Skip to main content
Version: 2.9.0

Step 3 - Create Vault Secrets, Dynamic Groups and IAM Policies

3.1 - Create Dynamic Group and IAM Policy​

The Dynamic Group and IAM Policy together will grant permissions to the OKE cluster nodes to sync the vault secret to kubernetes.

  • Replace <dynamic-group-name> and <iam-policy-name> with an appropriate value for each.
oci iam dynamic-group create --name "<dynamic-group-name>" \
--description "Dynamic Group for OKE cluster nodes" \
--matching-rule "instance.compartment.id='${compartment_ocid}'"

oci iam policy create -c ${compartment_ocid} --name '<iam-policy-name>' \
--description "Oracle vault secrets access for OKE" \
--statements "[\"Allow dynamic-group <dynamic-group-name> to read secret-family in compartment <oracle-compartment-name> where target.vault.id='${vault_ocid}'\"]"

Step 3.2 - Add the MongoDB passwords to Vault Secret​

To enable the CDR Platform Policy API to create and manage the policies in MongoDB, and Async API to create and manage the requests, MongoDB needs to be deployed using helm charts. Two users will be created by the mongodb helm chart and the corresponding user's password needs to be set in the Vault Secret, e.g:

  • Sensitive data, such as MongoDB connection string should be stored as key-value pairs in JSON format in the Vault Secret.
  • When passwords from multiple steps needs to be setup, create a single json with all passwords included Or update the existing json with new passwords.
{
    "mongodb-cdrp-password": "",
    "mongodb-admin-password": ""
}

Step 3.3 Reversing Labs credentials​

To integrate the Halo with Reversing Labs, add the credentials of the Reversing Labs to the KeyVault.

{
    "reversinglabs_username": "",
    "reversinglabs_password": ""
}

ICAP MTLS certificates (Optional)​

ICAP servers can be configured for mutual client authentication using the MTLS certificates. The certificates will be mounted to the ICAP server pods using the Kubernetes secrets. Add the server certificates and certificate authority to the Oracle Vault so that they can be synced to Kubernetes secrets.

{ 
    "tls-server-cert": "<content of mtls-server-cert.pem>",
    "tls-server-key": "<content of mtls-server-key.pem>",
    "tls-cafile": "<content of mtls-ca-cert.pem>"
}