Compare commits
2 Commits
4c23ce19c3
...
cdb10d130c
Author | SHA1 | Date | |
---|---|---|---|
cdb10d130c
|
|||
d6761b5a00
|
@@ -154,7 +154,7 @@ spec:
|
|||||||
- name: carrramba-encore-rate-api
|
- name: carrramba-encore-rate-api
|
||||||
image: rg.fr-par.scw.cloud/asr-projects/carrramba-encore-rate-api:latest
|
image: rg.fr-par.scw.cloud/asr-projects/carrramba-encore-rate-api:latest
|
||||||
command: ["/bin/bash"]
|
command: ["/bin/bash"]
|
||||||
args: ["-c", "source ${BASH_ENV} ; python ./main.py "]
|
args: ["-c", "source ${BASH_ENV} ; python ./api/main.py "]
|
||||||
# args: ["-c", "while true; do echo hello; sleep 10;done"]
|
# args: ["-c", "while true; do echo hello; sleep 10;done"]
|
||||||
ports:
|
ports:
|
||||||
- name: web
|
- name: web
|
||||||
@@ -163,7 +163,7 @@ spec:
|
|||||||
- name: BASH_ENV
|
- name: BASH_ENV
|
||||||
value: /vault/secrets/carrramba-encore-rate-api
|
value: /vault/secrets/carrramba-encore-rate-api
|
||||||
- name: CONFIG_PATH
|
- name: CONFIG_PATH
|
||||||
value: ./config.sample.yaml
|
value: ./api/config.sample.yaml
|
||||||
- name: CER__TRACING__ENABLE
|
- name: CER__TRACING__ENABLE
|
||||||
value: "true"
|
value: "true"
|
||||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||||
|
56
init.sh
56
init.sh
@@ -57,12 +57,12 @@ vault write auth/kubernetes/config \
|
|||||||
|
|
||||||
vault secrets enable database
|
vault secrets enable database
|
||||||
vault write database/config/carrramba_encore_rate \
|
vault write database/config/carrramba_encore_rate \
|
||||||
plugin_name=postgresql-database-plugin \
|
plugin_name=postgresql-database-plugin \
|
||||||
verify_connection=false \
|
verify_connection=false \
|
||||||
allowed_roles="*" \
|
allowed_roles="*" \
|
||||||
connection_url="postgresql://{{username}}:{{password}}@postgres:5432/carrramba_encore_rate?sslmode=disable" \
|
connection_url="postgresql://{{username}}:{{password}}@postgres:5432/carrramba_encore_rate?sslmode=disable" \
|
||||||
username="postgres" \
|
username="postgres" \
|
||||||
password="password"
|
password="password"
|
||||||
|
|
||||||
vault policy write carrramba-encore-rate-api vault-carrramba-encore-rate-api-policy.hcl
|
vault policy write carrramba-encore-rate-api vault-carrramba-encore-rate-api-policy.hcl
|
||||||
|
|
||||||
@@ -70,33 +70,33 @@ vault write --force /database/rotate-root/carrramba_encore_rate
|
|||||||
|
|
||||||
# TODO: Restore default_ttl and max_ttl once the api able to reload env variable on change.
|
# TODO: Restore default_ttl and max_ttl once the api able to reload env variable on change.
|
||||||
vault write database/roles/carrramba-encore-rate-api \
|
vault write database/roles/carrramba-encore-rate-api \
|
||||||
db_name=carrramba_encore_rate \
|
db_name=carrramba_encore_rate \
|
||||||
creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
|
creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
|
||||||
GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
|
GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
|
||||||
revocation_statements="ALTER ROLE \"{{name}}\" NOLOGIN;"\
|
revocation_statements="ALTER ROLE \"{{name}}\" NOLOGIN;"\
|
||||||
default_ttl="768h" \
|
default_ttl="768h" \
|
||||||
max_ttl="768h"
|
max_ttl="768h"
|
||||||
# default_ttl="1h" \
|
# default_ttl="1h" \
|
||||||
# max_ttl="24h"
|
# max_ttl="24h"
|
||||||
vault write auth/kubernetes/role/carrramba_encore_rate_api \
|
vault write auth/kubernetes/role/carrramba_encore_rate_api \
|
||||||
bound_service_account_names=carrramba-encore-rate-api \
|
bound_service_account_names=carrramba-encore-rate-api \
|
||||||
bound_service_account_namespaces=default \
|
bound_service_account_namespaces=default \
|
||||||
policies=carrramba-encore-rate-api \
|
policies=carrramba-encore-rate-api \
|
||||||
ttl=1h
|
ttl=1h
|
||||||
|
|
||||||
vault policy write carrramba-encore-rate-admin vault-carrramba-encore-rate-admin-policy.hcl
|
vault policy write carrramba-encore-rate-admin vault-carrramba-encore-rate-admin-policy.hcl
|
||||||
vault write database/roles/carrramba-encore-rate-admin \
|
vault write database/roles/carrramba-encore-rate-admin \
|
||||||
db_name=carrramba_encore_rate \
|
db_name=carrramba_encore_rate \
|
||||||
creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
|
creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
|
||||||
ALTER ROLE \"{{name}}\" SUPERUSER;" \
|
ALTER ROLE \"{{name}}\" SUPERUSER;" \
|
||||||
revocation_statements="ALTER ROLE \"{{name}}\" NOLOGIN;"\
|
revocation_statements="ALTER ROLE \"{{name}}\" NOLOGIN;"\
|
||||||
default_ttl="1h" \
|
default_ttl="1h" \
|
||||||
max_ttl="24h"
|
max_ttl="24h"
|
||||||
vault write auth/kubernetes/role/carrramba-encore-rate-admin \
|
vault write auth/kubernetes/role/carrramba-encore-rate-admin \
|
||||||
bound_service_account_names=carrramba-encore-rate-admin \
|
bound_service_account_names=carrramba-encore-rate-admin \
|
||||||
bound_service_account_namespaces=default \
|
bound_service_account_namespaces=default \
|
||||||
policies=carrramba-encore-rate-admin \
|
policies=carrramba-encore-rate-admin \
|
||||||
ttl=1h
|
ttl=1h
|
||||||
|
|
||||||
vault secrets enable -path="carrramba-encore-rate-api" -description="carrramba-encore-rate secrets" kv
|
vault secrets enable -path="carrramba-encore-rate-api" -description="carrramba-encore-rate secrets" kv
|
||||||
vault kv put carrramba-encore-rate-api/idfm-api-key key=$(pass dev/idfm_prim_api_token)
|
vault kv put carrramba-encore-rate-api/idfm-api-key key=$(pass dev/idfm_prim_api_token)
|
||||||
|
Reference in New Issue
Block a user