aws k8s backup vault

Thank you for reading this post, don't forget to subscribe!

есть задача забэкапить 2 разных vault в разных namespace использовать будем модуль

infra/terraform-module/aws-vault-snapshot/main.tf

resource "vault_policy" "snapshot" {
  name   = "snapshot"
  policy = <<EOT
path "sys/storage/raft/snapshot" {
   capabilities = ["read"]
}
EOT
}

resource "vault_auth_backend" "approle" {
  type = "approle"
}

resource "vault_approle_auth_backend_role" "snapshot_agent" {
  backend        = vault_auth_backend.approle.path
  role_name      = "snapshot-agent"
  token_ttl      = 7200
  token_policies = [vault_policy.snapshot.name]
}

resource "vault_approle_auth_backend_role_secret_id" "snapshot_agent" {
  backend   = vault_auth_backend.approle.path
  role_name = vault_approle_auth_backend_role.snapshot_agent.role_name
}

resource "kubernetes_secret" "snapshot_agent_vault" {
  metadata {
    name      = "vault-snapshot-agent-vault-creds"
    namespace = var.vault_namespace
  }
  data = {
    VAULT_APPROLE_ROLE_ID   = vault_approle_auth_backend_role.snapshot_agent.role_id
    VAULT_APPROLE_SECRET_ID = vault_approle_auth_backend_role_secret_id.snapshot_agent.secret_id
  }
  type = "Opaque"
}

resource "kubernetes_config_map" "vault_snapshots_create" {
  metadata {
    name      = "vault-snapshots-create"
    namespace = var.vault_namespace
  }
  data = {
    "create.sh" = <<EOF
      #!/bin/sh
      set -e

      export VAULT_TOKEN=$(vault write auth/approle/login role_id=$VAULT_APPROLE_ROLE_ID secret_id=$VAULT_APPROLE_SECRET_ID -format=yaml | grep client_token | awk '{print $2}')
      vault operator raft snapshot save /share/backup_$(date '+%Y-%m-%d_%H-%M-%S').snap
    EOF
  }
}

resource "kubernetes_config_map" "vault_snapshots_upload" {
  metadata {
    name      = "vault-snapshots-upload"
    namespace = var.vault_namespace
  }

  data = {
    "upload.sh" = <<EOF
      #!/bin/sh
      set -e
      yum install -y jq > /dev/null 2>&1
      # Assume the role
      response=$(aws sts assume-role-with-web-identity --role-arn ${var.iam_role_arn} --role-session-name vault-upload --web-identity-token file:///var/run/secrets/eks.amazonaws.com/serviceaccount/token)
      # Parse the credentials from the response
      AccessKeyId=$(echo $response | jq -r .Credentials.AccessKeyId)
      SecretAccessKey=$(echo $response | jq -r .Credentials.SecretAccessKey)
      SessionToken=$(echo $response | jq -r .Credentials.SessionToken)
      # Export the credentials as environment variables
      export AWS_ACCESS_KEY_ID=$AccessKeyId
      export AWS_SECRET_ACCESS_KEY=$SecretAccessKey
      export AWS_SESSION_TOKEN=$SessionToken
      # Upload the snapshot
      until [ -f /share/backup_*.snap ]; do sleep 5; done
      aws s3 cp /share/ s3://$S3_BUCKET_NAME/ --recursive --exclude "*" --include "backup_*.snap"
    EOF
  }
}

resource "kubernetes_cron_job_v1" "vault_snapshots" {
  metadata {
    name      = "vault-snapshots"
    namespace = var.vault_namespace
  }
  spec {
    schedule                      = "*/10 * * * *"
    starting_deadline_seconds     = 50
    concurrency_policy            = "Forbid"
    successful_jobs_history_limit = 1
    failed_jobs_history_limit     = 1

    job_template {
      metadata {}
      spec {
        template {
          metadata {}
          spec {
            service_account_name = "vault-sa"
            container {
              name              = "snapshot-create"
              image             = "hashicorp/vault:1.14.0"
              image_pull_policy = "IfNotPresent"

              command = ["/bin/sh", "-c", "/create.sh"]

              env {
                name  = "VAULT_ADDR"
                value = var.vault_address
              }

              env_from {
                secret_ref {
                  name = kubernetes_secret.snapshot_agent_vault.metadata[0].name
                }
              }

              volume_mount {
                name       = "snapshots-create"
                mount_path = "/create.sh"
                sub_path   = "create.sh"
              }

              volume_mount {
                name       = "share"
                mount_path = "/share"
              }
            }
            container {
              name              = "snapshot-upload"
              image             = "amazon/aws-cli:2.12.6"
              image_pull_policy = "IfNotPresent"

              command = ["/bin/sh", "-c", "/upload.sh"]

              env {
                name  = "S3_BUCKET_NAME"
                value = var.s3_bucket_name
              }
              volume_mount {
                name       = "snapshots-upload"
                mount_path = "/upload.sh"
                sub_path   = "upload.sh"
              }

              volume_mount {
                name       = "share"
                mount_path = "/share"
              }
            }

            restart_policy = "OnFailure"

            volume {
              name = "snapshots-create"
              config_map {
                name         = kubernetes_config_map.vault_snapshots_create.metadata[0].name
                default_mode = "0700"
              }
            }

            volume {
              name = "snapshots-upload"
              config_map {
                name         = kubernetes_config_map.vault_snapshots_upload.metadata[0].name
                default_mode = "0700"
              }
            }

            volume {
              name = "share"
              empty_dir {}
            }
          }
        }
      }
    }
  }
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

resource "vault_policy" "snapshot" {

name = "snapshot"

policy = <<EOT

path "sys/storage/raft/snapshot" {

capabilities = ["read"]

}

EOT

}

resource "vault_auth_backend" "approle" {

type = "approle"

}

resource "vault_approle_auth_backend_role" "snapshot_agent" {

backend = vault_auth_backend.approle.path

role_name = "snapshot-agent"

token_ttl = 7200

token_policies = [vault_policy.snapshot.name]

}

resource "vault_approle_auth_backend_role_secret_id" "snapshot_agent" {

backend = vault_auth_backend.approle.path

role_name = vault_approle_auth_backend_role.snapshot_agent.role_name

}

resource "kubernetes_secret" "snapshot_agent_vault" {

metadata {

name = "vault-snapshot-agent-vault-creds"

namespace = var.vault_namespace

}

data = {

VAULT_APPROLE_ROLE_ID = vault_approle_auth_backend_role.snapshot_agent.role_id

VAULT_APPROLE_SECRET_ID = vault_approle_auth_backend_role_secret_id.snapshot_agent.secret_id

}

type = "Opaque"

}

resource "kubernetes_config_map" "vault_snapshots_create" {

metadata {

name = "vault-snapshots-create"

namespace = var.vault_namespace

}

data = {

"create.sh" = <<EOF

#!/bin/sh

set -e

export VAULT_TOKEN=$(vault write auth/approle/login role_id=$VAULT_APPROLE_ROLE_ID secret_id=$VAULT_APPROLE_SECRET_ID -format=yaml | grep client_token | awk '{print $2}')

vault operator raft snapshot save /share/backup_$(date '+%Y-%m-%d_%H-%M-%S').snap

EOF

}

resource "kubernetes_config_map" "vault_snapshots_upload" {

metadata {

name = "vault-snapshots-upload"

namespace = var.vault_namespace

}

data = {

"upload.sh" = <<EOF

#!/bin/sh

set -e

yum install -y jq > /dev/null 2>&1

# Assume the role

response=$(aws sts assume-role-with-web-identity --role-arn ${var.iam_role_arn} --role-session-name vault-upload --web-identity-token file:///var/run/secrets/eks.amazonaws.com/serviceaccount/token)

# Parse the credentials from the response

AccessKeyId=$(echo $response | jq -r .Credentials.AccessKeyId)

SecretAccessKey=$(echo $response | jq -r .Credentials.SecretAccessKey)

SessionToken=$(echo $response | jq -r .Credentials.SessionToken)

# Export the credentials as environment variables

export AWS_ACCESS_KEY_ID=$AccessKeyId

export AWS_SECRET_ACCESS_KEY=$SecretAccessKey

export AWS_SESSION_TOKEN=$SessionToken

# Upload the snapshot

until [ -f /share/backup_*.snap ]; do sleep 5; done

aws s3 cp /share/ s3://$S3_BUCKET_NAME/ --recursive --exclude "*" --include "backup_*.snap"

EOF

}

resource "kubernetes_cron_job_v1" "vault_snapshots" {

metadata {

name = "vault-snapshots"

namespace = var.vault_namespace

}

spec {

schedule = "*/10 * * * *"

starting_deadline_seconds = 50

concurrency_policy = "Forbid"

successful_jobs_history_limit = 1

failed_jobs_history_limit = 1

job_template {

metadata {}

spec {

template {

metadata {}

spec {

service_account_name = "vault-sa"

container {

name = "snapshot-create"

image = "hashicorp/vault:1.14.0"

image_pull_policy = "IfNotPresent"

command = ["/bin/sh", "-c", "/create.sh"]

env {

name = "VAULT_ADDR"

value = var.vault_address

}

env_from {

secret_ref {

name = kubernetes_secret.snapshot_agent_vault.metadata[0].name

}

volume_mount {

name = "snapshots-create"

mount_path = "/create.sh"

sub_path = "create.sh"

}

volume_mount {

name = "share"

mount_path = "/share"

}

container {

name = "snapshot-upload"

image = "amazon/aws-cli:2.12.6"

image_pull_policy = "IfNotPresent"

command = ["/bin/sh", "-c", "/upload.sh"]

env {

name = "S3_BUCKET_NAME"

value = var.s3_bucket_name

}

volume_mount {

name = "snapshots-upload"

mount_path = "/upload.sh"

sub_path = "upload.sh"

}

volume_mount {

name = "share"

mount_path = "/share"

}

restart_policy = "OnFailure"

volume {

name = "snapshots-create"

config_map {

name = kubernetes_config_map.vault_snapshots_create.metadata[0].name

default_mode = "0700"

}

volume {

name = "snapshots-upload"

config_map {

name = kubernetes_config_map.vault_snapshots_upload.metadata[0].name

default_mode = "0700"

}

volume {

name = "share"

empty_dir {}

}

infra/terraform-module/aws-vault-snapshot/variables.tf

variable "s3_bucket_name" {
  description = "The name of the S3 bucket to upload snapshots to"
  type        = string
}

variable "vault_namespace" {
  description = "The namespace where Vault is deployed"
  type        = string
}

variable "vault_address" {
  description = "The address of the Vault server"
  type        = string
}

variable "iam_role_arn" {
  description = "The ARN of the IAM role to assume for uploading to S3"
  type        = string
}

variable "s3_bucket_name" {

description = "The name of the S3 bucket to upload snapshots to"

type = string

}

variable "vault_namespace" {

description = "The namespace where Vault is deployed"

type = string

}

variable "vault_address" {

description = "The address of the Vault server"

type = string

}

variable "iam_role_arn" {

description = "The ARN of the IAM role to assume for uploading to S3"

type = string

}

infra/terraform-module/aws-vault-snapshot/output.tf

output "snapshot_agent_role_id" {
  description = "Role ID for the snapshot agent AppRole"
  value       = vault_approle_auth_backend_role.snapshot_agent.role_id
}

output "snapshot_agent_secret_id" {
  description = "Secret ID for the snapshot agent AppRole"
  value       = vault_approle_auth_backend_role_secret_id.snapshot_agent.secret_id
}

output "snapshot_agent_secret_name" {
  description = "Name of the Kubernetes secret containing the AppRole credentials"
  value       = kubernetes_secret.snapshot_agent_vault.metadata[0].name
}

output "create_config_map_name" {
  description = "Name of the ConfigMap containing the create script"
  value       = kubernetes_config_map.vault_snapshots_create.metadata[0].name
}

output "upload_config_map_name" {
  description = "Name of the ConfigMap containing the upload script"
  value       = kubernetes_config_map.vault_snapshots_upload.metadata[0].name
}

output "cron_job_name" {
  description = "Name of the Kubernetes CronJob"
  value       = kubernetes_cron_job_v1.vault_snapshots.metadata[0].name
}

output "snapshot_agent_role_id" {

description = "Role ID for the snapshot agent AppRole"

value = vault_approle_auth_backend_role.snapshot_agent.role_id

}

output "snapshot_agent_secret_id" {

description = "Secret ID for the snapshot agent AppRole"

value = vault_approle_auth_backend_role_secret_id.snapshot_agent.secret_id

}

output "snapshot_agent_secret_name" {

description = "Name of the Kubernetes secret containing the AppRole credentials"

value = kubernetes_secret.snapshot_agent_vault.metadata[0].name

}

output "create_config_map_name" {

description = "Name of the ConfigMap containing the create script"

value = kubernetes_config_map.vault_snapshots_create.metadata[0].name

}

output "upload_config_map_name" {

description = "Name of the ConfigMap containing the upload script"

value = kubernetes_config_map.vault_snapshots_upload.metadata[0].name

}

output "cron_job_name" {

description = "Name of the Kubernetes CronJob"

value = kubernetes_cron_job_v1.vault_snapshots.metadata[0].name

}

а вот наш аккаунт

infra/infrastructure/aws/dev/main.tf

data "aws_secretsmanager_secret" "vault_initial_root_token" {
  name     = "dev/vault_initial_root_token"
  provider = aws
}

data "aws_secretsmanager_secret_version" "vault_initial_root_token" {
  secret_id = data.aws_secretsmanager_secret.vault_initial_root_token.id
  provider  = aws
}

provider "vault" {
  address = "https://vault.dev.test.tech"
  token   = data.aws_secretsmanager_secret_version.vault_initial_root_token.secret_string
}

provider "vault" {
  alias   = "vault-test"
  address = "https://vault-test.dev.test.tech"
  token   = data.aws_secretsmanager_secret_version.vault_initial_root_token_test.secret_string
}

data "aws_secretsmanager_secret" "vault_initial_root_token_test" {
  name     = "dev-vault-test/vault_initial_root_token"
  provider = aws
}

data "aws_secretsmanager_secret_version" "vault_initial_root_token_test" {
  secret_id = data.aws_secretsmanager_secret.vault_initial_root_token_test.id
  provider  = aws
}

data "aws_secretsmanager_secret" "vault_initial_root_token" {

name = "dev/vault_initial_root_token"

provider = aws

}

data "aws_secretsmanager_secret_version" "vault_initial_root_token" {

secret_id = data.aws_secretsmanager_secret.vault_initial_root_token.id

provider = aws

}

provider "vault" {

address = "https://vault.dev.test.tech"

token = data.aws_secretsmanager_secret_version.vault_initial_root_token.secret_string

}

provider "vault" {

alias = "vault-test"

address = "https://vault-test.dev.test.tech"

token = data.aws_secretsmanager_secret_version.vault_initial_root_token_test.secret_string

}

data "aws_secretsmanager_secret" "vault_initial_root_token_test" {

name = "dev-vault-test/vault_initial_root_token"

provider = aws

}

data "aws_secretsmanager_secret_version" "vault_initial_root_token_test" {

secret_id = data.aws_secretsmanager_secret.vault_initial_root_token_test.id

provider = aws

}

так как у провайдера указывается домен то добавим ему alias

alias = "vault-test"

infra/infrastructure/aws/dev/vault.tf

### Sealing key ###
resource "aws_kms_key" "vault_dev" {
  description         = "Key for vault dev unseal"
  enable_key_rotation = true

  tags = merge(local.settings.vpc.tags, { Name = "vault_dev" })
}

resource "aws_kms_alias" "vault_dev" {
  name          = "alias/vault-dev"
  target_key_id = aws_kms_key.vault_dev.key_id
}
### End of sealing key ###

### IAM role KMS access for Vault ###
module "iam_assumable_role_vault" {
  source                        = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
  version                       = "5.39.0"
  create_role                   = true
  role_name                     = "${local.name}-sa-vault"
  provider_url                  = replace(module.eks.cluster_oidc_issuer_url, "https://", "")
  role_policy_arns              = [aws_iam_policy.vault.arn]
  oidc_fully_qualified_subjects = ["system:serviceaccount:vault:vault-sa"]
}

resource "aws_iam_policy" "vault" {
  name = "${local.name}-sa-vault-kms"
  policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Sid    = "AllowKMS",
        Effect = "Allow",
        Action = [
          "kms:Encrypt",
          "kms:Decrypt",
          "kms:DescribeKey",
        ],
        Resource = aws_kms_key.vault_dev.arn,
      }
    ]
  })
}
### End ###

### Kubernetes objects ###
resource "kubernetes_namespace" "vault" {
  metadata {
    annotations = {
      name = local.settings.eks.vault_namespace
    }

    name = local.settings.eks.vault_namespace
  }

  provider = kubernetes
}

### TLS Certificate ###
locals {
  vault_tls_secret_name = "vault-tls"
}

resource "kubernetes_manifest" "vault-tls" {
  manifest = yamldecode(<<EOF
    apiVersion: cert-manager.io/v1
    kind: Certificate
    metadata:
      name: "${local.vault_tls_secret_name}"
      namespace: "${kubernetes_namespace.vault.metadata.0.name}"
    spec:
      dnsNames:
        - "${local.settings.dns.vault_dns_name}.${local.settings.dns.base_domain}.${local.settings.dns.tech_domain}"
      secretName: "${local.vault_tls_secret_name}"
      issuerRef:
        name: "${local.settings.certs.prod_issuer_name}"
        kind: ClusterIssuer
  EOF
  )

  provider = kubernetes
}
########################## End of TLS Certificate section ######################################

resource "helm_release" "vault" {
  name             = local.settings.eks.vault_release_name
  repository       = "https://helm.releases.hashicorp.com"
  chart            = "vault"
  version          = local.settings.eks.vault_helm_version
  namespace        = kubernetes_namespace.vault.metadata.0.name
  create_namespace = false

  values = [<<EOF
global:
  enabled: true
  serverTelemetry:
    prometheusOperator: true

injector:
  enabled: false

server:
  resources:
    requests:
      memory: 512Mi
      cpu: 500m
    limits:
      memory: 1024Mi
      cpu: 1000m

  ingress:
    enabled: true
    ingressClassName: "nginx-int"
    pathType: Prefix
    activeService: true
    hosts:
      - host: "${local.settings.dns.vault_dns_name}.${local.settings.dns.base_domain}.${local.settings.dns.tech_domain}"
        paths:
          - /
    tls:
      - secretName: "${local.vault_tls_secret_name}"
        hosts:
          - "${local.settings.dns.vault_dns_name}.${local.settings.dns.base_domain}.${local.settings.dns.tech_domain}"

  nodeSelector:
    dedication: "infra"
  tolerations:
    - key: "dedicated"
      operator: "Equal"
      value: "infra"
      effect: "NoSchedule"

  ha:
    enabled: true
    replicas: 1

    config: |
      ui = true

      telemetry {
        unauthenticated_metrics_access = "true"
        prometheus_retention_time = "24h"
      }

      listener "tcp" {
        tls_disable = 1
        address = "[::]:8200"
        cluster_address = "[::]:8201"
        # Enable unauthenticated metrics access (necessary for Prometheus Operator)
        telemetry {
         unauthenticated_metrics_access = "true"
        }
      }
      storage "postgresql" {
        connection_url = "postgres://vault:${jsondecode(data.aws_secretsmanager_secret_version.dev_rds_db_users-version.secret_string)["vault"]}@${aws_db_instance.dev-db.address}:5432/vault"
        ha_enabled = "true"
        table = "vault_kv_store"
        ha_table = "vault_ha_locks"
      }
      service_registration "kubernetes" {}

      seal "awskms" {
        region     = "${local.settings.vpc.region}"
        kms_key_id = "${aws_kms_key.vault_dev.id}"
      }

  serviceAccount:
    name: "vault-sa"
    annotations:
      eks.amazonaws.com/role-arn: "${module.iam_assumable_role_vault.iam_role_arn}"

serverTelemetry:
  serviceMonitor:
    enabled: true
    interval: 30s
    selectors:
      release: kube-prometheus-stack    

ui:
  enabled: true
  EOF
  ]

  provider = helm
}

############ secret for test ############
resource "vault_mount" "test-secret" {
  path    = "secret/data"
  type    = "kv"
  options = { version = "1" }
}

resource "vault_policy" "test-secret-policy" {
  name = "wbsecret"

  policy = <<EOT
  path "/secret/data/*" {
      capabilities = ["create", "read", "list", "update", "delete"]
  }

  # List available secrets engines to retrieve accessor ID
  path "sys/mounts" {
    capabilities = [ "read" ]
  }
  EOT
}

############ End of secret section ############

### Sealing key ###

resource "aws_kms_key" "vault_test" {
  description         = "Key for vault dev unseal"
  enable_key_rotation = true

  tags = merge(local.settings.vpc.tags, { Name = "vault_test" })
}

resource "aws_kms_alias" "vault_test" {
  name          = "alias/vault-test"
  target_key_id = aws_kms_key.vault_test.key_id
}

### IAM role KMS access for Vault ###
module "iam_assumable_role_vault_test" {
  source                        = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
  version                       = "5.39.0"
  create_role                   = true
  role_name                     = "${local.name}-sa-vault-test"
  provider_url                  = replace(module.eks.cluster_oidc_issuer_url, "https://", "")
  role_policy_arns              = [aws_iam_policy.vault_test.arn]
  oidc_fully_qualified_subjects = ["system:serviceaccount:vault-test:vault-test-sa"]
}

resource "aws_iam_policy" "vault_test" {
  name = "${local.name}-sa-vault-test-kms"
  policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Sid    = "AllowKMS",
        Effect = "Allow",
        Action = [
          "kms:Encrypt",
          "kms:Decrypt",
          "kms:DescribeKey",
        ],
        Resource = aws_kms_key.vault_test.arn,
      }
    ]
  })
}
## End ###

########################## End of TLS Certificate section ######################################

resource "helm_release" "vault_test" {
  name             = "vault-test"
  repository       = "https://helm.releases.hashicorp.com"
  chart            = "vault"
  version          = local.settings.eks.vault_helm_version
  namespace        = "vault-test"
  create_namespace = false

  values = [<<EOF
global:
  enabled: true
  serverTelemetry:
    prometheusOperator: true

injector:
  enabled: false

server:
  updateStrategyType: "RollingUpdate"

  nodeSelector:
    dedication: "infra"
  tolerations:
    - key: "dedicated"
      operator: "Equal"
      value: "infra"
      effect: "NoSchedule"

  resources:
    requests:
      memory: 512Mi
      cpu: 500m
    limits:
      memory: 1024Mi
      cpu: 1000m

  ingress:
    enabled: true
    ingressClassName: "nginx-int"
    pathType: Prefix
    activeService: true
    hosts:
      - host: "vault-test.${local.settings.dns.base_domain}.${local.settings.dns.tech_domain}"
        paths:
          - /
    tls:
      - secretName: "${local.vault_tls_secret_name}"
        hosts:
          - "vault-test.${local.settings.dns.base_domain}.${local.settings.dns.tech_domain}"

  dataStorage:
    size: 10Gi
    storageClass: gp3

  auditStorage:
    enabled: true
    size: 10Gi
    storageClass: gp3

  standalone:
    enabled: false

  ha:
    enabled: true
    replicas: 3

    raft:
      enabled: true
      setNodeId: true

      config: |
        ui = true
        telemetry {
          unauthenticated_metrics_access = "true"
          prometheus_retention_time = "24h"
        }

        listener "tcp" {
          tls_disable = 1
          address = "[::]:8200"
          cluster_address = "[::]:8201"
          # Enable unauthenticated metrics access (necessary for Prometheus Operator)
          telemetry {
            unauthenticated_metrics_access = "true"
          }
        }

        storage "raft" {
          path = "/vault/data"
          retry_join {
            leader_api_addr = "http://vault-test-0.vault-test-internal:8200"
          }
          retry_join {
            leader_api_addr = "http://vault-test-1.vault-test-internal:8200"
          }
          retry_join {
            leader_api_addr = "http://vault-test-2.vault-test-internal:8200"
          }
        }

        service_registration "kubernetes" {}

        seal "awskms" {
          region     = "${local.settings.vpc.region}"
          kms_key_id = "${aws_kms_key.vault_test.id}"
        }

  serviceAccount:
    name: "vault-test-sa"
    annotations:
      eks.amazonaws.com/role-arn: "${module.iam_assumable_role_vault_test.iam_role_arn}"

serverTelemetry:
  serviceMonitor:
    enabled: true
    interval: 30s
    selectors:
      release: kube-prometheus-stack    

ui:
  enabled: true
  EOF
  ]

  provider = helm
}


module "vault_snapshot_module" {
  source          = "../../../terraform-module/aws-vault-snapshot"
  s3_bucket_name  = "test-dev-vault-snapshot"
  vault_namespace = "vault-test"
  vault_address   = "http://vault-test-active.vault-test.svc.cluster.local:8200"
  iam_role_arn    = module.iam_assumable_role_vault_test.iam_role_arn

  providers = {
    vault = vault.vault-test
  }
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

### Sealing key ###

resource "aws_kms_key" "vault_dev" {

description = "Key for vault dev unseal"

enable_key_rotation = true

tags = merge(local.settings.vpc.tags, { Name = "vault_dev" })

}

resource "aws_kms_alias" "vault_dev" {

name = "alias/vault-dev"

target_key_id = aws_kms_key.vault_dev.key_id

}

### End of sealing key ###

### IAM role KMS access for Vault ###

module "iam_assumable_role_vault" {

source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"

version = "5.39.0"

create_role = true

role_name = "${local.name}-sa-vault"

provider_url = replace(module.eks.cluster_oidc_issuer_url, "https://", "")

role_policy_arns = [aws_iam_policy.vault.arn]

oidc_fully_qualified_subjects = ["system:serviceaccount:vault:vault-sa"]

}

resource "aws_iam_policy" "vault" {

name = "${local.name}-sa-vault-kms"

policy = jsonencode({

Version = "2012-10-17",

Statement = [

{

Sid = "AllowKMS",

Effect = "Allow",

Action = [

"kms:Encrypt",

"kms:Decrypt",

"kms:DescribeKey",

Resource = aws_kms_key.vault_dev.arn,

}

]

})

}

### End ###

### Kubernetes objects ###

resource "kubernetes_namespace" "vault" {

metadata {

annotations = {

name = local.settings.eks.vault_namespace

}

name = local.settings.eks.vault_namespace

}

provider = kubernetes

}

### TLS Certificate ###

locals {

vault_tls_secret_name = "vault-tls"

}

resource "kubernetes_manifest" "vault-tls" {

manifest = yamldecode(<<EOF

apiVersion: cert-manager.io/v1

kind: Certificate

metadata:

namespace: "${kubernetes_namespace.vault.metadata.0.name}"

spec:

dnsNames:

- "${local.settings.dns.vault_dns_name}.${local.settings.dns.base_domain}.${local.settings.dns.tech_domain}"

secretName: "${local.vault_tls_secret_name}"

issuerRef:

kind: ClusterIssuer

EOF

)

provider = kubernetes

}

########################## End of TLS Certificate section ######################################

resource "helm_release" "vault" {

name = local.settings.eks.vault_release_name

repository = "https://helm.releases.hashicorp.com"

chart = "vault"

version = local.settings.eks.vault_helm_version

namespace = kubernetes_namespace.vault.metadata.0.name

create_namespace = false

values = [<<EOF

global:

enabled: true

serverTelemetry:

prometheusOperator: true

injector:

enabled: false

server:

resources:

requests:

memory: 512Mi

cpu: 500m

limits:

memory: 1024Mi

cpu: 1000m

ingress:

enabled: true

ingressClassName: "nginx-int"

pathType: Prefix

activeService: true

hosts:

- host: "${local.settings.dns.vault_dns_name}.${local.settings.dns.base_domain}.${local.settings.dns.tech_domain}"

paths:

- /

tls:

- secretName: "${local.vault_tls_secret_name}"

hosts:

- "${local.settings.dns.vault_dns_name}.${local.settings.dns.base_domain}.${local.settings.dns.tech_domain}"

nodeSelector:

dedication: "infra"

tolerations:

- key: "dedicated"

operator: "Equal"

value: "infra"

effect: "NoSchedule"

ha:

enabled: true

replicas: 1

config: |

ui = true

telemetry {

unauthenticated_metrics_access = "true"

prometheus_retention_time = "24h"

}

listener "tcp" {

tls_disable = 1

address = "[::]:8200"

cluster_address = "[::]:8201"

# Enable unauthenticated metrics access (necessary for Prometheus Operator)

telemetry {

unauthenticated_metrics_access = "true"

}

storage "postgresql" {

connection_url = "postgres://vault:${jsondecode(data.aws_secretsmanager_secret_version.dev_rds_db_users-version.secret_string)["vault"]}@${aws_db_instance.dev-db.address}:5432/vault"

ha_enabled = "true"

table = "vault_kv_store"

ha_table = "vault_ha_locks"

}

service_registration "kubernetes" {}

seal "awskms" {

region = "${local.settings.vpc.region}"

kms_key_id = "${aws_kms_key.vault_dev.id}"

}

serviceAccount:

annotations:

eks.amazonaws.com/role-arn: "${module.iam_assumable_role_vault.iam_role_arn}"

serverTelemetry:

serviceMonitor:

enabled: true

interval: 30s

selectors:

release: kube-prometheus-stack

ui:

enabled: true

EOF

]

provider = helm

}

############ secret for test ############

resource "vault_mount" "test-secret" {

path = "secret/data"

type = "kv"

options = { version = "1" }

}

resource "vault_policy" "test-secret-policy" {

name = "wbsecret"

policy = <<EOT

path "/secret/data/*" {

capabilities = ["create", "read", "list", "update", "delete"]

}

# List available secrets engines to retrieve accessor ID

path "sys/mounts" {

capabilities = [ "read" ]

}

EOT

}

############ End of secret section ############

### Sealing key ###

resource "aws_kms_key" "vault_test" {

description = "Key for vault dev unseal"

enable_key_rotation = true

tags = merge(local.settings.vpc.tags, { Name = "vault_test" })

}

resource "aws_kms_alias" "vault_test" {

name = "alias/vault-test"

target_key_id = aws_kms_key.vault_test.key_id

}

### IAM role KMS access for Vault ###

module "iam_assumable_role_vault_test" {

source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"

version = "5.39.0"

create_role = true

role_name = "${local.name}-sa-vault-test"

provider_url = replace(module.eks.cluster_oidc_issuer_url, "https://", "")

role_policy_arns = [aws_iam_policy.vault_test.arn]

oidc_fully_qualified_subjects = ["system:serviceaccount:vault-test:vault-test-sa"]

}

resource "aws_iam_policy" "vault_test" {

name = "${local.name}-sa-vault-test-kms"

policy = jsonencode({

Version = "2012-10-17",

Statement = [

{

Sid = "AllowKMS",

Effect = "Allow",

Action = [

"kms:Encrypt",

"kms:Decrypt",

"kms:DescribeKey",

Resource = aws_kms_key.vault_test.arn,

}

]

})

}

## End ###

########################## End of TLS Certificate section ######################################

resource "helm_release" "vault_test" {

name = "vault-test"

repository = "https://helm.releases.hashicorp.com"

chart = "vault"

version = local.settings.eks.vault_helm_version

namespace = "vault-test"

create_namespace = false

values = [<<EOF

global:

enabled: true

serverTelemetry:

prometheusOperator: true

injector:

enabled: false

server:

updateStrategyType: "RollingUpdate"

nodeSelector:

dedication: "infra"

tolerations:

- key: "dedicated"

operator: "Equal"

value: "infra"

effect: "NoSchedule"

resources:

requests:

memory: 512Mi

cpu: 500m

limits:

memory: 1024Mi

cpu: 1000m

ingress:

enabled: true

ingressClassName: "nginx-int"

pathType: Prefix

activeService: true

hosts:

- host: "vault-test.${local.settings.dns.base_domain}.${local.settings.dns.tech_domain}"

paths:

- /

tls:

- secretName: "${local.vault_tls_secret_name}"

hosts:

- "vault-test.${local.settings.dns.base_domain}.${local.settings.dns.tech_domain}"

dataStorage:

size: 10Gi

storageClass: gp3

auditStorage:

enabled: true

size: 10Gi

storageClass: gp3

standalone:

enabled: false

ha:

enabled: true

replicas: 3

raft:

enabled: true

setNodeId: true

config: |

ui = true

telemetry {

unauthenticated_metrics_access = "true"

prometheus_retention_time = "24h"

}

listener "tcp" {

tls_disable = 1

address = "[::]:8200"

cluster_address = "[::]:8201"

# Enable unauthenticated metrics access (necessary for Prometheus Operator)

telemetry {

unauthenticated_metrics_access = "true"

}

storage "raft" {

path = "/vault/data"

retry_join {

leader_api_addr = "http://vault-test-0.vault-test-internal:8200"

}

retry_join {

leader_api_addr = "http://vault-test-1.vault-test-internal:8200"

}

retry_join {

leader_api_addr = "http://vault-test-2.vault-test-internal:8200"

}

service_registration "kubernetes" {}

seal "awskms" {

region = "${local.settings.vpc.region}"

kms_key_id = "${aws_kms_key.vault_test.id}"

}

serviceAccount:

annotations:

eks.amazonaws.com/role-arn: "${module.iam_assumable_role_vault_test.iam_role_arn}"

serverTelemetry:

serviceMonitor:

enabled: true

interval: 30s

selectors:

release: kube-prometheus-stack

ui:

enabled: true

EOF

]

provider = helm

}

module "vault_snapshot_module" {

source = "../../../terraform-module/aws-vault-snapshot"

s3_bucket_name = "test-dev-vault-snapshot"

vault_namespace = "vault-test"

vault_address = "http://vault-test-active.vault-test.svc.cluster.local:8200"

iam_role_arn = module.iam_assumable_role_vault_test.iam_role_arn

providers = {

vault = vault.vault-test

}

а там где вызываем модуль добавляем указатель на наш провайдер алиас

providers = { vault = vault.vault-test }

Centos

aws k8s backup vault

https://github.com/midnight47/

Октябрь 2024
Пн	Вт	Ср	Чт	Пт	Сб	Вс
	1	2	3	4	5	6
7	8	9	10	11	12	13
14	15	16	17	18	19	20
21	22	23	24	25	26	27
28	29	30	31