Murat ÖZDEMİR
508363fc75
Remove vault-transit service entirely. Each vault node now auto-unseals at startup by reading the Shamir unseal key from a Docker secret managed by vault-bootstrap.sh. Eliminates the transit token expiry failure mode and removes the vault_transit node-pinning requirement. Changes: - docker-stack-vault.yml: remove vault-transit service, vault_transit_config, vault-transit-data-vl, transit_master_token / vault_transit_unseal_key secrets; add vault_unseal_key secret; rewrite vault entrypoint to background start + poll + auto-unseal loop - vault-template-v1.json, vault-template-v2.json: remove seal.transit block - vault-template-transit.json: deleted (vault-transit is gone) - vault-bootstrap.sh: full rewrite — node-agnostic run_vault() helper (docker exec fallback to docker run over overlay network), 7-step Shamir flow with SKIP_DEPLOY support and early-exit when vault is already healthy - deploy-prod.yml: replace BE-Forecast deploy with vault stack deploy + bootstrap (SKIP_DEPLOY=true) + cluster health check
45 lines
1.2 KiB
YAML
45 lines
1.2 KiB
YAML
name: Deploy Vault Stack to Production
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- prod-env
|
|
|
|
concurrency:
|
|
group: vault-prod-deploy
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: prod-runner
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Connect Runner to Overlay Network
|
|
run: docker network connect iklimco-net $(hostname) || true
|
|
|
|
- name: Deploy Vault Stack
|
|
run: |
|
|
docker stack deploy \
|
|
--with-registry-auth \
|
|
-c docker-stack-vault.yml \
|
|
iklimco
|
|
|
|
- name: Run Bootstrap
|
|
env:
|
|
SKIP_DEPLOY: "true"
|
|
run: bash vault-bootstrap.sh
|
|
|
|
- name: Verify Vault Cluster Health
|
|
run: |
|
|
SEALED=$(docker run --rm --network iklimco-net hashicorp/vault:2.0.1 \
|
|
sh -c "VAULT_ADDR=https://vault.iklim.co:8200 VAULT_SKIP_VERIFY=true vault status 2>/dev/null" \
|
|
| awk '/^Sealed/{print $2}' || echo "true")
|
|
if [ "$SEALED" = "false" ]; then
|
|
echo "Vault cluster is unsealed and healthy"
|
|
else
|
|
echo "ERROR: Vault cluster is sealed or unreachable"
|
|
exit 1
|
|
fi
|