afnix/infra
0
0
Fork 0
Code Issues 40 Pull requests 10 Projects Releases Packages Wiki Activity

[Tracking Issue] Secret management at scale #156

New issue
Open
opened 2024-12-15 16:13:09 +00:00 by raito · 4 comments
raito commented 2024-12-15 16:13:09 +00:00 (Migrated from git.lix.systems)
Copy link

Here's the list of things we need to convert to our Vault server.

  • Monitoring
  • Terraform S3 access keys for operators
  • AppRole via SPIFFE
  • OfBorg's RabbitMQ connections
  • PostgreSQL's connections for Hydra & co.
Here's the list of things we need to convert to our Vault server. - [x] Monitoring - [x] Terraform S3 access keys for operators - [ ] AppRole via SPIFFE - [x] OfBorg's RabbitMQ connections - [ ] PostgreSQL's connections for Hydra & co.
raito commented 2025-01-02 17:41:12 +00:00 (Migrated from git.lix.systems)
Copy link

OfBorg done in https://git.lix.systems/the-distro/infra/pulls/162.
Next is PostgreSQL for Hydra. Terraform S3 requires a privileged sort of API to emit scoped keys which we do not have right now. With Ceph RGW, that's very feasible.

OfBorg done in https://git.lix.systems/the-distro/infra/pulls/162. Next is PostgreSQL for Hydra. Terraform S3 requires a privileged sort of API to emit scoped keys which we do not have right now. With Ceph RGW, that's very feasible.
raito commented 2025-01-04 14:31:15 +00:00 (Migrated from git.lix.systems)
Copy link

Monitoring done in a1f2c9209f and 72e2c8f93b ; thanks to @k900 !

Monitoring done in https://git.lix.systems/the-distro/infra/commit/a1f2c9209f73101276868770c595ae8a926189e3 and https://git.lix.systems/the-distro/infra/commit/72e2c8f93b06cba51c34d40a4c3d549e9895f750 ; thanks to @k900 !
raito commented 2025-05-01 16:23:14 +00:00 (Migrated from git.lix.systems)
Copy link

Daily operations roles done in 85c71e7bd0. Now we need developer experience to connect via SSO and stuff and some testing.

I will set the S3 access key secret now and write a proper shell for operators.

Daily operations roles done in 85c71e7bd04221e4fc9060819817bb9816fa677d. Now we need developer experience to connect via SSO and stuff and some testing. I will set the S3 access key secret now and write a proper shell for operators.
raito commented 2025-05-01 17:09:15 +00:00 (Migrated from git.lix.systems)
Copy link

Terraform S3 fixed in #205.

Terraform S3 fixed in #205.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
staging
docs-afnix-fr
broker-flows
goaccess
alerting-to-zulip
better-backup-monitoring
forgejo-runners-sprinkles
abm
afnix-social-logins
hyp01
benchmarks
afnix-oidc
voidlinux-tenant
x86_builder_v6_only
besadii-release-branches
tom-hubrecht/audit
repair-ofborg
i-wish-i-had-jj-and-gerrit
scheduled-builds
gerrit-hydra
single-node-ceph
storage-project
cache-lix
email-groups
format
No results found.
Labels
Clear labels   
Compat/Breaking

Breaking change that won't be backward compatible

  
Difficulty/Architectural

Requires changes in multiple pieces of the stack: the Nix interpreter, etc.

  
Difficulty/Easy

Infrastructure beginner friendly tasks

  
Difficulty/Hard

Requires prior knowledge, research and design

  
Help Wanted

Looking for a first task to pick? This one is looking for somefew to do it as well!

  
Kind/Bug

Something is not working

  
Kind/Documentation

Documentation changes

  
Kind/Enhancement

Improve existing functionality

  
Kind/Feature

New functionality

  
Kind/Testing

Issue or pull request related to testing

  
Priority/Critical

The priority is critical

  
Priority/High

The priority is high

  
Priority/Low

The priority is low

  
Priority/Medium

The priority is medium

  
Reviewed/Confirmed

Issue has been confirmed

  
Reviewed/Duplicate

This issue or pull request already exists

  
Reviewed/Invalid

Invalid issue

  
Reviewed/Won't Fix

This issue won't be fixed

  
Security

This is a security issue

  
Silenced Alert

This issue was created to track a silenced alert which needs remediation work.

  
Status/Abandoned

Somebody has started to work on this but abandoned work

  
Status/Blocked

Something is blocking this issue or pull request

  
Status/Need More Info

Feedback is required to reproduce issue or to continue work

  
Status/Postponed

We can do this later

  
Tracking Issue

Umbrella issue of many things at the same time

No labels
Compat/Breaking
Difficulty/Architectural
Difficulty/Easy
Difficulty/Hard
Help Wanted
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Testing
Priority/Critical
Priority/High
Priority/Low
Priority/Medium
Reviewed/Confirmed
Reviewed/Duplicate
Reviewed/Invalid
Reviewed/Won't Fix
Security
Silenced Alert
Status/Abandoned
Status/Blocked
Status/Need More Info
Status/Postponed
Tracking Issue
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: afnix/infra#156
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?