Vault

{{- /*
Bootstrap Job — turns the once-manual Vault setup (kv mount, policies,
userpass, kubernetes auth, jwt auth) into version-controlled, idempotent
Helm resources. Runs on every install/upgrade via Helm hooks; ArgoCD
honors these.

Requires a Secret named `vault-bootstrap` in the `vault` namespace with
keys `root-token` (an admin-capable Vault token) and `admin-password`
(the userpass password for admin_user). Create it once:
  kubectl -n vault create secret generic vault-bootstrap \
    --from-literal=root-token='...' \
    --from-literal=admin-password='...'
*/}}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: vault-bootstrap
  namespace: vault
  annotations:
    "helm.sh/hook": post-install,post-upgrade
    "helm.sh/hook-weight": "-20"
    # Persist: the long-lived token Secret references this SA.
    "helm.sh/hook-delete-policy": before-hook-creation
---
# Long-lived token for vault-bootstrap, used as Vault's token_reviewer_jwt.
# The Job's own projected SA token expires shortly after the pod completes,
# which breaks Vault's TokenReview (→ auth/kubernetes/login "permission
# denied"). A static kubernetes.io/service-account-token Secret stays valid
# until deleted.
apiVersion: v1
kind: Secret
metadata:
  name: vault-bootstrap-token
  namespace: vault
  annotations:
    kubernetes.io/service-account.name: vault-bootstrap
    "helm.sh/hook": post-install,post-upgrade
    "helm.sh/hook-weight": "0"
    # Persist across syncs: the token must stay stable because Vault's
    # token_reviewer_jwt references it. Deleting it after the hook (as with
    # hook-succeeded) invalidates TokenReview on the next sync.
    "helm.sh/hook-delete-policy": before-hook-creation
type: kubernetes.io/service-account-token
---
# Grants the bootstrap SA's token the ability to perform TokenReview,
# which Vault's kubernetes auth config requires as token_reviewer_jwt.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: vault-bootstrap-tokenreview
  annotations:
    "helm.sh/hook": post-install,post-upgrade
    "helm.sh/hook-weight": "-10"
    # Persist: the bootstrap SA needs TokenReview permission on re-runs.
    "helm.sh/hook-delete-policy": before-hook-creation
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
  - kind: ServiceAccount
    name: vault-bootstrap
    namespace: vault
---
apiVersion: batch/v1
kind: Job
metadata:
  name: vault-bootstrap
  namespace: vault
  annotations:
    "helm.sh/hook": post-install,post-upgrade
    "helm.sh/hook-weight": "10"
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
spec:
  template:
    metadata:
      name: vault-bootstrap
    spec:
      restartPolicy: Never
      serviceAccountName: vault-bootstrap
      containers:
        - name: bootstrap
          image: hashicorp/vault:1.20.1
          command: ["/bin/sh", "-ec"]
          args:
            - |
              export VAULT_ADDR=http://vault:8200
              export VAULT_TOKEN="${VAULT_ROOT_TOKEN}"

              # Wait until Vault is reachable and unsealed (60x2s).
              for i in $(seq 1 60); do
                if vault status -format=json 2>/dev/null | grep -q '"sealed":false'; then
                  break
                fi
                sleep 2
              done
              vault status >/dev/null 2>&1 || { echo "Vault not ready/unsealed after 120s"; exit 1; }

              echo "== kv mount =="
              vault secrets list -format=json 2>/dev/null | grep -q '"opi5-cluster/"' || vault secrets enable -path=opi5-cluster -version=2 kv

              echo "== policies =="
              vault policy read admin >/dev/null 2>&1 || printf '%s' $'path "*" {\n  capabilities = ["create", "read", "update", "delete", "list", "sudo"]\n}\n' | vault policy write admin -
              vault policy read reader >/dev/null 2>&1 || printf '%s' $'path "*" {\n  capabilities = ["read", "list"]\n}\n' | vault policy write reader -

              echo "== userpass =="
              vault auth list -format=json 2>/dev/null | grep -q '"userpass/"' || vault auth enable userpass
              vault write "auth/userpass/users/${ADMIN_USER}" password="${ADMIN_PASSWORD}" policies="admin"

              echo "== kubernetes auth =="
              vault auth list -format=json 2>/dev/null | grep -q '"kubernetes/"' || vault auth enable kubernetes
              # Host/cert are self-served from the job's own service account.
              # token_reviewer_jwt uses the long-lived vault-bootstrap-token
              # (a projected SA token would expire and break TokenReview).
              vault write auth/kubernetes/config \
                token_reviewer_jwt="$(cat /var/run/secrets/bootstrap-token/token)" \
                kubernetes_host="https://kubernetes.default.svc.cluster.local:443" \
                kubernetes_ca_cert="$(cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt)" \
                disable_issuer_verification=true

              # audience is derived from the job's own SA token so it always
              # matches the cluster's actual token audience (hardcoding it
              # broke ESO login with "audience claim does not match").
              # Decoded in pure shell (vault image has no python/jq/-E).
              AUDIENCE="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token \
                | cut -d. -f2 \
                | tr '_-' '/+' \
                | base64 -d 2>/dev/null \
                | sed -n 's/.*"aud":\[*"\([^"]*\)".*/\1/p')"
              vault write auth/kubernetes/role/k3s-role \
                bound_service_account_names="*" \
                bound_service_account_namespaces="*" \
                policies=reader \
                ttl=1h \
                audience="${AUDIENCE}"

              echo "== jwt (GitLab CI) =="
              vault auth list -format=json 2>/dev/null | grep -q '"jwt/"' || vault auth enable jwt
              vault write auth/jwt/config \
                oidc_discovery_url="https://gitlab.com" \
                bound_issuer="https://gitlab.com"
              printf '%s' $'{\n  "role_type": "jwt",\n  "policies": ["reader"],\n  "token_explicit_max_ttl": 60,\n  "user_claim": "user_email",\n  "bound_audiences": "https://vault.opi5cluster.co.uk",\n  "bound_claims_type": "glob",\n  "bound_claims": {\n    "namespace_id": "{{ .Values.bootstrap.gitlabNamespaceId }}"\n  }\n}\n' | vault write auth/jwt/role/gitlab-role -

              echo "bootstrap complete"
          env:
            - name: VAULT_ROOT_TOKEN
              valueFrom:
                secretKeyRef:
                  name: vault-bootstrap
                  key: root-token
            - name: ADMIN_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: vault-bootstrap
                  key: admin-password
            - name: ADMIN_USER
              valueFrom:
                secretKeyRef:
                  name: vault-bootstrap
                  key: admin-username
          volumeMounts:
            - name: bootstrap-token
              mountPath: /var/run/secrets/bootstrap-token
              readOnly: true
      volumes:
        - name: bootstrap-token
          secret:
            secretName: vault-bootstrap-token

apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: vault-cluster-secret-store
spec:
  provider:
    vault:
      server: http://vault.vault.svc.cluster.local:8200
      path: opi5-cluster
      version: v2
      auth:
        kubernetes:
          mountPath: kubernetes
          role: k3s-role

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: vault-httproute
  namespace: vault
  annotations:
    link.argocd.argoproj.io/external-link: "https://vault.opi5cluster.co.uk"
spec:
  parentRefs:
    - name: istio-gateway
      namespace: istio
      sectionName: websecure
  hostnames:
    - vault.opi5cluster.co.uk
  rules:
    - backendRefs:
        - name: vault-ui
          port: 8200

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: vault
  name: vault-role
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "update", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: vault-role-binding
  namespace: vault
  labels:
    app: vault
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: vault-role
subjects:
- kind: ServiceAccount
  name: vault-service-account
  namespace: vault