fix(vault): switch storage

[jazzlyn]

No description provided.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[tyriis-automation]

--- kubernetes/talos-flux/apps/secops/vault/app Kustomization: flux-system/vault HelmRelease: secops/vault

+++ kubernetes/talos-flux/apps/secops/vault/app Kustomization: flux-system/vault HelmRelease: secops/vault

@@ -50,43 +50,46 @@

         storageClass: ceph-block
       extraEnvironmentVars:
         TZ: Europe/Vienna
       extraLabels:
         reloader.stakater.com/auto: 'true'
       ha:
-        config: |
-          # api_addr = "http://127.0.0.1:8200"
-          # cluster_addr = "https://127.0.0.1:8201"
-          disable_mlock = true
-          ui = true
-          # seal "gcpckms" {
-          #   disabled    = "false"
-          #   project     = "techtales"
-          #   region      = "europe-west3"
-          #   key_ring    = "home-infra"
-          #   crypto_key  = "vault-unseal"
-          # }
-          listener "tcp" {
-            tls_disable = 1
-            address = "[::]:8200"
-            cluster_address = "[::]:8201"
-            telemetry {
-              unauthenticated_metrics_access = "true"
+        enabled: true
+        raft:
+          config: |
+            # api_addr = "http://127.0.0.1:8200"
+            # cluster_addr = "https://127.0.0.1:8201"
+            disable_mlock = true
+            ui = true
+            # seal "gcpckms" {
+            #   disabled    = "false"
+            #   project     = "techtales"
+            #   region      = "europe-west3"
+            #   key_ring    = "home-infra"
+            #   crypto_key  = "vault-unseal"
+            # }
+            listener "tcp" {
+              tls_disable = 1
+              address = "[::]:8200"
+              cluster_address = "[::]:8201"
+              telemetry {
+                unauthenticated_metrics_access = "true"
+              }
             }
-          }
-          storage "file" {
-            path = "/vault/data"
-          }
-          # storage "raft" {
-          #   path = "/vault/data"
-          #   # retry_join {
-          #   #   leader_api_addr = "http://vault-0.vault-internal:8200"
-          #   # }
-          # }
-          service_registration "kubernetes" {}
-        enabled: true
+            # storage "file" {
+            #   path = "/vault/data"
+            # }
+            storage "raft" {
+              path = "/vault/data"
+              # retry_join {
+              #   leader_api_addr = "http://vault-0.vault-internal:8200"
+              # }
+            }
+            service_registration "kubernetes" {}
+          enabled: true
+          setNodeId: true
         replicas: 1
       ingress:
         annotations:
           cert-manager.io/cluster-issuer: letsencrypt-staging
           kubernetes.io/tls-acme: 'true'
           nginx.ingress.kubernetes.io/force-ssl-redirect: 'true'

[tyriis-automation]

--- HelmRelease: secops/vault ConfigMap: secops/vault-config

+++ HelmRelease: secops/vault ConfigMap: secops/vault-config

@@ -26,19 +26,19 @@

       address = "[::]:8200"
       cluster_address = "[::]:8201"
       telemetry {
         unauthenticated_metrics_access = "true"
       }
     }
-    storage "file" {
+    # storage "file" {
+    #   path = "/vault/data"
+    # }
+    storage "raft" {
       path = "/vault/data"
+      # retry_join {
+      #   leader_api_addr = "http://vault-0.vault-internal:8200"
+      # }
     }
-    # storage "raft" {
-    #   path = "/vault/data"
-    #   # retry_join {
-    #   #   leader_api_addr = "http://vault-0.vault-internal:8200"
-    #   # }
-    # }
     service_registration "kubernetes" {}
 
     disable_mlock = true
 
--- HelmRelease: secops/vault StatefulSet: secops/vault

+++ HelmRelease: secops/vault StatefulSet: secops/vault

@@ -102,23 +102,29 @@

         - name: HOSTNAME
           valueFrom:
             fieldRef:
               fieldPath: metadata.name
         - name: VAULT_CLUSTER_ADDR
           value: https://$(HOSTNAME).vault-internal:8201
+        - name: VAULT_RAFT_NODE_ID
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
         - name: HOME
           value: /home/vault
         - name: VAULT_LOG_LEVEL
           value: info
         - name: VAULT_LOG_FORMAT
           value: json
         - name: TZ
           value: Europe/Vienna
         volumeMounts:
         - name: audit
           mountPath: /vault/audit
+        - name: data
+          mountPath: /vault/data
         - name: config
           mountPath: /vault/config
         - name: home
           mountPath: /home/vault
         ports:
         - containerPort: 8200
@@ -144,12 +150,21 @@

               command:
               - /bin/sh
               - -c
               - sleep 5 && kill -SIGTERM $(pidof vault)
   volumeClaimTemplates:
   - metadata:
+      name: data
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 1Gi
+      storageClassName: ceph-block
+  - metadata:
       name: audit
     spec:
       accessModes:
       - ReadWriteOnce
       resources:
         requests:

[tyriis-automation]

🦙 MegaLinter status: ✅ SUCCESS

Descriptor	Linter	Files	Fixed	Errors	Elapsed time
✅ EDITORCONFIG	editorconfig-checker	1		0	0.01s
✅ REPOSITORY	gitleaks	yes		no	3.13s
✅ YAML	prettier	1		0	0.37s
✅ YAML	yamllint	1		0	0.3s

See detailed report in MegaLinter reports
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

MegaLinter is graciously provided by OX Security