Pod - Hashicorp Vault #33

Merged

tepichord merged 12 commits from feat/18-pod-hashicorp-vault into main

2026-09-09 12:31:05 -07:00

tepichord commented

2026-09-08 16:51:00 -07:00

Owner

Closes #18

Automated PR created by forgejo-done adapter.

Closes #18 Automated PR created by forgejo-done adapter.

tepichord added 8 commits

2026-09-08 16:51:00 -07:00

feat(control-plane): widen NodePort range for Vault services a263584840

Append apiserver extraArgs patch to set service-node-port-range to
8080-32767, enabling NodePorts 8443/8200/8080 for Vault. Add plan test
assertion for the new config patch.

Refs: #18

feat(worker): add Vault data volume and Talos UserVolumeConfig 6eda48810a

Add 20 GiB qcow2 volume (milner-worker-1-vault.qcow2) attached as vdb,
with a UserVolumeConfig machine-config patch to partition and mount it at
/var/mnt/vault. Update cleanup.sh banner to warn about data volume
destruction. Add plan tests for vault volume, vdb disk, and UserVolumeConfig.

Refs: #18

feat(vault): add Terraform root for in-cluster Vault via Helm 113bd545e3

New vault/ root deploys HashiCorp Vault as a single-replica StatefulSet
on worker-large using the official vault-helm chart (0.34.1, image 2.0.4).
Includes nginx sidecar for Tailscale TLS termination, NodePort services
(8443/8080/8200), PSA privileged namespace label, and TLS secrets from
gitignored cert paths.

Plan tests mock kubernetes/helm providers and verify namespace labels,
helm_release properties, and nginx Service NodePorts.

Refs: #18

test: update pytest lint/fmt lists for vault migration 7f279ddf85

Add vault/ to terraform fmt recursive check. Replace hc-vault/yamllint
with vault/values.yaml. Skip hadolint test when no Dockerfiles exist.
Add vault terraform plan test.

Refs: #18

docs: repoint Vault references from hc-vault/ to vault/ 90dd33fca4

Update all documentation to reflect the in-cluster Vault migration:
README.md (link), AGENTS.md (repo map + tech stack), PLAN.md (phase 2
description + security model), ARCHITECTURE.md (reconciliation table +
NodePort note).

Refs: #18

docs(infra): shorten verbose comments, add missing section context 6c7c80aefb

- Add comment explaining NodePort range purpose in control-plane config patch
- Shorten disk-index explanation in worker plan tests

Refs: #18

fix(vault): ignore vault/certs holding real TLS private keys 71e0141066

README instructs copying mkcert/tailscale certs and private keys into
vault/certs/ and claims the dir is gitignored, but nothing excluded it;
a stray git add would stage real keys, violating the AGENTS.md hard
rule. Add a certs/ ignore entry.

Refs: #18

refactor(vault): drop meaningless nginx server_name from apiserver URL 8a8c464e2a

server_name was interpolated from the kubeconfig apiserver URL
(https://<cp-ip>:6443), which can never match a client Host header —
a leftover translation of the legacy podman nginx's real tailnet
hostname. The block is the sole vhost on :443, so it is the implicit
default server; removing the dead directive is behavior-preserving.

Refs: #18

tepichord added the

reviewing

label

2026-09-08 16:51:01 -07:00

tepichord added 3 commits

2026-09-09 12:25:02 -07:00

feat(vault): expose via Tailscale operator ingress; drop nginx sidecar + NodePorts 5436df5cd5

Vault is now reachable at https://vault.faun-snapper.ts.net through the
Tailscale Kubernetes operator (ingress ProxyGroup + Ingress with
tls.hosts pinning the MagicDNS name), retiring the per-app nginx
sidecar, NodePort services, and file-based tailscale/mkcert certs.

Architecture changes:
- vault/main.tf: remove tailscale cert/key variables, the vault-tls
  secret, the nginx ConfigMap, and the 8443/8080 NodePort service; add
  kubernetes_manifest ProxyGroup (ingress, replicas 1) and a Tailscale
  Ingress (backend vault:8200). No cert files or TLS variables remain.
- vault/values.yaml: tlsDisable true + tls_disable=1 (the operator
  proxies plaintext HTTP; Vault treats a keyless listener as TLS-on,
  which crashed with an empty cert path); mount vault-data hostPath at
  /vault/data (chart's own data mount was missing entirely); disable
  the unused sidecar injector (its Deployment readiness stall wedged
  helm upgrades to timeout); service type ClusterIP.
- Drop mkcert/tailscale certs + terraform.tfvars (no variables left).

Tests/docs:
- vault/tests: plan tests now assert ProxyGroup type and the Ingress
  (tailscale class, tls.hosts=vault, backend vault:8200); unused TLS
  fixture certs deleted. Control-plane range test message de-scoped
  from Vault (range kept widened, no current consumer).
- vault/README, AGENTS, ARCHITECTURE, PLAN: document the operator
  model, admin-console prerequisites (tagOwners, OAuth, service
  approval), plaintext backend rationale, and gotchas.

chore: remove decommissioned hc-vault podman stack 4b5a9d6716

The in-cluster Vault deployment supersedes the podman-compose stack;
podman-compose era ended when the VM-based cluster came up.

docs: add OPERATIONS.md runbook for out-of-band commands; link from READMEs 6d0e7c9a02

Terraform owns the vault namespace/Helm release/ProxyGroup/Ingress, the
worker data volume, and the apiserver node-port range — but the Tailscale
operator bootstrap, admin-console approvals, Vault init/unseal, and client
daemon flags were all applied by hand and captured by no repo file.

- OPERATIONS.md (new): canonical runbook + audit trail — what lives where
  (Terraform vs imperative vs admin console), ACL/OAuth/HTTPS/service
  approval steps, the helm operator install with env-based OAuth creds, the
  ingress-proxies-0 recycle that fixes 'Not advertising', Vault apply/init/
  unseal/day-2 commands, worker vault-volume attach/reboot, client
  accept-routes/operator flags, and full bring-up order from a wiped
  cluster.
- Root README: 'Out-of-band operations' section linking OPERATIONS.md.
- ARCHITECTURE.md: pointer note beside the network-topology table.
- vault/README.md: out-of-band callout + day-2 status/unseal/health section.
- worker/README.md: 'Vault data volume' section (attach, boot-time mount,
  preservation semantics).
- AGENTS.md: repo-map row for OPERATIONS.md.

tepichord added 1 commit

2026-09-09 12:30:54 -07:00

Merge branch 'main' of ssh://clone.gloom.garden/tepichord/milner into feat/18-pod-hashicorp-vault a69b7f6a3d