1
0
mirror of https://github.com/ceph/ceph-csi.git synced 2024-12-24 22:10:23 +00:00
ceph-csi/examples/kms/vault/tenant-sa.yaml
Niels de Vos 82557e3f34 util: allow configuring VAULT_BACKEND for Vault connection
It seems that the version of the key/value engine can not always be
detected for Hashicorp Vault. In certain cases, it is required to
configure the `VAULT_BACKEND` (or `vaultBackend`) option so that a
successful connection to the service can be made.

The `kv-v2` is the current default for development deployments of
Hashicorp Vault (what we use for automated testing). Production
deployments default to version 1 for now.

Signed-off-by: Niels de Vos <ndevos@redhat.com>
2021-07-22 13:02:47 +00:00

25 lines
573 B
YAML

---
#
# The ServiceAccount "ceph-csi-vault-sa" should be created in the Namespace of
# the tenant that will be creating encrypted PVCs with a "vaulttenantsa" KMS
# provider.
#
apiVersion: v1
kind: ServiceAccount
metadata:
name: ceph-csi-vault-sa
---
#
# Each tenant most likely has their own VAULT_BACKEND_PATH or other
# configuration options. In this example, the tenant has its own key-value
# store at "tenant".
#
apiVersion: v1
kind: ConfigMap
metadata:
name: ceph-csi-kms-config
data:
vaultBackend: kv-v2
vaultBackendPath: tenant
vaultRole: ceph-csi-tenant