Add Vault Operator to Infra Cluster

argocd/infra/shared/vault-operator-configs/app.yml

@@ -0,0 +1,34 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: vault-operator-config
+  namespace: argocd
+spec:
+  goTemplate: true
+  goTemplateOptions: ["missingkey=error"]
+  generators:
+  - list:
+      elements:
+        # Names of clusters to deploy the app to
+        - name: infra
+          path: infra
+  template:
+    metadata:
+      name: '{{.name}}-vault-operator-config'
+      annotations:
+        argocd.argoproj.io/sync-wave: "-1"
+    spec:
+      project: infrastructure-project
+      source:
+        path: components/infra/vault-operator-config-infra/{{.path}}
+        repoURL: 'https://github.com/isisbusapps/gitops'
+        targetRevision: main
+      destination:
+        namespace: lgtm
+        name: '{{.name}}'
+      syncPolicy:
+        automated: 
+          selfHeal: true
+        syncOptions:
+          - CreateNamespace=true
+          - ServerSideApply=true

argocd/infra/shared/vault-operator/app.yml

@@ -0,0 +1,35 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: vault-operator
+  namespace: argocd
+spec:
+  goTemplate: true
+  goTemplateOptions: ["missingkey=error"]
+  generators:
+  - list:
+      elements:
+        # Names of clusters to deploy the app to
+        - name: infra
+  template:
+    metadata:
+      name: '{{.name}}-vault-operator'
+      annotations:
+        argocd.argoproj.io/sync-wave: "-10"
+    spec:
+      project: infrastructure-project
+      source:
+        repoURL: https://helm.releases.hashicorp.com
+        targetRevision: 0.10.0
+        chart: vault-secrets-operator
+        helm:
+          releaseName: vault-operator
+      destination:
+        namespace: vault-operator
+        name: '{{.name}}'
+      syncPolicy:
+        automated: 
+          selfHeal: true
+        syncOptions:
+          - CreateNamespace=true
+          - ServerSideApply=true

components/infra/vault-operator-config-infra/infra/vault-auth-service-account.yaml

@@ -0,0 +1,48 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  namespace: lgtm
+  name: vault-op
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: service-account-read
+  namespace: lgtm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: service-account-read
+subjects:
+  - kind: ServiceAccount
+    name: vault-op
+    namespace: lgtm
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: service-account-read-lgtm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+  - kind: ServiceAccount
+    name: vault-op
+    namespace: lgtm
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: service-account-read
+  namespace: lgtm
+rules:
+  - apiGroups: [""]
+    resources: ["serviceaccounts"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: ["authentication.k8s.io"]
+    resources: ["tokenreviews"]
+    verbs: ["create"]
+  - apiGroups: [ "authentication.k8s.io" ]
+    resources: [ "subjectaccessreviews" ]
+    verbs: [ "create" ]

components/infra/vault-operator-config-infra/infra/vault-auth.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: static-auth
+  namespace: lgtm
+spec:
+  vaultConnectionRef: secrets-isis-connection
+  method: kubernetes
+  mount: fase-infra
+  allowedNamespaces:
+    - "*"
+  kubernetes:
+    role: cluster
+    serviceAccount: vault-op
+    audiences:
+      - vault
+      - https://kubernetes.default.svc.cluster.local

components/infra/vault-operator-config-infra/infra/vault-connection.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultConnection
+metadata:
+  namespace: lgtm
+  name: secrets-isis-connection
+spec:
+  address: "https://secrets.isis.rl.ac.uk"

components/ua/vault-operator-config/dev/vault-auth.yaml

@@ -7,7 +7,7 @@ metadata:
 spec:
   vaultConnectionRef: secrets-isis-connection
   method: kubernetes
-  mount: u-and-a-dev
+  mount: fase-infra
   allowedNamespaces:
     - "*"
   kubernetes: