Add tool to allow creating credentials from vault
Version Control Information
Source branch: feature/admin-conf-from-vault
Target branch: devel
Commits:
* Add tool to allow creating credentials from vault
This allows configuring Vault in such a way that it is possible to
source a fully-functional admin.conf file from Vault.
* Remove unused k8s-pki issuer role
I'm not sure what this role was intended to be used for; it is
referenced in the policy in init.sh for the orchestrator role, however,
the privileges granted by the certificate from this issue role are
useless. You can use it to impersonate a node, but that doesn't seem
like a useful thing to be able to do, in particular because the
orchestrator can create approle roles for nodes and then use that (which
is needed in the bare metal flow) to obtain credentials for the node.
Thus, we drop it, as well as the privileges to use it.
Description
This MR provides the necessary tooling to generate admin.conf-like files from certificates issued by the Vault instance.
There are a couple open questions:
- Is there a better way to obtain the
cluster_name
,username
andkubernetes_server
in thek8s-login.sh
script? - Docs need to be written
Merge Prerequisites
-
MR title (and description) are descriptive -
Code is readable and syntactically correct -
Code is understandable -
Documentation has been updated, if necessary -
Commit messages look good -
Release note file added in latest commit
As a developer: please do not tick these boxes yourself. As a reviewer: please get yourself a hot cold beverage.
Edited by Jonas Schäfer