vault-webhook-base.yaml

# Base Deployment for HashiCorp Vault example with Banzai secret webhook
# Deploys the following containers
# - init container: with a dummy echo statement
# - base container: named "showcase", executes a script, stored in ConfigMap and appends some logs
# - sidecar container: named "showcase-sidecar", tail/follows the log file 
#
# The app binds a Secret as env variable and file mount. This show cases the circumstance, 
# that mounted secrets will be updated, env however not
#
# Difference to HashiCorp Vault specifica
# - Using annotation to inject the secrets directly from Vault
# - using service accounts to interact with Vault, service account is bound to a Vault role and policy
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: sa-system-a-dev
  namespace: vault-test3
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: sa-system-b-dev
  namespace: vault-test3
---
# Grant TokenReview permission to service account to allow verify of the token
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: sa-system-a-dev-test-vault-role-tokenreview-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
  - kind: ServiceAccount
    name: sa-system-a-dev
    namespace: vault-test3
---
apiVersion: v1
kind: Secret
metadata:
  name: vault-demo-creds-01
  namespace: vault-test3
stringData:
  username: dummy
  password: dummy-value 
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: showcase-vault-webhook-scripts
  namespace: vault-test3
data:
  secrets-output.sh: |
    echo "secrets-output.sh script"
    while [ true ]; do
      
      echo "$(date '+%Y-%m-%d %H:%M:%S'): [From Main container] ...waiting..." >> /logs/test.log; 

      echo "[Main container] ...waiting..."
      
      echo "Env:"
      env | grep -i db

      echo "-------------------------------------------"

      sleep 15
    done;  
---
apiVersion: v1
kind: Secret
metadata:
  name: vault-demo-webhook-secret
  namespace: vault-test3
  annotations:        
    # the address of the Vault service, default values is https://vault:8200
    vault.security.banzaicloud.io/vault-addr: "http://hashicorp-vault.vault-backend:8200"
    # the default value is the name of the ServiceAccount the Pod runs in, in case of Secrets and ConfigMaps it is "default"
    vault.security.banzaicloud.io/vault-role: "role-system-a-dev"
    vault.security.banzaicloud.io/vault-skip-verify: "true" 
    #vault.security.banzaicloud.io/vault-agent: "true"
    vault.security.banzaicloud.io/vault-serviceaccount: sa-system-a-dev
stringData:
  username: dummy
  password: vault:secret/data/dev/system-a#db_password
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: showcase-vault-webhook-deployment
  namespace: vault-test3
  labels:
    app: showcase-vault-webhook
spec:
  replicas: 1
  selector:
    matchLabels:
      app: showcase-vault-webhook
  template:
    metadata:
      labels:
        app: showcase-vault-webhook
      annotations:        
        # the address of the Vault service, default values is https://vault:8200
        vault.security.banzaicloud.io/vault-addr: "http://hashicorp-vault.vault-backend:8200"
        # the default value is the name of the ServiceAccount the Pod runs in, in case of Secrets and ConfigMaps it is "default"
        vault.security.banzaicloud.io/vault-role: "role-system-a-dev"
        vault.security.banzaicloud.io/vault-skip-verify: "true" 
        #vault.security.banzaicloud.io/vault-agent: "true"
    spec:
      # Specific sa, relevant for Vault interaction
      serviceAccountName: sa-system-a-dev
      containers:
      - name: showcase-vault-webhook
        image: busybox:1.28
        command: ['sh', '-c', '/scripts/secrets-output.sh']
        env:
        - name: DB_USERID
          value: vault:secret/data/dev/system-a#db_userid
        - name: DB_PASSWORD
          value: vault:secret/data/dev/system-a#db_password
        volumeMounts:
          # Mount for the logs, shared with sidecar
          - name: logs
            mountPath: /logs
          # Mount from ConfigMap holding a script
          - name: showcase-scripts-configmap
            mountPath: /scripts
        resources:
          requests:
            memory: "64Mi"
            cpu: "250m"
          limits:
            memory: "64Mi"
            cpu: "250m"
      volumes:
        - name: logs
          emptyDir: {}
        - name: showcase-scripts-configmap
          configMap:
            name: showcase-vault-webhook-scripts
            defaultMode: 0777