Use LHDI's HashiCorp Vault for shared credentials

department-of-veterans-affairs / abd-vro

To get Veterans benefits in minutes, VRO software uses health evidence data to help fast track disability claims.

Other

19 stars 6 forks source link

Use LHDI's HashiCorp Vault for shared credentials #768

Closed yoomlam closed 1 year ago

yoomlam commented 1 year ago

Let's do this in Jan 2023. Dependent on LHDI providing the HashiCorp Vault.

Follow-on from #717, where a github "machine user" account was created. Use LHDI's HashiCorp Vault for shared credentials for these accounts so that admins (Yoom), SecRel maintainer (Seth), and DevOps have access to the accounts.

Slack

Document Secrets in each env and connect to HashiCorp Vault

Secrets vs. env var vs. application-prod.yml
DevOps: automate setting K8s secrets so that rotations are easy
- Incorporate LHDI's HashiCorp Vault: https://developer.hashicorp.com/vault/tutorials/getting-started/getting-started-intro
- Use https://developer.hashicorp.com/vault/api-docs/libraries if env variable not present
- create kind: Secret files https://phoenixnap.com/kb/helm-environment-variables

yoomlam commented 1 year ago

Update:

The dev and prod stories are complete; there is just one more story to finish getting [HashiCorp Vault] ready for customer use (setting up onboarding, ArgoCD integration, and documentation for the most part). It's currently in work, so hopefully within the next sprint or two

yoomlam commented 1 year ago

Usage demo on Feb 15th

yoomlam commented 1 year ago

Not yet released this week. Pushing it to next sprint or until online documentation is available.

Requires VA network access
Unclear how to use it without ArgoCD

yoomlam commented 1 year ago

Not yet released.

yoomlam commented 1 year ago

Ready for use

yoomlam commented 1 year ago

Meeting with LHDI today to get started. I'll start creating a list of secrets currently in K8s so they can automated.

dianagriffin commented 1 year ago

Context: secrets etc are stored in K8s and were created ad hoc, without supporting documentation. This directly impact maintenance of VRO; it would be challenging to rotate credentials in the current state, for example. LHDI is in process of providing HashiCorp Vault, which would provide a solution to manage credentials in a shared vault.

yoomlam commented 1 year ago

Notes from meeting with LHDI:

Need to create a separate GH Team to limit access to Vault secrets to a subset of the VRO team.
Will get instructions on accessing Vault secrets from a K8s pod
Set up a GH Action workflow to run on a self-hosted runner to pull Vault secrets and set them in K8s

yoomlam commented 1 year ago

Need to test non-dev images. Blocked by SecRel-alerts.

yoomlam commented 1 year ago

VRO deployed to prod-test successfully.