Skip to content

Concourse vault

Ghost User requested to merge concourse-vault into master

Provisioning for concourse vault backend configuration

For each concourse instance a kubernetes role is created. Each k8s role gives access to approle secrets and oidc secrets for configuring concourse.

The approle secret gives access to pipeline secrets at secret/{{ role_name }}/*

Example with this call:

module "vault_concourse_client" {
  source = "../../modules/vault_concourse"

  client_id          = module.keycloak_oidc_concourse_client.client_id
  client_secret      = module.keycloak_oidc_concourse_client.client_secret
  secret_mount_path  = module.vault_base.secret_mount_path
  approle_mount_path = module.vault_base.approle_mount_path
  role_name          = "concourse"
  namespace          = "concourse"
}

The concourse-web pod in the namespace concourse will be able to read secrets (using kubernetes auth):

  • secret/oidc/concourse (eg: secret/oidc/{{ role_name }})
  • secret/applications/concourse/* (eg: secret/application/{{ role_name }}/*)

The OIDC client_id/client_secret is at secret/oidc/concourse and contains:

{
  "id": "....",
  "secret": "...."
}

The approle secret is at secret/applications/concourse/vault and contains:

{
  "role_id": "xxx",
  "secret_id": "xxx"
}

Other secrets might be created in secret/applications/concourse. For example, workers keys, local users...

Once concourse is running and configured with the approle it will be able to read pipeline secrets in secret/{{ role_name }}/*.

The idea is also to have global secrets, and team/pipeline scoped secrets, so concourse should be configured with:

CONCOURSE_VAULT_PATH_PREFIX: secret/{{ role_name }}/
CONCOURSE_VAULT_SHARED_PATH: global
Edited by Ghost User

Merge request reports