Add ability to leverage an external Vault

Summary

Currently Sylva stack deploys its own Vault in the managemet cluster to store application's secrets of the management. These secrets are randomly generated againt a password policy. This issue proposes that the deployment units should be able (as a deployment option) to use an external Vault to consumme sylva's secrets.

Details

The external vault stores secrets that are expected to be consummed by sylva deployment units. Basically Sylva writes and reads secrets in the same way as for the local vault deployed today in the management cluster.

prerequisite: the external vault must configure paths, access policies and roles for Sylva. K8S authentication scheme must be enabled to allow Sylva's SA to authenticate.

The detailed configuration operations are available on this document: sylva-todo.md

Useful debugging scripts: configure-vault-auth-k8s.sh test-login.sh

cc @alain.thioliere @Electrogur @vladimir.braquet (possible impact on https://gitlab.com/sylva-projects/sylva-elements/workload-cluster-operator)

Edited May 27, 2025 by Pierrick Seite
Assignee Loading
Time tracking Loading