Research and Document best way for utilizing Vault secrets within BigBang

Work with integration team to determine best way for other applications to integrate with vault and consume secrets.

Document this strategy in the package and within BigBang.

added to epic &99 (closed)

changed the description

added Big Bang Add-Ons priority6 teamXForce labels

set weight to 3

changed iteration to Big Bang Iterations Nov 30, 2021 - Dec 13, 2021

changed title from Work with Integration to Research and Document best way for utilizing Vault secrets within BigBang to Research and Document best way for utilizing Vault secrets within BigBang

changed milestone to %1.23.0

marked this issue as related to #944 (closed)

assigned to @michaelmartin

added statusdoing label

Vault docs recommend the following:

NOT having ELB/reverse-proxy terminate TLS on Kubernetes: https://learn.hashicorp.com/tutorials/vault/kubernetes-security-concerns?in=vault/kubernetes#end-to-end-tls

Evaluate using ajent-injector (for app pods like argocd/gitlab/etc) vs using something like setting a pod up with a JWT and agent sidecar to auth with Vault: https://learn.hashicorp.com/tutorials/vault/agent-kubernetes?in=vault/kubernetes

Guide should also mention a tested example for gitlab-runners consuming Vault secrets, creating an admin user with "sudo" perms (BigBang has terraform for this too) and revoking the initial root user token.

I think I know the answer, but worth asking. Do we know the Vault deployment model that is being used or we need to support? i.e. Cloud/SaaS Vault, Self-managed external Vault, self-managed internal vault, etc.

added statusreview label and removed statusdoing label

created merge request !1155 (merged) to address this issue

mentioned in merge request !1155 (merged)

marked this issue as related to #983 (closed)

set weight to 1

removed milestone %1.23.0

changed iteration to Big Bang Iterations Dec 14, 2021 - Dec 27, 2021

mentioned in commit db4e2b37

closed with merge request !1155 (merged)

removed the relation with #944 (closed)

removed statusreview label