search

hashicorp / terraform-aws-hashicorp-vault-eks-addon

HashiCorp Vault Add-on for AWS EKS
https://www.hashicorp.com/blog/vault-and-aws-partner-to-enhance-kubernetes-security
Apache License 2.0
23 stars 14 forks source link

Auto-unseal and irsa support for vault addon #6

Closed mleklund closed 1 year ago

mleklund commented 2 years ago

There is a chicken or egg problem of needing the kms key info in order to create a custom vault config to pass to helm, but if the key is created outside of the module, and we try to base count off the existence of the arn string we end up with the "terraform cannot predict how many instances will be created" issue. There is probably a better way to handle this, but I have not been able to piece it together.

This will also require changes to how this addon is called from aws-ia/terraform-aws-eks-blueprints.

MaiCabrera commented 2 years ago

Is this feature able to get merged? I’d be tempted to play with it

mleklund commented 2 years ago

It works for me, I haven’t heard a comment about getting it committed.

Here is the repo

here is one with needed EKS blueprints changes

ksatirli commented 2 years ago

Hey @mleklund thank you for contributing this - we had to carry out some other work before we could get to this, hence the delay.

The good news is that the other work is now done.

Could I get you to resolve the conflicting files so we can push this PR forward?

mleklund commented 2 years ago

I saw the message and took a quick look at it but it does not look like a simple merge. I am pretty tied up with work at the moment, and will have to loop back to this sometime later.

oferchen commented 1 year ago

is there any update on this?

mleklund commented 1 year ago

is there any update on this?

I have been tied up at with work and family and have not done anything since a quick look to see if it was an easy merge. It did not look to be a quick easy merge due to upstream changes made after I submitted the merge request in June. I probably wont have time to look at it for a couple of weeks at least, if anyone else wants to pick it up, feel free.

oferchen commented 1 year ago

is there any update on this?

I have been tied up at with work and family and have not done anything since a quick look to see if it was an easy merge. It did not look to be a quick easy merge due to upstream changes made after I submitted the merge request in June. I probably wont have time to look at it for a couple of weeks at least, if anyone else wants to pick it up, feel free.

Yeah I understand the holidays is a difficult time to multitask. There is a rebased code repository in the branch https://github.com/mleklund/terraform-aws-eks-blueprints/tree/vault_auto_unseal I think this one would be easier to integrate because there are only 9 commits difference.

mleklund commented 1 year ago

closing this as #11 is cleaner and better thought out then what I did here.