Issue #56: Adds vault-ui ingress

.github/workflows/test.yml

@@ -0,0 +1,23 @@
+name: Python api-test workflows
+
+on:
+  pull_request:
+    types:
+      - opened
+      - closed
+      - synchronize
+
+jobs:
+  lint-test:
+    uses: ai-cfia/github-workflows/.github/workflows/workflow-lint-test-python.yml@main
+    secrets: inherit
+
+  markdown-check:
+    uses: ai-cfia/github-workflows/.github/workflows/workflow-markdown-check.yml@main
+    with:
+      config-file-path: '.mlc_config.json'
+    secrets: inherit
+
+  repo-standard:
+    uses: ai-cfia/github-workflows/.github/workflows/workflow-repo-standards-validation.yml@main
+    secrets: inherit

docs/generic-achitecture.md

@@ -158,7 +158,7 @@ flowchart
 
 3. Representation of the two diagrams above in one
 
-![Diagram](png/ha-redundancy-lb.png)
+![Diagram](img/ha-redundancy-lb.png)
 
 ## References
 

docs/secret-management.md

@@ -0,0 +1,89 @@
+# Secret management
+
+## Introduction
+
+Secrets are sensitive pieces of information that should be protected from
+unauthorized access. In the context of a Kubernetes cluster, secrets are used to
+store sensitive data such as passwords, tokens, and keys. To allow for secure
+and efficient management of secrets, we are using HashiCorp Vault, a tool that
+is designed to manage secrets and protect sensitive data. Vault provides a
+centralized way to manage access to secrets and encryption keys, and it also has
+the ability to generate dynamic secrets on demand. This document provides an
+overview of the secret management process and the role of Vault in securing and
+managing secrets in the Kubernetes cluster.
+
+## Vault architecture
+
+Vault is a highly available and distributed system that is designed to provide
+secure storage and management of secrets. It is built on a client-server
+architecture, with the server being the central component that stores and
+manages secrets, and the clients being the applications and services that access
+the secrets. The server is responsible for authenticating clients, authorizing
+access to secrets, and providing encryption and decryption services. The server
+is also responsible for generating dynamic secrets on demand, which are
+short-lived and are automatically revoked after a certain period of time.
+
+Current configuration allows vault to inject secrets into pods using a sidecar
+container that runs the Vault Agent Injector. The Vault Agent Injector is a
+mutating webhook that intercepts requests to create or update pods and injects
+secrets into the pod's file system. This allows clients (hosted applications) to
+access secrets as files, which is a secure and efficient way to manage secrets
+in a Kubernetes environment.
+
+The following diagram illustrates the workflow of the Vault Agent Injector and
+how developers can manage secrets of hosted applications:
+![Developer workflow diagram](img/Vault-argoCD-workflow.svg)
+
+## Secret management process
+
+The secret management process involves the following steps:
+
+1. **Secret creation**: Secrets are created and stored in Vault using the Vault
+   CLI or API. When a secret is created, it is encrypted and stored in the
+   central Vault server.
+
+2. **Secret retrieval**: Applications and services can retrieve secrets from
+    Vault using the Vault CLI or API. When a secret is retrieved, it is
+    decrypted and returned to the client in a secure manner.
+
+3. **Dynamic secret generation**: Vault has the ability to generate dynamic
+    secrets on demand. This means that instead of storing static secrets in
+    Vault, Vault can generate short-lived secrets that are automatically revoked
+    after a certain period of time. This provides an additional layer of
+    security and reduces the risk of unauthorized access to secrets.
+
+4. **Access control**: Vault provides fine-grained access control to secrets,
+    allowing administrators to define policies that specify which clients can
+    access which secrets. This ensures that only authorized clients can access
+    sensitive data. Currently, we are using the Kubernetes authentication method
+    to authenticate hosted applications and authorize access to secrets. As for
+    the human users, we are using the Github authentication method to
+    authenticate and authorize access to secrets.
+
+## Create, read, update, and delete secrets
+
+Vault provides a UI service to manage secrets. The UI service is a web-based
+user interface that allows administrators to create, read, update, and delete
+secrets. The service also provides a way to manage access control policies
+and audit logs. The service is accessible through a web browser and is
+protected by the same security mechanisms as the Vault server.
+
+### Steps
+
+1. In order to gain access to the Vault UI service, you need to have the
+   appropriate permissions and access to the Vault URL. It is currently
+   configured to give access to any member of the `ai-cfia` organization on
+   Github.
+2. Generate a personal access token on Github and use it to authenticate to the
+   Vault UI service. The scope of the token should be : ![PAT token
+   scope](img/pat-token-scope.png)
+3. Gain access to the Vault UI service by navigating to the Vault URL in a web
+   browser. You will be prompted to authenticate using your Github PAT token.
+4. Once authenticated, you will be able to create, read, update, and delete
+   secrets using the UI service. Simply navigate to the PV secret engine and
+   follow the path to your applications secrets. The PV secret engine is a
+    key-value store that allows you to store and manage secrets for your
+    applications. ![PV secret engine](img/pv-secret-engine.png)
+5. Once in the directory of your application secrets, simply click on 'create
+    new version' and you will be able to add, update, or delete secrets as
+    needed. ![Create mew secret](img/create-new-secret.PNG)

kubernetes/aks/system/vault/helm/values.yml

@@ -788,7 +788,7 @@ server:
         plugin_directory = "/vault/plugins"
 
         listener "tcp" {
-          tls_disable = true
+          tls_disable = false
           address = "[::]:8200"
           cluster_address = "[::]:8201"
           tls_cert_file = "/vault/userconfig/vault-ha-tls/vault.crt"

kubernetes/aks/system/vault/ingress.yml

@@ -0,0 +1,32 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vault-ui
+  namespace: vault
+  labels:
+    app.kubernetes.io/name: vault-ui
+    app.kubernetes.io/instance: vault
+  annotations:
+    external-dns.alpha.kubernetes.io/target: inspection.alpha.canada.ca
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/rewrite-target: /
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+    kubernetes.io/tls-acme: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - "vault.inspection.alpha.canada.ca"
+      secretName: vault-ui
+  rules:
+    - host: "vault.inspection.alpha.canada.ca"
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: vault-ui
+                port:
+                  name: https