3ng1n33r

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: bluegreen-demo
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$1
spec:
  rules:
  - host: bluegreen-demo.lvh.me
    http:

3ng1n33r

apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: bluegreen-demo
  labels:
    app: bluegreen-demo
spec:
  replicas: 3
  revisionHistoryLimit: 1
  selector:

3ng1n33r

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: canary-demo
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$1
spec:
  rules:
  - host: canary-demo.lvh.me
    http:

3ng1n33r

apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: canary-demo
spec:
  replicas: 5
  revisionHistoryLimit: 1
  selector:
    matchLabels:
      app: canary-demo

3ng1n33r

stages:
  - vault

read_secrets:
  stage: vault
  image: hashicorp/vault:1.14
  variables:
    VAULT_ADDR: https://vault.default.svc.cluster.local:8200
    VAULT_SKIP_VERIFY: 'true'
    VAULT_AUTH_ROLE: myproject-production

3ng1n33r

vault write auth/jwt/config \
  oidc_discovery_url="https://gitlab.com" \
  bound_issuer="https://gitlab.com"

3ng1n33r

vault write auth/jwt/role/myproject-staging - <<EOF
{
  "role_type": "jwt",
  "policies": ["myproject-staging"],
  "token_explicit_max_ttl": 60,
  "user_claim": "user_email",
  "bound_claims": {
    "project_id": "51459829",
    "ref": "staging*",
    "ref_type": "branch"

3ng1n33r

vault policy write myproject-staging - <<EOF
# Policy name: myproject-staging
#
# Read-only permission on 'secret/myproject/staging/*' path
path "secret/data/myproject/staging/*" {
  capabilities = [ "read" ]
}
EOF
  
  

3ng1n33r

apiVersion: v1
kind: ServiceAccount
metadata:
  name: gitlab-user
  namespace: gitlab-runner
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: gitlab-user

3ng1n33r

apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello-secrets
spec:
  replicas: 1
  selector:
    matchLabels:
      app: hello-secrets
  template: