.upbound.io/upbound/platform-ref-multi-vault:v0.1.0
kubectl crossplane install configuration ${CONFIGURATION_PACKAGE}
kubectl get pkg
```
#### GCP Provider Setup
Set up your GCP account keyfile by following the instructions on:
https://crossplane.io/docs/v1.0/getting-started/install-configure.html#select-provider
Ensure that the following roles are added to your service account:
* `roles/compute.networkAdmin`
* `roles/container.admin`
* `roles/iam.serviceAccountUser`
Then create the secret using the given `creds.json` file:
```console
kubectl create secret generic gcp-creds -n crossplane-system --from-file=key=./creds.json
```
Create the `ProviderConfig`, ensuring to set the `projectID` to your specific GCP project:
```console
kubectl apply -f examples/provider-default-gcp.yaml
```
## Building Configuration Package
Create a `Repository` called `platform-ref-multi-vault` in your Upbound Cloud `Organization`.
Set these to match your settings:
```console
UPBOUND_ORG=acme
UPBOUND_ACCOUNT_EMAIL=me@acme.io
REPO=platform-ref-multi-vault
VERSION_TAG=v0.0.1
REGISTRY=registry.upbound.io
PLATFORM_CONFIG=${REGISTRY:+$REGISTRY/}${UPBOUND_ORG}/${REPO}:${VERSION_TAG}
```
Clone the GitHub repo.
```console
git clone https://github.com/upbound/platform-ref-multi-vault.git
cd platform-ref-multi-vault
```
Login to your container registry.
```console
docker login ${REGISTRY} -u ${UPBOUND_ACCOUNT_EMAIL}
```
Build package.
```console
kubectl crossplane build configuration --name package.xpkg --package-root configuration
```
Push package to registry.
```console
kubectl crossplane push configuration ${PLATFORM_CONFIG} -f configuration/package.xpkg
```
Install package into an Upbound `Platform` instance.
```console
kubectl crossplane install configuration ${PLATFORM_CONFIG}
```
The cloud service primitives that can be used in a `Composition` today are
listed in the Crossplane provider docs:
* [Crossplane GCP Provider](https://doc.crds.dev/github.com/crossplane/provider-gcp)
To learn more see [Configuration
Packages](https://crossplane.io/docs/v0.14/getting-started/package-infrastructure.html).