Add Vault to cron-jobs namespace

argocd/dev/ua/vault-operator-configs/app.yaml

@@ -8,26 +8,30 @@ spec:
   goTemplateOptions: ["missingkey=error"]
   generators:
   - list:
-      elements:
-        # Names of clusters to deploy the app to
-        - name: dev-v3
-          path: dev
-        # Uncomment if you want to deploy to dev-microk8s-alternative
-        - name: dev-microk8s-alternative
-          path: dev-fallback
+    elements:
+      # Names of clusters to deploy the app to
+      - name: dev-v3
+        path: dev
+      # Uncomment if you want to deploy to dev-microk8s-alternative
+      - name: dev-microk8s-alternative
+        path: dev-fallback
+  - list:
+    elements:
+      - namespace: apps
+      - namespace: cron-jobs
   template:
     metadata:
-      name: '{{.name}}-vault-operator-config'
+      name: '{{.name}}-{{.namespace}}-vault-operator-config'
       annotations:
         argocd.argoproj.io/sync-wave: "-1"
     spec:
       project: u-a-project
       source:
-        path: components/ua/vault-operator-config/{{.path}}
+        path: components/ua/vault-operator-config/{{.path}}/{{.namespace}}
         repoURL: 'https://github.com/isisbusapps/gitops'
         targetRevision: main
       destination:
-        namespace: apps
+        namespace: '{{.namespace}}'
         name: '{{.name}}'
       syncPolicy:
         automated: 

components/ua/vault-operator-config/dev/vault-auth.yaml → components/ua/vault-operator-config/dev/apps/vault-auth.yaml

@@ -15,4 +15,4 @@ spec:
     serviceAccount: vault-op
     audiences:
       - vault
-      - https://kubernetes.default.svc.cluster.local
+      - https://kubernetes.default.svc.cluster.local

components/ua/vault-operator-config/dev/apps/vault-connection.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultConnection
+metadata:
+  namespace: apps
+  name: secrets-isis-connection
+spec:
+  address: "https://secrets.isis.rl.ac.uk"

components/ua/vault-operator-config/dev/cron-jobs/vault-auth-service-account.yaml

@@ -0,0 +1,49 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  namespace: cron-jobs
+  name: cron-jobs-vault-op
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: service-account-read
+  namespace: cron-jobs
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: service-account-read
+subjects:
+  - kind: ServiceAccount
+    name: cron-jobs-vault-op
+    namespace: cron-jobs
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: service-account-read-cron-jobs
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+  - kind: ServiceAccount
+    name: cron-jobs-vault-op
+    namespace: cron-jobs
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: service-account-read
+  namespace: cron-jobs
+rules:
+  - apiGroups: [""]
+    resources: ["serviceaccounts"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: ["authentication.k8s.io"]
+    resources: ["tokenreviews"]
+    verbs: ["create"]
+  - apiGroups: [ "authentication.k8s.io" ]
+    resources: [ "subjectaccessreviews" ]
+    verbs: [ "create" ]

components/ua/vault-operator-config/dev/cron-jobs/vault-auth.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: static-auth
+  namespace: cron-jobs
+spec:
+  vaultConnectionRef: secrets-isis-connection
+  method: kubernetes
+  mount: submissions
+  kubernetes:
+    role: cluster
+    serviceAccount: vault-op
+    audiences:
+      - vault
+      - https://kubernetes.default.svc.cluster.local

components/ua/vault-operator-config/dev/vault-connection.yaml → components/ua/vault-operator-config/dev/cron-jobs/vault-connection.yaml

@@ -2,7 +2,7 @@
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultConnection
 metadata:
-  namespace: apps
+  namespace: cron-jobs
   name: secrets-isis-connection
 spec:
   address: "https://secrets.isis.rl.ac.uk"