Implement Vaults

[andrewsignori-aot]

As a Ministry Security Officer, I would like secrets to be stored and controlled using Hashicorp Vault.

Prerequisite Creation of vault secrets and implementation must occur in same sprint

• [ ] Technical lead to create secrets in Vault (Stephen can assist in automation if wanted)
  • [ ] Creation of [dev/test/staging]-common in nonprod vault
  • [ ] Creation of [dev/test/staging]-forms in nonprod vault
  • [ ] Creation of [dev/test/staging]-queue-consumers in nonprod vault
  • [ ] Creation of [dev/test/staging]-web in nonprod vault
  • [ ] Creation of [dev/test/staging]-workers in nonprod vault
  • [ ] Creation of [dev/test/staging]-edw-api in nonprod vault
  • [ ] Creation of prod-common in prod vault
  • [ ] Creation of prod-forms in prod vault
  • [ ] Creation of prod-queue-consumers in prod vault
  • [ ] Creation of prod-web in prod vault
  • [ ] Creation of prod-workers in prod vault
  • [ ] Creation of prod-edw-api in prod vault
• [ ] Discuss Infrastructre items: Patroni, Redis, hamongo, simsdb-backup

Acceptance Criteria

• [ ] Exclude Infrastructure items: Patroni, Redis, hamongo, simsdb-backup for this ticket
• [ ] Inject common and specific vault secret into each DC
• [ ] Remove mapped secrets and environment variables from Deployment Configs
• [ ] Remove secrets from GH
• [ ] Pods starts

Technical Context

Insert the following yaml into the spec/strategy/template/metadata Replace ${license-plate}, ${prod or nonprod} and secret1/2 with the real values

annotations:
    vault.hashicorp.com/agent-inject-secret-secrets.env: '${license-plate}-${prod or nonprod}/secret1,${license-plate}-${prod or nonprod}/secret2
    vault.hashicorp.com/namespace: platform-services
    vault.hashicorp.com/role: ${license-plate}-nonprod
    vault.hashicorp.com/agent-pre-populate-only: 'true'
    vault.hashicorp.com/agent-inject: 'true'
    vault.hashicorp.com/agent-inject-template-secrets.env: |
      {{- with secret "${license-plate}-${prod or nonprod}/secret1" -}}
      {{- range $key, $value := .Data.data -}}
      export {{ $key }}="{{ $value }}"{{ "\n" }}
      {{- end -}}
      {{- end -}}
      {{- with secret "${license-plate}-${prod or nonprod}/secret2" -}}
      {{- range $key, $value := .Data.data -}}
      export {{ $key }}="{{ $value }}"{{ "\n" }}
      {{- end -}}
      {{- end -}}   

Add user into spec/strategy/template/spec

serviceAccount: ${license-play}-vault

Finally, you will need to either source the secrets.env file located at /vault/secrets/secrets.env as part of container startup or as part of the application code.

[cditcher]

Determined that this is a requirement. Will prioritize devops.

[sslaws]

I'd like to discuss the priority on this... I've put it in 2x

[sslaws]

Reminder to Stephen to follow up with Nick C regarding local OpenShift secret encryption.