hermes: mount node access through Vault CSI

services/hermes/node-ssh-access.yaml

@@ -7,6 +7,22 @@ metadata:
   labels:
     app: hermes-node-ssh-access
 ---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: hermes-node-ssh-access
+  namespace: hermes
+spec:
+  provider: vault
+  parameters:
+    vaultAddress: "http://vault.vault.svc.cluster.local:8200"
+    roleName: hermes-node-ssh
+    objects: |
+      - objectName: "node-ssh-public-key"
+        secretPath: "kv/data/atlas/hermes/developer-ssh"
+        secretKey: "public_key"
+        filePermission: 256
+---
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
@@ -22,20 +38,6 @@ spec:
     metadata:
       labels:
         app: hermes-node-ssh-access
-      annotations:
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/role: hermes-node-ssh
-        vault.hashicorp.com/agent-inject-secret-node-ssh-public-key: kv/data/atlas/hermes/developer-ssh
-        vault.hashicorp.com/agent-inject-template-node-ssh-public-key: |
-          {{- with secret "kv/data/atlas/hermes/developer-ssh" -}}
-          {{ .Data.data.public_key }}
-          {{- end }}
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-requests-cpu: 5m
-        vault.hashicorp.com/agent-requests-mem: 16Mi
-        vault.hashicorp.com/agent-limits-cpu: 50m
-        vault.hashicorp.com/agent-limits-mem: 64Mi
     spec:
       serviceAccountName: hermes-node-ssh-access
       automountServiceAccountToken: true
@@ -84,6 +86,9 @@ spec:
             - name: host-passwd
               mountPath: /host-etc/passwd
               readOnly: true
+            - name: vault-secrets
+              mountPath: /vault/secrets
+              readOnly: true
             - name: tmp
               mountPath: /tmp
           resources:
@@ -102,6 +107,12 @@ spec:
           hostPath:
             path: /etc/passwd
             type: File
+        - name: vault-secrets
+          csi:
+            driver: secrets-store.csi.k8s.io
+            readOnly: true
+            volumeAttributes:
+              secretProviderClass: hermes-node-ssh-access
         - name: tmp
           emptyDir:
             sizeLimit: 8Mi

testing/tests/test_hermes_cli_lanes.py

@@ -964,19 +964,26 @@ def test_owner_agent_has_pinned_dedicated_node_ssh_access():
     ]
     service_account = next(item for item in access if item["kind"] == "ServiceAccount")
     assert service_account["metadata"]["name"] == "hermes-node-ssh-access"
+    provider = next(item for item in access if item["kind"] == "SecretProviderClass")
+    assert provider["metadata"]["name"] == "hermes-node-ssh-access"
+    assert provider["spec"]["provider"] == "vault"
+    parameters = provider["spec"]["parameters"]
+    assert parameters["roleName"] == "hermes-node-ssh"
+    assert 'secretPath: "kv/data/atlas/hermes/developer-ssh"' in parameters["objects"]
+    assert 'secretKey: "public_key"' in parameters["objects"]
     daemonset = next(item for item in access if item["kind"] == "DaemonSet")
     pod = daemonset["spec"]["template"]["spec"]
     assert pod["serviceAccountName"] == "hermes-node-ssh-access"
     assert pod["automountServiceAccountToken"] is True
-    pod_annotations = daemonset["spec"]["template"]["metadata"]["annotations"]
-    assert pod_annotations["vault.hashicorp.com/role"] == "hermes-node-ssh"
-    assert pod_annotations[
-        "vault.hashicorp.com/agent-inject-secret-node-ssh-public-key"
-    ] == "kv/data/atlas/hermes/developer-ssh"
-    assert pod_annotations["vault.hashicorp.com/agent-requests-cpu"] == "5m"
-    assert pod_annotations["vault.hashicorp.com/agent-requests-mem"] == "16Mi"
     host_home = next(item for item in pod["volumes"] if item["name"] == "host-home")
     assert host_home["hostPath"] == {"path": "/home", "type": "Directory"}
+    vault_secrets = next(
+        item for item in pod["volumes"] if item["name"] == "vault-secrets"
+    )
+    assert vault_secrets["csi"]["driver"] == "secrets-store.csi.k8s.io"
+    assert vault_secrets["csi"]["volumeAttributes"] == {
+        "secretProviderClass": "hermes-node-ssh-access"
+    }
     reconciler = pod["containers"][0]["args"][0]
     assert "cat /vault/secrets/node-ssh-public-key" in reconciler
     assert "grep -qxF" in reconciler