department-of-veterans-affairs / abd-vro

To get Veterans benefits in minutes, VRO software uses health evidence data to help fast track disability claims.
Other
19 stars 6 forks source link

ArgoCD + Vault: audit for completeness #3447

Open lisac opened 1 week ago

lisac commented 1 week ago

In introducing the ArgoCD + Vault integration, we rolled out the configuration app-by-app. Let's now consider a system-wide view.

Questions to consider:

  1. the key/values in environment-specific deployment files; are there any that can be consolidated? for example, env and secrets_env often (always?) are the same value; can we define the value once? Similarly for image.tag and imageTag.
  2. do all apps account for all environments? (dev, qa, sandbox, prod-test, prod)
  3. have all shared values, such as those in vro-ldhi-libchart, been migrated to take advantage of the Vault integration?

Acceptance Criteria

  1. tbd
  2. tbd
  3. tbd
lisac commented 1 week ago

of all our environments, is dev the only one where the path for the Vault secret(s) doesn't embed the environment name? (dev uses default in the path). if so: how complex would it be to modify the path for the dev use case? If we could do that, we might be able to eliminated the secrets_env key.

I think this is an example of a similar overload on the environment name: https://github.com/department-of-veterans-affairs/lighthouse-authorization-argocd-applications-vault/blob/375bb50c4d6d8738e897a0642474d3ace9b8d5ec/deploy/mock-mpi/templates/deployment-config-secrets.yaml#L14