Update Vault configuration

vault/README.md

@@ -7,5 +7,8 @@
 * Terraform CLI `1.0.8` or newer
 * a Digital Ocean [account](https://m.do.co/c/b73b4af31c09)
 
-## TODO
+## Deployment
 
+This deploys the following components to a Digital Ocean Kubernetes cluster.
+
+- Vault in dev mode (via Helm chart). Adds to Consul service mesh by default.

vault/main.tf

@@ -6,15 +6,5 @@ module "vault_on_doks" {
     kubernetes = kubernetes.doks
   }
 
-  # NOTE: this is NOT the version of Vault to use
-  chart_version = "0.16.1"
-}
-
-#module "vault_on_gke" {
-#  source = "./modules/vault"
-#
-#  providers = {
-#    helm       = helm.gke
-#    kubernetes = kubernetes.gke
-#  }
-#}
+  vault_dev_root_token = var.vault_token
+}

vault/modules/vault/main.tf

@@ -8,6 +8,9 @@ resource "helm_release" "vault" {
   version = var.chart_version # NOTE: this is NOT the version of Vault to use
 
   values = [
-    file("${path.module}/values.yml")
+    templatefile("${path.module}/values.yml", {
+      dev_root_token = var.vault_dev_root_token
+      add_to_service_mesh = var.add_to_service_mesh
+    })
   ]
 }

vault/modules/vault/values.yml

@@ -1,13 +1,28 @@
 ---
 
-  server:
-    dataStorage:
-      size: 128Mb
-    dev:
-      enabled: true
-    standalone:
-      enabled: true
-    authDelegator:
-      enabled: true
-  ui:
+global:
+  name: vault
+server:
+  %{ if add_to_service_mesh }
+  annotations:
+    consul.hashicorp.com/connect-inject: 'true'
+    consul.hashicorp.com/connect-service: 'vault'
+    consul.hashicorp.com/connect-service-port: '8200'
+    consul.hashicorp.com/connect-service-upstreams: 'expense-db-mysql:3306,expense-db-mssql:1433'
+    consul.hashicorp.com/transparent-proxy-exclude-outbound-ports: "8200,8201"
+    consul.hashicorp.com/transparent-proxy-exclude-inbound-ports: "8200,8201"
+  %{ endif }
+  dataStorage:
+    size: 128Mb
+  dev:
     enabled: true
+    devRootToken: ${dev_root_token}
+  standalone:
+    enabled: true
+
+ui:
+  enabled: true
+  serviceType: LoadBalancer
+
+csi:
+  enabled: false

vault/modules/vault/variables.tf

@@ -1,4 +1,16 @@
 variable "chart_version" {
   type        = string
   description = "Specify the exact chart version to install."
+  default     = "0.16.1"
+}
+
+variable "vault_dev_root_token" {
+  type        = string
+  description = "Vault root token for development mode."
+}
+
+variable "add_to_service_mesh" {
+  type        = bool
+  description = "Run Vault as part of Consul service mesh."
+  default     = true
 }

vault/terraform.tfvars.sample

@@ -1 +1,2 @@
 do_token = "..."
+vault_token = "..."

vault/variables.tf

@@ -1,6 +1,6 @@
 variable "do_region" {
   type        = string
-  description = "he slug identifier for the region where the resources will be created."
+  description = "The slug identifier for the region where the resources will be created."
   default     = "sfo3" # San Francisco, CA
 }
 
@@ -9,3 +9,9 @@ variable "do_token" {
   description = "This is the DO API token."
   sensitive   = true
 }
+
+variable "vault_token" {
+  type        = string
+  description = "Vault root token for dev mode."
+  sensitive   = true
+}