mirror of
https://github.com/andwati/telecom-platform.git
synced 2026-11-10 14:05:14 +00:00
feat: Add Kubernetes deployment documentation and HashiCorp Vault installation with TLS configuration
- Add README.md with architecture overview covering api-server (3 replicas), charging-engine (2 replicas), packet-gateway (2 replicas), web-dashboard (2 replicas), postgres, redis, monitoring stack (Prometheus, Grafana, InfluxDB, Alertmanager) - Add prerequisites section with kubectl/Docker/Helm requirements, Kubernetes 1.25+, 4 CPU/8GB RAM minimum, 50GB+ storage - Add quick start guide with deployment
This commit is contained in:
nutcas3
@@ -0,0 +1,198 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: vault
|
||||
labels:
|
||||
app.kubernetes.io/name: vault
|
||||
app.kubernetes.io/component: secrets
|
||||
app.kubernetes.io/part-of: telecom-platform
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: vault
|
||||
namespace: vault
|
||||
labels:
|
||||
app.kubernetes.io/name: vault
|
||||
app.kubernetes.io/component: secrets
|
||||
app.kubernetes.io/part-of: telecom-platform
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: vault
|
||||
app.kubernetes.io/component: secrets
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: vault
|
||||
app.kubernetes.io/component: secrets
|
||||
spec:
|
||||
containers:
|
||||
- name: vault
|
||||
image: hashicorp/vault:1.14.0
|
||||
ports:
|
||||
- containerPort: 8200
|
||||
name: vault
|
||||
- containerPort: 8201
|
||||
name: cluster
|
||||
env:
|
||||
- name: VAULT_ADDR
|
||||
value: "http://localhost:8200"
|
||||
- name: VAULT_CLUSTER_ADDR
|
||||
value: "http://localhost:8201"
|
||||
- name: VAULT_LOCAL_CONFIG
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: vault-config
|
||||
key: vault.hcl
|
||||
- name: VAULT_LOCAL_CONFIG_SKIP_BACKEND_CONFIG
|
||||
value: "true"
|
||||
- name: VAULT_SKIP_VERIFY
|
||||
value: "true"
|
||||
- name: SKIP_CHOWN
|
||||
value: "true"
|
||||
- name: VAULT_CACERT
|
||||
value: "/vault/tls/ca.crt"
|
||||
- name: VAULT_TLSCERT
|
||||
value: "/vault/tls/server.crt"
|
||||
- name: VAULT_TLSKEY
|
||||
value: "/vault/tls/server.key"
|
||||
command:
|
||||
- vault
|
||||
- server
|
||||
- -config=/vault/config/vault.hcl
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
securityContext:
|
||||
capabilities:
|
||||
add:
|
||||
- IPC_LOCK
|
||||
volumeMounts:
|
||||
- name: vault-config
|
||||
mountPath: /vault/config
|
||||
- name: vault-tls
|
||||
mountPath: /vault/tls
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /v1/sys/health
|
||||
port: vault
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /v1/sys/health
|
||||
port: vault
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 5
|
||||
volumes:
|
||||
- name: vault-config
|
||||
configMap:
|
||||
name: vault-config
|
||||
- name: vault-tls
|
||||
emptyDir:
|
||||
medium: Memory
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: vault
|
||||
namespace: vault
|
||||
labels:
|
||||
app.kubernetes.io/name: vault
|
||||
app.kubernetes.io/component: secrets
|
||||
app.kubernetes.io/part-of: telecom-platform
|
||||
spec:
|
||||
ports:
|
||||
- port: 8200
|
||||
name: vault
|
||||
targetPort: 8200
|
||||
- port: 8201
|
||||
name: cluster
|
||||
targetPort: 8201
|
||||
selector:
|
||||
app.kubernetes.io/name: vault
|
||||
app.kubernetes.io/component: secrets
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: vault-config
|
||||
namespace: vault
|
||||
labels:
|
||||
app.kubernetes.io/name: vault
|
||||
app.kubernetes.io/component: secrets
|
||||
app.kubernetes.io/part-of: telecom-platform
|
||||
data:
|
||||
vault.hcl: |
|
||||
ui = true
|
||||
|
||||
listener "tcp" {
|
||||
address = "0.0.0.0:8200"
|
||||
cluster_address = "0.0.0.0:8201"
|
||||
tls_disable = 1
|
||||
}
|
||||
|
||||
storage "consul" {
|
||||
address = "consul:8500"
|
||||
path = "vault/"
|
||||
}
|
||||
|
||||
api_addr = "http://vault:8200"
|
||||
cluster_addr = "http://vault:8201"
|
||||
|
||||
default_lease_ttl = "168h"
|
||||
max_lease_ttl = "720h"
|
||||
|
||||
disable_mlock = true
|
||||
|
||||
telemetry {
|
||||
prometheus_retention_time = "24h"
|
||||
disable_hostname = true
|
||||
}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: vault
|
||||
namespace: vault
|
||||
labels:
|
||||
app.kubernetes.io/name: vault
|
||||
app.kubernetes.io/component: secrets
|
||||
app.kubernetes.io/part-of: telecom-platform
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: vault
|
||||
labels:
|
||||
app.kubernetes.io/name: vault
|
||||
app.kubernetes.io/component: secrets
|
||||
app.kubernetes.io/part-of: telecom-platform
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: system:auth-delegator
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: vault
|
||||
namespace: vault
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: vault-token
|
||||
namespace: vault
|
||||
labels:
|
||||
app.kubernetes.io/name: vault
|
||||
app.kubernetes.io/component: secrets
|
||||
app.kubernetes.io/part-of: telecom-platform
|
||||
type: Opaque
|
||||
data:
|
||||
token: cm9vdA== # root
|
||||
@@ -0,0 +1,182 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: vault-secrets-config
|
||||
namespace: vault
|
||||
labels:
|
||||
app.kubernetes.io/name: vault
|
||||
app.kubernetes.io/component: secrets
|
||||
app.kubernetes.io/part-of: telecom-platform
|
||||
data:
|
||||
init-secrets.sh: |
|
||||
#!/bin/sh
|
||||
|
||||
# Wait for Vault to be ready
|
||||
until vault status; do
|
||||
echo "Waiting for Vault to be ready..."
|
||||
sleep 2
|
||||
done
|
||||
|
||||
# Initialize Vault
|
||||
vault operator init -key-shares=5 -key-threshold=3 > /tmp/vault-init.txt
|
||||
|
||||
# Unseal Vault (in production, this should be done manually)
|
||||
VAULT_TOKEN=$(grep 'Initial Root Token:' /tmp/vault-init.txt | awk '{print $4}')
|
||||
export VAULT_TOKEN
|
||||
|
||||
# Unseal with 3 keys
|
||||
vault operator unseal $(grep 'Key 1:' /tmp/vault-init.txt | awk '{print $3}')
|
||||
vault operator unseal $(grep 'Key 2:' /tmp/vault-init.txt | awk '{print $3}')
|
||||
vault operator unseal $(grep 'Key 3:' /tmp/vault-init.txt | awk '{print $3}')
|
||||
|
||||
# Enable auth methods
|
||||
vault auth enable kubernetes
|
||||
vault auth enable oidc
|
||||
vault auth enable userpass
|
||||
|
||||
# Enable secrets engines
|
||||
vault secrets enable kv-v2
|
||||
vault secrets enable database
|
||||
vault secrets enable transit
|
||||
|
||||
# Configure Kubernetes auth
|
||||
vault write auth/kubernetes/config \
|
||||
token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
|
||||
kubernetes_host="https://${KUBERNETES_PORT_443_TCP_ADDR}:443" \
|
||||
kubernetes_ca_cert="$(cat /var/run/secrets/kubernetes.io.serviceaccount/ca.crt)"
|
||||
|
||||
# Create policies
|
||||
vault policy write telecom-platform - <<EOF
|
||||
path "kv/data/telecom-platform/*" {
|
||||
capabilities = ["read", "list"]
|
||||
}
|
||||
|
||||
path "database/creds/telecom-platform" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
|
||||
path "transit/encrypt/*" {
|
||||
capabilities = ["update"]
|
||||
}
|
||||
|
||||
path "transit/decrypt/*" {
|
||||
capabilities = ["update"]
|
||||
}
|
||||
EOF
|
||||
|
||||
vault policy write telecom-platform-admin - <<EOF
|
||||
path "kv/data/telecom-platform/*" {
|
||||
capabilities = ["create", "read", "update", "delete", "list"]
|
||||
}
|
||||
|
||||
path "database/creds/telecom-platform" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
|
||||
path "database/config/telecom-platform" {
|
||||
capabilities = ["create", "read", "update", "delete"]
|
||||
}
|
||||
|
||||
path "transit/*" {
|
||||
capabilities = ["create", "read", "update", "delete", "list"]
|
||||
}
|
||||
EOF
|
||||
|
||||
# Configure database secrets engine
|
||||
vault write database/config/telecom-platform \
|
||||
plugin_name="postgresql-database-plugin" \
|
||||
connection_url="postgresql://{{username}}:{{password}}@postgres:5432/telecom_platform" \
|
||||
allowed_roles="telecom-platform" \
|
||||
username="vault" \
|
||||
password="vault_password"
|
||||
|
||||
vault write database/roles/telecom-platform \
|
||||
db_name="telecom-platform" \
|
||||
creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
|
||||
default_ttl="1h" \
|
||||
max_ttl="24h"
|
||||
|
||||
# Store telecom platform secrets
|
||||
vault kv put kv/telecom-platform/database \
|
||||
url="postgresql://postgres:prod123@postgres:5432/telecom_prod" \
|
||||
max_connections=100 \
|
||||
connection_timeout=30
|
||||
|
||||
vault kv put kv/telecom-platform/redis \
|
||||
url="redis://redis:6379" \
|
||||
max_connections=50 \
|
||||
connection_timeout=10
|
||||
|
||||
vault kv put kv/telecom-platform/jwt \
|
||||
secret="prod-jwt-secret-key" \
|
||||
expiration="24h"
|
||||
|
||||
vault kv put kv/telecom-platform/encryption \
|
||||
key="prod-encryption-key-256bits" \
|
||||
algorithm="AES-256-GCM"
|
||||
|
||||
vault kv put kv/telecom-platform/payment \
|
||||
stripe_secret_key="sk_live_..." \
|
||||
paypal_client_id="..." \
|
||||
paypal_client_secret="..."
|
||||
|
||||
# Create transit encryption key
|
||||
vault write -f transit/keys/telecom-platform
|
||||
|
||||
# Create Kubernetes roles
|
||||
vault write auth/kubernetes/role/telecom-platform \
|
||||
bound_service_account_names=telecom-platform \
|
||||
bound_service_account_namespaces=telecom-platform \
|
||||
policies=telecom-platform \
|
||||
ttl=24h
|
||||
|
||||
vault write auth/kubernetes/role/telecom-platform-admin \
|
||||
bound_service_account_names=telecom-platform-admin \
|
||||
bound_service_account_namespaces=telecom-platform \
|
||||
policies=telecom-platform-admin \
|
||||
ttl=8h
|
||||
|
||||
echo "Vault configuration completed successfully!"
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: vault-init
|
||||
namespace: vault
|
||||
labels:
|
||||
app.kubernetes.io/name: vault
|
||||
app.kubernetes.io/component: secrets
|
||||
app.kubernetes.io/part-of: telecom-platform
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: vault
|
||||
app.kubernetes.io/component: secrets
|
||||
spec:
|
||||
serviceAccountName: vault
|
||||
restartPolicy: OnFailure
|
||||
containers:
|
||||
- name: vault-init
|
||||
image: hashicorp/vault:1.14.0
|
||||
env:
|
||||
- name: VAULT_ADDR
|
||||
value: "http://vault:8200"
|
||||
- name: VAULT_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: vault-token
|
||||
key: token
|
||||
- name: KUBERNETES_PORT_443_TCP_ADDR
|
||||
value: "kubernetes.default.svc"
|
||||
command:
|
||||
- sh
|
||||
- /scripts/init-secrets.sh
|
||||
volumeMounts:
|
||||
- name: scripts
|
||||
mountPath: /scripts
|
||||
volumes:
|
||||
- name: scripts
|
||||
configMap:
|
||||
name: vault-secrets-config
|
||||
defaultMode: 0755
|
||||
Reference in New Issue
Block a user