From ee1505a1dbf07f2592a6562eae2b1a5beb1dd3c4 Mon Sep 17 00:00:00 2001 From: David Symons Date: Mon, 17 Aug 2026 14:02:06 +0100 Subject: [PATCH 1/7] Add vault operator config --- .../shared/vault-operator-configs/app.yml | 34 +++++++++++++ argocd/infra/shared/vault-operator/app.yml | 35 ++++++++++++++ .../infra/vault-auth-service-account.yaml | 48 +++++++++++++++++++ .../infra/vault-auth.yaml | 18 +++++++ .../infra/vault-connection.yaml | 8 ++++ 5 files changed, 143 insertions(+) create mode 100644 argocd/infra/shared/vault-operator-configs/app.yml create mode 100644 argocd/infra/shared/vault-operator/app.yml create mode 100644 components/infra/vault-operator-config/infra/vault-auth-service-account.yaml create mode 100644 components/infra/vault-operator-config/infra/vault-auth.yaml create mode 100644 components/infra/vault-operator-config/infra/vault-connection.yaml diff --git a/argocd/infra/shared/vault-operator-configs/app.yml b/argocd/infra/shared/vault-operator-configs/app.yml new file mode 100644 index 00000000..17f72287 --- /dev/null +++ b/argocd/infra/shared/vault-operator-configs/app.yml @@ -0,0 +1,34 @@ +apiVersion: argoproj.io/v1alpha1 +kind: ApplicationSet +metadata: + name: vault-operator-config + namespace: argocd +spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] + generators: + - list: + elements: + # Names of clusters to deploy the app to + - name: infra + path: infra + template: + metadata: + name: '{{.name}}-vault-operator-config' + annotations: + argocd.argoproj.io/sync-wave: "-1" + spec: + project: infrastructure-project + source: + path: components/infra/vault-operator-config/{{.path}} + repoURL: 'https://github.com/isisbusapps/gitops' + targetRevision: main + destination: + namespace: lgtm + name: '{{.name}}' + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true \ No newline at end of file diff --git a/argocd/infra/shared/vault-operator/app.yml b/argocd/infra/shared/vault-operator/app.yml new file mode 100644 index 00000000..011fc5ed --- /dev/null +++ b/argocd/infra/shared/vault-operator/app.yml @@ -0,0 +1,35 @@ +apiVersion: argoproj.io/v1alpha1 +kind: ApplicationSet +metadata: + name: vault-operator + namespace: argocd +spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] + generators: + - list: + elements: + # Names of clusters to deploy the app to + - name: infra + template: + metadata: + name: '{{.name}}-vault-operator' + annotations: + argocd.argoproj.io/sync-wave: "-10" + spec: + project: infrastructure-project + source: + repoURL: https://helm.releases.hashicorp.com + targetRevision: 0.10.0 + chart: vault-secrets-operator + helm: + releaseName: vault-operator + destination: + namespace: vault-operator + name: '{{.name}}' + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true diff --git a/components/infra/vault-operator-config/infra/vault-auth-service-account.yaml b/components/infra/vault-operator-config/infra/vault-auth-service-account.yaml new file mode 100644 index 00000000..6004c3b3 --- /dev/null +++ b/components/infra/vault-operator-config/infra/vault-auth-service-account.yaml @@ -0,0 +1,48 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + namespace: lgtm + name: vault-op +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: service-account-read + namespace: lgtm +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: service-account-read +subjects: + - kind: ServiceAccount + name: vault-op + namespace: lgtm +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: service-account-read-apps +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: system:auth-delegator +subjects: + - kind: ServiceAccount + name: vault-op + namespace: lgtm +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: service-account-read + namespace: lgtm +rules: + - apiGroups: [""] + resources: ["serviceaccounts"] + verbs: ["get", "watch", "list"] + - apiGroups: ["authentication.k8s.io"] + resources: ["tokenreviews"] + verbs: ["create"] + - apiGroups: [ "authentication.k8s.io" ] + resources: [ "subjectaccessreviews" ] + verbs: [ "create" ] \ No newline at end of file diff --git a/components/infra/vault-operator-config/infra/vault-auth.yaml b/components/infra/vault-operator-config/infra/vault-auth.yaml new file mode 100644 index 00000000..ebd11d59 --- /dev/null +++ b/components/infra/vault-operator-config/infra/vault-auth.yaml @@ -0,0 +1,18 @@ +--- +apiVersion: secrets.hashicorp.com/v1beta1 +kind: VaultAuth +metadata: + name: static-auth + namespace: lgtm +spec: + vaultConnectionRef: secrets-isis-connection + method: kubernetes + mount: fase-infra + allowedNamespaces: + - "*" + kubernetes: + role: cluster + serviceAccount: vault-op + audiences: + - vault + - https://kubernetes.default.svc.cluster.local \ No newline at end of file diff --git a/components/infra/vault-operator-config/infra/vault-connection.yaml b/components/infra/vault-operator-config/infra/vault-connection.yaml new file mode 100644 index 00000000..690071b8 --- /dev/null +++ b/components/infra/vault-operator-config/infra/vault-connection.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: secrets.hashicorp.com/v1beta1 +kind: VaultConnection +metadata: + namespace: lgtm + name: secrets-isis-connection +spec: + address: "https://secrets.isis.rl.ac.uk" \ No newline at end of file From c59f901cafc151876bef3700efdea85aa8a6db49 Mon Sep 17 00:00:00 2001 From: David Symons Date: Fri, 21 Aug 2026 15:14:10 +0100 Subject: [PATCH 2/7] Cleanup config & naming --- argocd/infra/shared/vault-operator-configs/app.yml | 2 +- .../infra/vault-auth-service-account.yaml | 2 +- .../infra/vault-auth.yaml | 0 .../infra/vault-connection.yaml | 0 components/ua/vault-operator-config/dev/vault-auth.yaml | 2 +- 5 files changed, 3 insertions(+), 3 deletions(-) rename components/infra/{vault-operator-config => vault-operator-config-infra}/infra/vault-auth-service-account.yaml (96%) rename components/infra/{vault-operator-config => vault-operator-config-infra}/infra/vault-auth.yaml (100%) rename components/infra/{vault-operator-config => vault-operator-config-infra}/infra/vault-connection.yaml (100%) diff --git a/argocd/infra/shared/vault-operator-configs/app.yml b/argocd/infra/shared/vault-operator-configs/app.yml index 17f72287..4097ab73 100644 --- a/argocd/infra/shared/vault-operator-configs/app.yml +++ b/argocd/infra/shared/vault-operator-configs/app.yml @@ -20,7 +20,7 @@ spec: spec: project: infrastructure-project source: - path: components/infra/vault-operator-config/{{.path}} + path: components/infra/vault-operator-config-infra/{{.path}} repoURL: 'https://github.com/isisbusapps/gitops' targetRevision: main destination: diff --git a/components/infra/vault-operator-config/infra/vault-auth-service-account.yaml b/components/infra/vault-operator-config-infra/infra/vault-auth-service-account.yaml similarity index 96% rename from components/infra/vault-operator-config/infra/vault-auth-service-account.yaml rename to components/infra/vault-operator-config-infra/infra/vault-auth-service-account.yaml index 6004c3b3..b61e7594 100644 --- a/components/infra/vault-operator-config/infra/vault-auth-service-account.yaml +++ b/components/infra/vault-operator-config-infra/infra/vault-auth-service-account.yaml @@ -21,7 +21,7 @@ subjects: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: service-account-read-apps + name: service-account-read-lgtm roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole diff --git a/components/infra/vault-operator-config/infra/vault-auth.yaml b/components/infra/vault-operator-config-infra/infra/vault-auth.yaml similarity index 100% rename from components/infra/vault-operator-config/infra/vault-auth.yaml rename to components/infra/vault-operator-config-infra/infra/vault-auth.yaml diff --git a/components/infra/vault-operator-config/infra/vault-connection.yaml b/components/infra/vault-operator-config-infra/infra/vault-connection.yaml similarity index 100% rename from components/infra/vault-operator-config/infra/vault-connection.yaml rename to components/infra/vault-operator-config-infra/infra/vault-connection.yaml diff --git a/components/ua/vault-operator-config/dev/vault-auth.yaml b/components/ua/vault-operator-config/dev/vault-auth.yaml index 21743fa8..b7a11b0d 100644 --- a/components/ua/vault-operator-config/dev/vault-auth.yaml +++ b/components/ua/vault-operator-config/dev/vault-auth.yaml @@ -7,7 +7,7 @@ metadata: spec: vaultConnectionRef: secrets-isis-connection method: kubernetes - mount: u-and-a-dev + mount: fase-infra allowedNamespaces: - "*" kubernetes: From 45148de139fa49ef1cf10e4c41dd92a6ec619fa7 Mon Sep 17 00:00:00 2001 From: David Symons Date: Tue, 25 Aug 2026 13:15:22 +0100 Subject: [PATCH 3/7] Add app.yaml --- argocd/infra/app-of-apps/app.yaml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 argocd/infra/app-of-apps/app.yaml diff --git a/argocd/infra/app-of-apps/app.yaml b/argocd/infra/app-of-apps/app.yaml new file mode 100644 index 00000000..5a25ad76 --- /dev/null +++ b/argocd/infra/app-of-apps/app.yaml @@ -0,0 +1,18 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: app-of-apps-fase-infra + namespace: argocd +spec: + project: infrastructure-project + source: + path: argocd/infra + repoURL: https://github.com/isisbusapps/gitops + targetRevision: main + directory: + recurse: true + destination: + namespace: argocd + server: https://kubernetes.default.svc + syncPolicy: + automated: {} \ No newline at end of file From 635b2c44b88b492e711edbb4ef2ff7e3484935bc Mon Sep 17 00:00:00 2001 From: David Symons Date: Tue, 25 Aug 2026 13:42:52 +0100 Subject: [PATCH 4/7] Update revision to working branch --- argocd/infra/app-of-apps/app.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/argocd/infra/app-of-apps/app.yaml b/argocd/infra/app-of-apps/app.yaml index 5a25ad76..c36d0de9 100644 --- a/argocd/infra/app-of-apps/app.yaml +++ b/argocd/infra/app-of-apps/app.yaml @@ -8,7 +8,7 @@ spec: source: path: argocd/infra repoURL: https://github.com/isisbusapps/gitops - targetRevision: main + targetRevision: AddInfraVaultOperator directory: recurse: true destination: From 7e6b464ecaafbc10abc7ebdf19d1815839809cb6 Mon Sep 17 00:00:00 2001 From: David Symons Date: Tue, 25 Aug 2026 13:44:51 +0100 Subject: [PATCH 5/7] Specify differences between vault operators --- argocd/infra/shared/vault-operator-configs/app.yml | 2 +- argocd/infra/shared/vault-operator/app.yml | 2 +- argocd/prod/ua/vault-operator-configs/app.yaml | 2 +- argocd/prod/ua/vault-operator/app.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/argocd/infra/shared/vault-operator-configs/app.yml b/argocd/infra/shared/vault-operator-configs/app.yml index 4097ab73..c5e14271 100644 --- a/argocd/infra/shared/vault-operator-configs/app.yml +++ b/argocd/infra/shared/vault-operator-configs/app.yml @@ -1,7 +1,7 @@ apiVersion: argoproj.io/v1alpha1 kind: ApplicationSet metadata: - name: vault-operator-config + name: infra-vault-operator-config namespace: argocd spec: goTemplate: true diff --git a/argocd/infra/shared/vault-operator/app.yml b/argocd/infra/shared/vault-operator/app.yml index 011fc5ed..b9fa80bf 100644 --- a/argocd/infra/shared/vault-operator/app.yml +++ b/argocd/infra/shared/vault-operator/app.yml @@ -1,7 +1,7 @@ apiVersion: argoproj.io/v1alpha1 kind: ApplicationSet metadata: - name: vault-operator + name: infra-vault-operator namespace: argocd spec: goTemplate: true diff --git a/argocd/prod/ua/vault-operator-configs/app.yaml b/argocd/prod/ua/vault-operator-configs/app.yaml index 22c4a603..e8421091 100644 --- a/argocd/prod/ua/vault-operator-configs/app.yaml +++ b/argocd/prod/ua/vault-operator-configs/app.yaml @@ -1,7 +1,7 @@ apiVersion: argoproj.io/v1alpha1 kind: ApplicationSet metadata: - name: vault-operator-config + name: prod-vault-operator-config namespace: argocd spec: goTemplate: true diff --git a/argocd/prod/ua/vault-operator/app.yaml b/argocd/prod/ua/vault-operator/app.yaml index 78992b1d..74912914 100644 --- a/argocd/prod/ua/vault-operator/app.yaml +++ b/argocd/prod/ua/vault-operator/app.yaml @@ -1,7 +1,7 @@ apiVersion: argoproj.io/v1alpha1 kind: ApplicationSet metadata: - name: vault-operator + name: prod-vault-operator namespace: argocd spec: goTemplate: true From c2f584e86445f75c4f4ef5f092d16274747705a9 Mon Sep 17 00:00:00 2001 From: David Symons Date: Tue, 25 Aug 2026 13:56:07 +0100 Subject: [PATCH 6/7] Move revision back to main --- argocd/infra/app-of-apps/app.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/argocd/infra/app-of-apps/app.yaml b/argocd/infra/app-of-apps/app.yaml index c36d0de9..5a25ad76 100644 --- a/argocd/infra/app-of-apps/app.yaml +++ b/argocd/infra/app-of-apps/app.yaml @@ -8,7 +8,7 @@ spec: source: path: argocd/infra repoURL: https://github.com/isisbusapps/gitops - targetRevision: AddInfraVaultOperator + targetRevision: main directory: recurse: true destination: From 1b181536552aeff21c7f6c8aa7abf0563befec03 Mon Sep 17 00:00:00 2001 From: David Symons Date: Tue, 25 Aug 2026 14:08:53 +0100 Subject: [PATCH 7/7] Correct ua vault --- components/ua/vault-operator-config/dev/vault-auth.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/ua/vault-operator-config/dev/vault-auth.yaml b/components/ua/vault-operator-config/dev/vault-auth.yaml index b7a11b0d..21743fa8 100644 --- a/components/ua/vault-operator-config/dev/vault-auth.yaml +++ b/components/ua/vault-operator-config/dev/vault-auth.yaml @@ -7,7 +7,7 @@ metadata: spec: vaultConnectionRef: secrets-isis-connection method: kubernetes - mount: fase-infra + mount: u-and-a-dev allowedNamespaces: - "*" kubernetes: