feat(security): Remove Vault dependency on Consul by using file backend #2886
Conversation
jim-wang-intel
added
enhancement
jim-wang-intel
requested review from
hutchic,
tonyespy,
bnevis-i and
lenny-goodell
Codecov Report
@@ Coverage Diff @@
## master #2886 +/- ##
==========================================
+ Coverage 40.25% 40.66% +0.40%
==========================================
Files 170 170
Lines 13873 14156 +283
==========================================
+ Hits 5585 5756 +171
- Misses 7924 8023 +99
- Partials 364 377 +13
Continue to review full report at Codecov.
|
jim-wang-intel
force-pushed
the
remove-vault-dependent-consul
branch
2 times, most recently
from
3a79bd6
to
7192dc2
Compare
jim-wang-intel
force-pushed
the
remove-vault-dependent-consul
branch
from
66e22be
to
c0e29ae
Compare
jim-wang-intel
dismissed stale reviews from lenny-goodell and bnevis-i
via
2e600a3
jim-wang-intel
force-pushed
the
remove-vault-dependent-consul
branch
from
c0e29ae
to
2e600a3
Compare
|
@jim-wang-intel Merge conflicts. |
jim-wang-intel
force-pushed
the
remove-vault-dependent-consul
branch
from
2e600a3
to
8de1748
Compare
Conflicts resolved. Please check. |
…nd instead of consul Change the Vault backend storage configuration from Consul to Filesystem so that we can remove the Vault dependency on Consul. The docker-compose file will also need to change to remove the -consul dependency from repo developer-script. The current edgex-consul healthy check on Vault also need to be remove as that check becomes superfluous. Closes: edgexfoundry#2882 Signed-off-by: Jim Wang <yutsung.jim.wang@intel.com>
Resolve conflicts with master Signed-off-by: Jim Wang <yutsung.jim.wang@intel.com>
jim-wang-intel
force-pushed
the
remove-vault-dependent-consul
branch
from
8de1748
to
565a8fe
Compare
|
Kudos, SonarCloud Quality Gate passed!
|
| redirect_addr = "http://edgex-vault:8200" | ||
| cluster_addr = "http://edgex-vault:8201" | ||
| } | ||
| backend "file" { |
There was a problem hiding this comment.
Where does this go once this service is removed?
There was a problem hiding this comment.
it will go to "bootstrapper" i guess and this one is taking the baby step. so in terms of removing is beyond the scope of this related issue.
There was a problem hiding this comment.
It goes straight into the docker-compose file as static configuration via env var (TLS was generating the variable parameters)
There was a problem hiding this comment.
Should also check to see if the snap depends on this script to generate the config file, or uses something else.
There was a problem hiding this comment.
@lenny-intel please suggest a change. i do not know what you want me to do.
…nd (edgexfoundry#2886) * feat(security): Remove Vault dependency on Consul by using file backend instead of consul Change the Vault backend storage configuration from Consul to Filesystem so that we can remove the Vault dependency on Consul. The docker-compose file will also need to change to remove the -consul dependency from repo developer-script. The current edgex-consul healthy check on Vault also need to be remove as that check becomes superfluous. Closes: edgexfoundry#2882
Change the Vault backend storage configuration from Consul to filesystem so that we can remove Vault dependency on Consul.
The docker-compose file will also need to change to remove the -consul dependency from repo developer-script.
The current edgex-consul healthy check on Vault also need to be remove as that check becomes superfluous.
Closes: #2882
Signed-off-by: Jim Wang yutsung.jim.wang@intel.com
PR Checklist
Please check if your PR fulfills the following requirements:
If your build fails due to your commit message not passing the build checks, please review the guidelines here: https://github.com/edgexfoundry/edgex-go/blob/master/.github/Contributing.md.
What is the current behavior?
Currently the Vault's backend storage is
Consuland thus has the dependency onConsul.Issue Number: #2882
What is the new behavior?
To break and remove the direct dependency on
Consul. After this PR is merged, Vault won't directly depend on Consul.Does this PR introduce a breaking change?
New Imports
Specific Instructions
Are there any specific instructions or things that should be known prior to reviewing?
Pending on the related ADR to be approved
Other information
To test it, one can use docker-compose file generated from developer-script and remove the dependency on consul for
vaultservice like:Note that the services list under the
depends_onnow does not haveconsulany more. In other words, it is changed fromto
Run
docker-compose up vaultto test it and see there is no error in the docker logs regarding the Vault itself.