Add annotations to configure Agent Cache #132

lawliet89 · 2020-05-06T07:47:45Z

TLS is always disabled because there is no way to mount arbitrary
volumes to the agent sidecar container

Fixes #73

$ make test
go test -race ./...
?       github.com/hashicorp/vault-k8s  [no test files]
ok      github.com/hashicorp/vault-k8s/agent-inject     (cached)
ok      github.com/hashicorp/vault-k8s/agent-inject/agent       (cached)
ok      github.com/hashicorp/vault-k8s/helper/cert      (cached)
ok      github.com/hashicorp/vault-k8s/subcommand/injector      (cached)
?       github.com/hashicorp/vault-k8s/subcommand/version       [no test files]
?       github.com/hashicorp/vault-k8s/version  [no test files]

- TLS is always disabled because there is no way to mount arbitrary volumes to the agent sidecar container

jasonodonnell · 2020-05-19T13:56:02Z

agent-inject/agent/annotations.go

+	AnnotationAgentCacheUseAutoAuthToken = "vault.hashicorp.com/agent-cache-use-auth-auth-token"
+
+	// AnnotationAgentCacheListenerAddress configures the address the agent cache should listen on
+	AnnotationAgentCacheListenerAddress = "vault.hashicorp.com/agent-cache-listener-address"


Maybe this shouldn't be configurable but always be 127.0.0.1. This really shouldn't be listening to anything other than localhost. Especially since the use-auth-auth-token parameter is configurable, unauthenticated clients could retrieve secrets from Vault if misconfigured.

I was thinking of allowing the user to change the port. Should I change this into a port configuration then?

What is your thoughts with enabling the listener? If other containers in the pod want to use the vault agent as a proxy?

I am not sure what you mean by this question. Do you mean what are my thoughts on allowing the listener to listen to IP addresses other than 127.0.0.1? I think you're right that it is a bad idea.

Just trying to understand the feature more in general.

We definitely don't want to bind to anything other than localhost, port configuration could be useful.

I see. I think this is a very useful feature. Other than just proxying, the vault agent cache also takes care of renewing secrets. I have some applications that basically "outsource" the renewal duty to Vault agent. Otherwise, they would have to implement the logic themselves, which might not be trivial.

The agent cache also takes care of Vault's CA without having to require the user to somehow configure themselves to accept the Vault CA.

Agreed with it being useful. I think turning this into a port configurable makes more sense.

OK. I will make the change in a bit.

Done. See f0dc686

…agent-cache

lawliet89 · 2020-06-04T06:31:20Z

@jasonodonnell Could we get this merged in if it's ok? There's been quite a few conflicts.

jasonodonnell

LGTM, thanks!

hamishforbes · 2020-06-16T17:06:59Z

Any chance of a release with this feature? It just barely missed the 0.4.0 release
Would really be appreciated as doing this with config maps for vault is a real pita!

reegnz · 2020-07-21T15:38:01Z

Please do a 0.5.0 release with this! Would be really great if I could start using this and not have to do explicit agent configs to do have listeners. :)

lawliet89 · 2020-08-12T07:57:55Z

@tvoran and @jasonodonnell : Could you please make a new release with this?

In any case, if you cannot wait, I've built and push a new image to lawliet89/vault-k8s:0.4.1-gh132 from commit 23879d1

The caveats are:

Built with make image
Binary was compiled on my machine
Binary is not signed by Hashicorp GPG key

EDIT: Might also be great to include #167 for a "pure" agent cache usage scenario.

jasonodonnell · 2020-08-12T16:18:05Z

We're planning a release soon @lawliet89, there's a few more PRs we're hoping to pull in for that release. Likely next week (August 17th-21st).

jasonodonnell · 2020-08-21T15:50:46Z

@lawliet89 My apologies for the delay on this release. I wanted to circle back to let you know this release is planned for August 24th. Vault is currently being released and since the Vault container is an official Docker image, we need to wait for them to publish the new images, which can take a day or two. Once the official images are available on Dockerhub, we'll update Vault K8s internal references to the latest image and get this published.

Thanks!

reegnz · 2020-08-24T09:09:54Z

It seems like those images got pushed 3 days ago.
Hoping for a release today! 🤞

How come this release is blocked by the new image version BTW? These releases shouldn't rely on what vault version we're running.

jasonodonnell · 2020-08-24T09:49:01Z

@reegnz, it doesn't really matter, but there are references internally for default injected image:

vault-k8s/agent-inject/agent/agent.go

Line 17 in 1ee5b2e

DefaultVaultImage = "vault:1.4.2"

.

Whenever possible we try to update this to the latest image. 1.5.2 released late on Friday so Vault K8s releases today.

* Add annotations to configure Agent Cache - TLS is always disabled because there is no way to mount arbitrary volumes to the agent sidecar container * Allow configuring listener port and not address

Add annotations to configure Agent Cache

5fe1803

- TLS is always disabled because there is no way to mount arbitrary volumes to the agent sidecar container

lawliet89 force-pushed the agent-cache branch from b5d64c7 to 5fe1803 Compare May 6, 2020 07:50

lawliet89 mentioned this pull request May 6, 2020

Support running Vault Agent cache in sidecar container #73

Closed

jasonodonnell reviewed May 19, 2020

View reviewed changes

lawliet89 added 3 commits May 20, 2020 12:38

Allow configuring listener port and not address

f0dc686

Merge branch 'master' of https://github.com/hashicorp/vault-k8s into …

68c2679

…agent-cache

Merge branch 'master' of https://github.com/hashicorp/vault-k8s into …

d85ad35

…agent-cache

jasonodonnell approved these changes Jun 4, 2020

View reviewed changes

jasonodonnell merged commit d0c76c7 into hashicorp:master Jun 4, 2020

jasonodonnell mentioned this pull request Jun 4, 2020

Vault Agent Sidecar Listener? #138

Closed

lawliet89 deleted the agent-cache branch June 5, 2020 02:51

jasonodonnell mentioned this pull request Aug 24, 2020

Update to 0.5.0 #173

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add annotations to configure Agent Cache #132

Add annotations to configure Agent Cache #132

lawliet89 commented May 6, 2020 •

edited

Loading

jasonodonnell May 19, 2020

lawliet89 May 19, 2020

jasonodonnell May 20, 2020

lawliet89 May 20, 2020

jasonodonnell May 20, 2020 •

edited

Loading

lawliet89 May 20, 2020 •

edited

Loading

jasonodonnell May 20, 2020

lawliet89 May 20, 2020

lawliet89 May 20, 2020

lawliet89 commented Jun 4, 2020

jasonodonnell left a comment

hamishforbes commented Jun 16, 2020

reegnz commented Jul 21, 2020 •

edited

Loading

lawliet89 commented Aug 12, 2020 •

edited

Loading

jasonodonnell commented Aug 12, 2020

jasonodonnell commented Aug 21, 2020

reegnz commented Aug 24, 2020

jasonodonnell commented Aug 24, 2020

Add annotations to configure Agent Cache #132

Add annotations to configure Agent Cache #132

Conversation

lawliet89 commented May 6, 2020 • edited Loading

jasonodonnell May 19, 2020

Choose a reason for hiding this comment

lawliet89 May 19, 2020

Choose a reason for hiding this comment

jasonodonnell May 20, 2020

Choose a reason for hiding this comment

lawliet89 May 20, 2020

Choose a reason for hiding this comment

jasonodonnell May 20, 2020 • edited Loading

Choose a reason for hiding this comment

lawliet89 May 20, 2020 • edited Loading

Choose a reason for hiding this comment

jasonodonnell May 20, 2020

Choose a reason for hiding this comment

lawliet89 May 20, 2020

Choose a reason for hiding this comment

lawliet89 May 20, 2020

Choose a reason for hiding this comment

lawliet89 commented Jun 4, 2020

jasonodonnell left a comment

Choose a reason for hiding this comment

hamishforbes commented Jun 16, 2020

reegnz commented Jul 21, 2020 • edited Loading

lawliet89 commented Aug 12, 2020 • edited Loading

jasonodonnell commented Aug 12, 2020

jasonodonnell commented Aug 21, 2020

reegnz commented Aug 24, 2020

jasonodonnell commented Aug 24, 2020

lawliet89 commented May 6, 2020 •

edited

Loading

jasonodonnell May 20, 2020 •

edited

Loading

lawliet89 May 20, 2020 •

edited

Loading

reegnz commented Jul 21, 2020 •

edited

Loading

lawliet89 commented Aug 12, 2020 •

edited

Loading