82 lines
2.8 KiB
YAML
82 lines
2.8 KiB
YAML
# services/vault/oidc-bootstrap-job.yaml
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: vault-oidc-bootstrap-2
|
|
namespace: vault
|
|
labels:
|
|
app: vault-oidc-bootstrap
|
|
spec:
|
|
backoffLimit: 0
|
|
ttlSecondsAfterFinished: 86400
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: vault-oidc-bootstrap
|
|
spec:
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: configure-oidc
|
|
image: hashicorp/vault:1.20.4
|
|
imagePullPolicy: IfNotPresent
|
|
env:
|
|
- name: VAULT_ADDR
|
|
value: http://vault.vault.svc.cluster.local:8200
|
|
- name: VAULT_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: vault-oidc-admin-token
|
|
key: token
|
|
- name: OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: oauth2-proxy-vault-oidc
|
|
key: client_secret
|
|
- name: VAULT_CLIENT_TIMEOUT
|
|
value: "30s"
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
set -euo pipefail
|
|
vault status
|
|
# Enable OIDC auth (idempotent)
|
|
vault auth enable oidc >/dev/null 2>&1 || vault auth tune -description="Keycloak OIDC" oidc
|
|
|
|
# Configure Keycloak OIDC
|
|
vault write auth/oidc/config \
|
|
oidc_discovery_url="https://sso.bstein.dev/realms/atlas" \
|
|
oidc_client_id="oauth2-proxy" \
|
|
oidc_client_secret="$OIDC_CLIENT_SECRET" \
|
|
default_role="admin" \
|
|
bound_issuer="https://sso.bstein.dev/realms/atlas" \
|
|
allowed_redirect_uris="https://secret.bstein.dev/ui/vault/auth/oidc/oidc/callback"
|
|
|
|
# Admin policy (wide permissions)
|
|
vault policy write vault-admin - <<'EOF'
|
|
path "*" {
|
|
capabilities = ["create", "read", "update", "delete", "list", "sudo"]
|
|
}
|
|
EOF
|
|
|
|
# Role mapping admin group -> vault-admin policy
|
|
cat >/tmp/role.json <<'EOF'
|
|
{
|
|
"user_claim": "sub",
|
|
"groups_claim": "groups",
|
|
"bound_audiences": "oauth2-proxy",
|
|
"allowed_redirect_uris": "https://secret.bstein.dev/ui/vault/auth/oidc/oidc/callback",
|
|
"claim_mappings": {
|
|
"email": "email",
|
|
"name": "name"
|
|
},
|
|
"token_policies": ["vault-admin"],
|
|
"oidc_scopes": ["profile", "email", "groups"],
|
|
"bound_claims": { "groups": ["admin"] }
|
|
}
|
|
EOF
|
|
vault write auth/oidc/role/admin @/tmp/role.json
|
|
# Make OIDC the default UI login method
|
|
vault write sys/config/ui default_auth_method="oidc"
|
|
echo "vault OIDC bootstrap complete"
|