🎉 First commit

2023-09-18 22:31:19 +02:00
commit 4c23ce19c3
9 changed files with 592 additions and 0 deletions
--- a/init.sh
+++ b/init.sh
@@ -0,0 +1,110 @@
+#!/bin/bash
+
+source ./setup_env.sh
+
+snap install kubectl --classic
+snap install vault --classic
+
+kubectl create secret docker-registry registry-secret \
+		--docker-server=rg.fr-par.scw.cloud \
+		--docker-username=asr-projects \
+		--docker-password=$SCW_SECRET_KEY
+
+kubectl get secret registry-secret --output=yaml
+
+# Install traefik
+helm repo add traefik https://traefik.github.io/charts
+helm repo update
+kubectl create ns traefik
+helm --kubeconfig ./kubeconfig-k8s-projects.yaml install -n traefik traefik traefik/traefik
+
+# Install cert-manager
+helm repo add jetstack https://charts.jetstack.io
+helm repo update
+helm --kubeconfig ./kubeconfig-k8s-projects.yaml install cert-manager jetstack/cert-manager \
+	 --namespace cert-manager \
+	 --create-namespace \
+	 --version v1.12\
+	 --set installCRDs=true
+
+# Install vault
+helm repo add hashicorp https://helm.releases.hashicorp.com
+helm repo update
+helm install vault hashicorp/vault
+vault secrets enable database
+
+# Install traefik
+helm repo add traefik https://traefik.github.io/charts
+helm repo update
+helm install traefik traefik/traefik
+
+# Install prometheus
+helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
+helm repo update
+kubectl create ns monitoring
+helm --kubeconfig ./kubeconfig-k8s-projects.yaml \
+	 -n monitoring install kube-prometheus-stack prometheus-community/kube-prometheus-stack
+
+kubectl port-forward vault-0 8200:8200 &
+export VAULT_ADDR='http://127.0.0.1:8200'
+
+# Enable db passwords management by Vault
+# Cf. https://www.hashicorp.com/blog/dynamic-database-credentials-with-vault-and-kubernetes
+vault auth enable kubernetes
+vault write auth/kubernetes/config \
+	  kubernetes_host=https://5c3a37c1-03b3-4a9d-b36f-45566ece9847.api.k8s.fr-par.scw.cloud:6443 \
+	  disable_local_ca_jwt=true
+
+vault secrets enable database
+vault write database/config/carrramba_encore_rate \
+    plugin_name=postgresql-database-plugin \
+    verify_connection=false \
+    allowed_roles="*" \
+    connection_url="postgresql://{{username}}:{{password}}@postgres:5432/carrramba_encore_rate?sslmode=disable" \
+    username="postgres" \
+    password="password"
+
+vault policy write carrramba-encore-rate-api vault-carrramba-encore-rate-api-policy.hcl
+
+vault write --force /database/rotate-root/carrramba_encore_rate
+
+# TODO: Restore default_ttl and max_ttl once the api able to reload env variable on change.
+vault write database/roles/carrramba-encore-rate-api \
+    db_name=carrramba_encore_rate \
+    creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
+        GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
+    revocation_statements="ALTER ROLE \"{{name}}\" NOLOGIN;"\
+    default_ttl="768h" \
+    max_ttl="768h"
+    # default_ttl="1h" \
+    # max_ttl="24h"
+vault write auth/kubernetes/role/carrramba_encore_rate_api \
+    bound_service_account_names=carrramba-encore-rate-api \
+    bound_service_account_namespaces=default \
+    policies=carrramba-encore-rate-api \
+    ttl=1h
+
+vault policy write carrramba-encore-rate-admin vault-carrramba-encore-rate-admin-policy.hcl
+vault write database/roles/carrramba-encore-rate-admin \
+    db_name=carrramba_encore_rate \
+    creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
+        ALTER ROLE \"{{name}}\" SUPERUSER;" \
+    revocation_statements="ALTER ROLE \"{{name}}\" NOLOGIN;"\
+    default_ttl="1h" \
+    max_ttl="24h"
+vault write auth/kubernetes/role/carrramba-encore-rate-admin \
+    bound_service_account_names=carrramba-encore-rate-admin \
+    bound_service_account_namespaces=default \
+    policies=carrramba-encore-rate-admin \
+    ttl=1h
+
+vault secrets enable -path="carrramba-encore-rate-api" -description="carrramba-encore-rate secrets" kv
+vault kv put carrramba-encore-rate-api/idfm-api-key key=$(pass dev/idfm_prim_api_token)
+
+# Install tracing (cf. https://www.jaegertracing.io/docs/1.49/operator/)
+kubectl create namespace observability
+kubectl create -f https://github.com/jaegertracing/jaeger-operator/releases/download/v1.49.0/jaeger-operator.yaml -n observability
+kubectl apply -f observability.yaml -n observability
+
+kubectl apply -f carrramba-cert.yaml
+kubectl apply -f carrramba-encore-rate-deployment.yaml