ceph-csi/examples/kms/vault/tenant-config.yaml

---
# This is an optional (re)configuration of the connection to the Vault
# Service that can be created in a Kubernetes Namespace for a Tenant.
apiVersion: v1
kind: ConfigMap
metadata:
  name: ceph-csi-kms-config
data:
  vaultAddress: "http://vault.default.svc.cluster.local:8200"
  vaultBackend: "kv-v1"
  vaultBackendPath: "secret/"
  vaultTLSServerName: "vault.default.svc.cluster.local"
  vaultCAVerify: "false"
util: allow tenants to (re)configure VaultTokens settings A tenant can place a ConfigMap in their Kubernetes Namespace with configuration options that differ from the global (by the Storage Admin set) values. The ConfigMap needs to be located in the Tenants namespace, as described in the documentation See-also: docs/design/proposals/encryption-with-vault-tokens.md Signed-off-by: Niels de Vos <ndevos@redhat.com> 2020-12-15 08:11:53 +00:00			`---`
			`# This is an optional (re)configuration of the connection to the Vault`
			`# Service that can be created in a Kubernetes Namespace for a Tenant.`
			`apiVersion: v1`
			`kind: ConfigMap`
			`metadata:`
			`name: ceph-csi-kms-config`
			`data:`
			`vaultAddress: "http://vault.default.svc.cluster.local:8200"`
util: allow configuring VAULT_BACKEND for Vault connection It seems that the version of the key/value engine can not always be detected for Hashicorp Vault. In certain cases, it is required to configure the `VAULT_BACKEND` (or `vaultBackend`) option so that a successful connection to the service can be made. The `kv-v2` is the current default for development deployments of Hashicorp Vault (what we use for automated testing). Production deployments default to version 1 for now. Signed-off-by: Niels de Vos <ndevos@redhat.com> 2021-07-20 09:18:58 +00:00			`vaultBackend: "kv-v1"`
util: allow tenants to (re)configure VaultTokens settings A tenant can place a ConfigMap in their Kubernetes Namespace with configuration options that differ from the global (by the Storage Admin set) values. The ConfigMap needs to be located in the Tenants namespace, as described in the documentation See-also: docs/design/proposals/encryption-with-vault-tokens.md Signed-off-by: Niels de Vos <ndevos@redhat.com> 2020-12-15 08:11:53 +00:00			`vaultBackendPath: "secret/"`
			`vaultTLSServerName: "vault.default.svc.cluster.local"`
			`vaultCAVerify: "false"`