mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-22 19:29:13 +08:00
51 lines
1.7 KiB
Markdown
51 lines
1.7 KiB
Markdown
# Vault KV v2 Worker Secret custody
|
|
|
|
This overlay replaces the base `mounted-files` value projection with direct,
|
|
TLS 1.3 Vault KV v2 resolution. The control Pods mount only the private Vault
|
|
CA and one short-lived read token; Secret values and opaque Legacy Env bundles
|
|
remain in Vault and are fetched only after the durable Worker delivery authority
|
|
has been validated.
|
|
|
|
The exact Vault policy is read-only:
|
|
|
|
```hcl
|
|
path "worker-secrets/data/values/production/*" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "auth/token/lookup-self" {
|
|
capabilities = ["read"]
|
|
}
|
|
```
|
|
|
|
Issue an orphan, non-renewable service token with only that policy and a TTL no
|
|
greater than 15 minutes. Rotate the projected `token` atomically before expiry;
|
|
the adapter rereads and revalidates it for every authorized resolution. A Vault
|
|
Agent or external Secret operator may own this projection, but must not project
|
|
the actual Worker Secret values.
|
|
|
|
Store each value at
|
|
`worker-secrets/data/values/production/<sha256(canonical SecretRef)>` with this
|
|
exact KV payload:
|
|
|
|
```json
|
|
{
|
|
"schemaVersion": 1,
|
|
"secretRefDigest": "<same 64-hex path key>",
|
|
"encoding": "base64",
|
|
"value": "<canonical base64 bytes>"
|
|
}
|
|
```
|
|
|
|
Create the two private Kubernetes Secret objects from
|
|
`credentials.example.yaml` through the deployment authority, then render:
|
|
|
|
```sh
|
|
kubectl kustomize deploy/kubernetes/ql3-cluster/vault-kv-worker-secret
|
|
```
|
|
|
|
The overlay intentionally does not create a NetworkPolicy because the base
|
|
control-plane deployment has no universal egress policy and external Vault
|
|
topologies differ. If the namespace is default-deny, explicitly allow DNS,
|
|
PostgreSQL, the artifact store and TCP 8200 only to the reviewed Vault identity.
|