From 0ef11853341c5924ac488b52aa3574ddae8dc14a Mon Sep 17 00:00:00 2001 From: David Symons Date: Tue, 15 Sep 2026 11:37:21 +0100 Subject: [PATCH 1/2] Modify vault deployment to deploy to cron-jobs namespaces --- argocd/dev/ua/vault-operator-configs/app.yaml | 10 ++-- .../vault-auth-service-account.yaml | 0 .../dev/apps/vault-auth.yaml | 18 +++++++ .../dev/apps/vault-connection.yaml | 8 +++ .../cron-jobs/vault-auth-service-account.yaml | 49 +++++++++++++++++++ .../dev/{ => cron-jobs}/vault-auth.yaml | 4 +- .../dev/{ => cron-jobs}/vault-connection.yaml | 2 +- 7 files changed, 85 insertions(+), 6 deletions(-) rename components/ua/vault-operator-config/dev/{ => apps}/vault-auth-service-account.yaml (100%) create mode 100644 components/ua/vault-operator-config/dev/apps/vault-auth.yaml create mode 100644 components/ua/vault-operator-config/dev/apps/vault-connection.yaml create mode 100644 components/ua/vault-operator-config/dev/cron-jobs/vault-auth-service-account.yaml rename components/ua/vault-operator-config/dev/{ => cron-jobs}/vault-auth.yaml (88%) rename components/ua/vault-operator-config/dev/{ => cron-jobs}/vault-connection.yaml (87%) diff --git a/argocd/dev/ua/vault-operator-configs/app.yaml b/argocd/dev/ua/vault-operator-configs/app.yaml index 8eb549694..b8d1bf095 100644 --- a/argocd/dev/ua/vault-operator-configs/app.yaml +++ b/argocd/dev/ua/vault-operator-configs/app.yaml @@ -15,19 +15,23 @@ spec: # Uncomment if you want to deploy to dev-microk8s-alternative - name: dev-microk8s-alternative path: dev-fallback + - list: + elements: + - namespace: apps + - namespace: cron-jobs template: metadata: - name: '{{.name}}-vault-operator-config' + name: '{{.name}}-{{.namespace}}-vault-operator-config' annotations: argocd.argoproj.io/sync-wave: "-1" spec: project: u-a-project source: - path: components/ua/vault-operator-config/{{.path}} + path: components/ua/vault-operator-config/{{.path}}/{{.namespace}} repoURL: 'https://github.com/isisbusapps/gitops' targetRevision: main destination: - namespace: apps + namespace: '{{.namespace}}' name: '{{.name}}' syncPolicy: automated: diff --git a/components/ua/vault-operator-config/dev/vault-auth-service-account.yaml b/components/ua/vault-operator-config/dev/apps/vault-auth-service-account.yaml similarity index 100% rename from components/ua/vault-operator-config/dev/vault-auth-service-account.yaml rename to components/ua/vault-operator-config/dev/apps/vault-auth-service-account.yaml diff --git a/components/ua/vault-operator-config/dev/apps/vault-auth.yaml b/components/ua/vault-operator-config/dev/apps/vault-auth.yaml new file mode 100644 index 000000000..9779694db --- /dev/null +++ b/components/ua/vault-operator-config/dev/apps/vault-auth.yaml @@ -0,0 +1,18 @@ +--- +apiVersion: secrets.hashicorp.com/v1beta1 +kind: VaultAuth +metadata: + name: static-auth + namespace: apps +spec: + vaultConnectionRef: secrets-isis-connection + method: kubernetes + mount: u-and-a-dev + allowedNamespaces: + - "*" + kubernetes: + role: cluster + serviceAccount: vault-op + audiences: + - vault + - https://kubernetes.default.svc.cluster.local diff --git a/components/ua/vault-operator-config/dev/apps/vault-connection.yaml b/components/ua/vault-operator-config/dev/apps/vault-connection.yaml new file mode 100644 index 000000000..2054bdfba --- /dev/null +++ b/components/ua/vault-operator-config/dev/apps/vault-connection.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: secrets.hashicorp.com/v1beta1 +kind: VaultConnection +metadata: + namespace: apps + name: secrets-isis-connection +spec: + address: "https://secrets.isis.rl.ac.uk" diff --git a/components/ua/vault-operator-config/dev/cron-jobs/vault-auth-service-account.yaml b/components/ua/vault-operator-config/dev/cron-jobs/vault-auth-service-account.yaml new file mode 100644 index 000000000..99e243f36 --- /dev/null +++ b/components/ua/vault-operator-config/dev/cron-jobs/vault-auth-service-account.yaml @@ -0,0 +1,49 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + namespace: cron-jobs + name: cron-jobs-vault-op +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: service-account-read + namespace: cron-jobs +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: service-account-read +subjects: + - kind: ServiceAccount + name: cron-jobs-vault-op + namespace: cron-jobs +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: service-account-read-cron-jobs +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: system:auth-delegator +subjects: + - kind: ServiceAccount + name: cron-jobs-vault-op + namespace: cron-jobs +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: service-account-read + namespace: cron-jobs +rules: + - apiGroups: [""] + resources: ["serviceaccounts"] + verbs: ["get", "watch", "list"] + - apiGroups: ["authentication.k8s.io"] + resources: ["tokenreviews"] + verbs: ["create"] + - apiGroups: [ "authentication.k8s.io" ] + resources: [ "subjectaccessreviews" ] + verbs: [ "create" ] \ No newline at end of file diff --git a/components/ua/vault-operator-config/dev/vault-auth.yaml b/components/ua/vault-operator-config/dev/cron-jobs/vault-auth.yaml similarity index 88% rename from components/ua/vault-operator-config/dev/vault-auth.yaml rename to components/ua/vault-operator-config/dev/cron-jobs/vault-auth.yaml index 21743fa8a..9ea867a2c 100644 --- a/components/ua/vault-operator-config/dev/vault-auth.yaml +++ b/components/ua/vault-operator-config/dev/cron-jobs/vault-auth.yaml @@ -3,11 +3,11 @@ apiVersion: secrets.hashicorp.com/v1beta1 kind: VaultAuth metadata: name: static-auth - namespace: apps + namespace: cron-jobs spec: vaultConnectionRef: secrets-isis-connection method: kubernetes - mount: u-and-a-dev + mount: submissions allowedNamespaces: - "*" kubernetes: diff --git a/components/ua/vault-operator-config/dev/vault-connection.yaml b/components/ua/vault-operator-config/dev/cron-jobs/vault-connection.yaml similarity index 87% rename from components/ua/vault-operator-config/dev/vault-connection.yaml rename to components/ua/vault-operator-config/dev/cron-jobs/vault-connection.yaml index ad9331071..b8fddefff 100644 --- a/components/ua/vault-operator-config/dev/vault-connection.yaml +++ b/components/ua/vault-operator-config/dev/cron-jobs/vault-connection.yaml @@ -2,7 +2,7 @@ apiVersion: secrets.hashicorp.com/v1beta1 kind: VaultConnection metadata: - namespace: apps + namespace: cron-jobs name: secrets-isis-connection spec: address: "https://secrets.isis.rl.ac.uk" \ No newline at end of file From d48df8589667ccb1e82a679eaed62933a92ff6c2 Mon Sep 17 00:00:00 2001 From: David Symons Date: Mon, 21 Sep 2026 11:41:16 +0100 Subject: [PATCH 2/2] Address comments --- argocd/dev/ua/vault-operator-configs/app.yaml | 14 +++++++------- .../dev/cron-jobs/vault-auth.yaml | 2 -- 2 files changed, 7 insertions(+), 9 deletions(-) diff --git a/argocd/dev/ua/vault-operator-configs/app.yaml b/argocd/dev/ua/vault-operator-configs/app.yaml index b8d1bf095..1a50e7510 100644 --- a/argocd/dev/ua/vault-operator-configs/app.yaml +++ b/argocd/dev/ua/vault-operator-configs/app.yaml @@ -8,13 +8,13 @@ spec: goTemplateOptions: ["missingkey=error"] generators: - list: - elements: - # Names of clusters to deploy the app to - - name: dev-v3 - path: dev - # Uncomment if you want to deploy to dev-microk8s-alternative - - name: dev-microk8s-alternative - path: dev-fallback + elements: + # Names of clusters to deploy the app to + - name: dev-v3 + path: dev + # Uncomment if you want to deploy to dev-microk8s-alternative + - name: dev-microk8s-alternative + path: dev-fallback - list: elements: - namespace: apps diff --git a/components/ua/vault-operator-config/dev/cron-jobs/vault-auth.yaml b/components/ua/vault-operator-config/dev/cron-jobs/vault-auth.yaml index 9ea867a2c..751f1d1a6 100644 --- a/components/ua/vault-operator-config/dev/cron-jobs/vault-auth.yaml +++ b/components/ua/vault-operator-config/dev/cron-jobs/vault-auth.yaml @@ -8,8 +8,6 @@ spec: vaultConnectionRef: secrets-isis-connection method: kubernetes mount: submissions - allowedNamespaces: - - "*" kubernetes: role: cluster serviceAccount: vault-op