Skip to content

feat(vault): Add example secret to mvp vcluster + README

Context

  • Minimal example of making a Vault secret accessible in a nomad job (OpenProject task 1036)
  • Any security implications are out of scope for this example (followed up in task 1556)
  • Depends on vs-example!6 (merged)

Impact

  • Added manual steps to the README for running the vcluster mvp example with a secret

Test(s)

  • Create the vc-shared-services base infrastructure
  • Make sure to test this branch with the vs-example branch from vs-example!6 (merged)
  • Follow the Readme in this MR to set up port forwarding + secret as needed
  • After terraform apply, log in to Nomad and check the logs for the echo job. The example secret should be printed there: nomad-login

Known issues

  • It is a manual step to add a Vault secret
  • For production, this example needs to be followed up with a more secure version
    • No secrets printing in cleartext
    • Ensure HTTPS for vault access
    • The secret should be sensitive inside Terraform
    • To be checked if the Vault token or secret are logged or stored somewhere in Terraform
    • To be checked if the secret is handled securely besides the above points
  • The security issues are followed up in task 1556

Links

  • OpenProject task 1036
Edited by Carolina Lindqvist

Merge request reports

Loading