Updated Vault template to allow either passthrough or public gateway

General MR

Summary

• Updated Vault template logic to allow for use on either public or passthrough gateways

Relevant logs/screenshots

Validated tests pass in Vault: https://repo1.dso.mil/big-bang/product/packages/vault/-/jobs/63675929

Override used to verify:

addons:
  vault:
    enabled: true
    ingress:
      gateway: "" # Clear out values to use public
      key: "" # Clear out values to use public
      cert: "" # Clear out values to use public

Before Upgrade:

kubectl get vs -n vault

NAME    GATEWAYS                                       HOSTS                       AGE
vault   ["istio-gateway/passthrough-ingressgateway"]   ["vault.dev.bigbang.mil"]   15m

kubectl get netpol -n vault | grep gateway

allow-egress-from-vault-autoinit-to-ns-istio-gateway-pod-passthrough-ingressgateway-tcp-port-8200   batch.kubernetes.io/job-name=vault-vault-job-init   15m
allow-ingress-to-vault-8200-from-ns-istio-gateway-pod-passthrough-ingressgateway                    app.kubernetes.io/name=vault                        15m

kubectl get ap -n vault | grep gateway

vault-passthrough-ingressgateway-authz-policy                                                                 ALLOW    15m

After Upgrade:

kubectl get vs -n vault

NAME    GATEWAYS                                  HOSTS                       AGE
vault   ["istio-gateway/public-ingressgateway"]   ["vault.dev.bigbang.mil"]   14m

kubectl get netpol -n vault | grep gateway

allow-egress-from-vault-autoinit-to-ns-istio-gateway-pod-public-ingressgateway-tcp-port-8443   batch.kubernetes.io/job-name=vault-vault-job-init   14m
allow-ingress-to-vault-8200-from-ns-istio-gateway-pod-public-ingressgateway                    app.kubernetes.io/name=vault                        14m

kubectl get ap -n vault | grep gateway

vault-public-ingressgateway-authz-policy                                                                      ALLOW    14m

Linked Issue

issue

Upgrade Notices

Vault can now use either a TLS-terminated gateway or a passthrough gateway. We recommend migrating to TLS termination at Big Bang’s public gateway because this will become the default behavior in Big Bang 4.0. If the public and passthrough gateways use different addresses, update the DNS record for vault.<domain> to point to the public gateway.

To use Big Bang’s public gateway, clear any explicit gateway selection and remove the Vault certificate and key:

addons:
  vault:
    ingress:
      gateway: ""
      cert: ""
      key: ""

When both cert and key are empty, TLS terminates at the public gateway and traffic is forwarded to Vault over HTTP. Supplying both values continues to configure Vault for TLS passthrough.

The raft.config key will need to be updated accordingly in order to successfully migrate and the vault pods will need to be manually restarted for the change to take full effect.

As an example, this is being used with Vault using the passthrough gateway:

    raft:
      enabled: true
      setNodeId: true

      config: |
        ui = true

        listener "tcp" {
          tls_disable = false
          address = "[::]:8200"
          cluster_address = "[::]:8201"
          tls_cert_file = "/vault/tls/tls.crt"
          tls_key_file  = "/vault/tls/tls.key"
          telemetry {
            unauthenticated_metrics_access = true
          }
        }

        storage "raft" {
          path = "/vault/data"

          retry_join {
            leader_api_addr = "https://vault-vault-0.vault-vault-internal:8200"
            leader_client_cert_file = "/vault/tls/tls.crt"
            leader_client_key_file = "/vault/tls/tls.key"
            leader_tls_servername = "vault.dev.bigbang.mil"
          }

          retry_join {
            leader_api_addr = "https://vault-vault-1.vault-vault-internal:8200"
            leader_client_cert_file = "/vault/tls/tls.crt"
            leader_client_key_file = "/vault/tls/tls.key"
            leader_tls_servername = "vault.dev.bigbang.mil"
          }

          retry_join {
            leader_api_addr = "https://vault-vault-2.vault-vault-internal:8200"
            leader_client_cert_file = "/vault/tls/tls.crt"
            leader_client_key_file = "/vault/tls/tls.key"
            leader_tls_servername = "vault.dev.bigbang.mil"
          }
        }
...

While the following would be used when using the TLS terminated gateway:

    raft:
      enabled: true
      setNodeId: true

      config: |
        ui = true

        listener "tcp" {
          tls_disable = true
          address = "[::]:8200"
          cluster_address = "[::]:8201"
          telemetry {
            unauthenticated_metrics_access = true
          }
        }

        storage "raft" {
          path = "/vault/data"

          retry_join {
            leader_api_addr = "http://vault-vault-0.vault-vault-internal:8200"
            leader_tls_servername = "vault.dev.bigbang.mil"
          }

          retry_join {
            leader_api_addr = "http://vault-vault-1.vault-vault-internal:8200"
            leader_tls_servername = "vault.dev.bigbang.mil"
          }

          retry_join {
            leader_api_addr = "http://vault-vault-2.vault-vault-internal:8200"
            leader_tls_servername = "vault.dev.bigbang.mil"
          }
        }
...