From b86592ad94ae4d41765e7b94c5c140de1db231c2 Mon Sep 17 00:00:00 2001 From: Shelley Shen Date: Wed, 22 Jul 2026 23:31:38 -0700 Subject: [PATCH] feat(migrations): add OpenBao migration for event-ledger Adds 22_setup_event-ledger.sh with: - KV2 secrets engine at services/event-ledger/kv for Cassandra credentials - JWT secrets engine at services/event-ledger/jwt (issuer: http://event-ledger.nvcf.svc.cluster.local) - JWT signing roles for sis-api and nvca, merged into their existing auth roles - JWT auth role for the event-ledger service account (namespace: nvcf) Updates 07_setup_api-keys.sh: - Adds event-ledger to the registrations/services KV array (service ID: nvidia-cloud-events-ncp-service-id-ckozoh6f) - Switches the write to overwrite=true so re-runs on existing clusters pick up new entries --- .../openbao/migrations/07_setup_api-keys.sh | 7 +- .../migrations/22_setup_event-ledger.sh | 106 ++++++++++++++++++ 2 files changed, 111 insertions(+), 2 deletions(-) create mode 100644 migrations/openbao/migrations/22_setup_event-ledger.sh diff --git a/migrations/openbao/migrations/07_setup_api-keys.sh b/migrations/openbao/migrations/07_setup_api-keys.sh index f4cd0f898..52baa33c9 100644 --- a/migrations/openbao/migrations/07_setup_api-keys.sh +++ b/migrations/openbao/migrations/07_setup_api-keys.sh @@ -35,6 +35,8 @@ SERVICE_ACCOUNT_NAME="api-keys-api" # and the NVCT_SERVICE_ID env var consumed by NAK and NVCT. NVCT_SERVICE_ID="nvidia-cloud-tasks-ncp-service-id-nvcttasks" +EVENT_LEDGER_SERVICE_ID="nvidia-cloud-events-ncp-service-id-ckozoh6f" + #------------------------------------------- # Set defaults for secret paths and policies #------------------------------------------- @@ -85,6 +87,7 @@ write_secrets_kv "${VAULT_SECRET_BASE_PATH}/kv" "keys/data-domain-key" "key=$DAT SVC_VALUE=$(base64_encode '[ {"serviceId":"nvidia-cloud-functions-ncp-service-id-aketm","serviceName":"nvcf-api","audienceServiceIds":["nvidia-cloud-functions-ncp-service-id-aketm"],"maxApiKeysPerUser":8,"maxApiKeyTtlDays":365,"maxAuthzSizeChars":2048,"minAuthzUpdateIntervalSeconds":3}, - {"serviceId":"'"${NVCT_SERVICE_ID}"'","serviceName":"nvct-api","audienceServiceIds":["'"${NVCT_SERVICE_ID}"'"],"maxApiKeysPerUser":8,"maxApiKeyTtlDays":365,"maxAuthzSizeChars":2048,"minAuthzUpdateIntervalSeconds":3} + {"serviceId":"'"${NVCT_SERVICE_ID}"'","serviceName":"nvct-api","audienceServiceIds":["'"${NVCT_SERVICE_ID}"'"],"maxApiKeysPerUser":8,"maxApiKeyTtlDays":365,"maxAuthzSizeChars":2048,"minAuthzUpdateIntervalSeconds":3}, + {"serviceId":"'"${EVENT_LEDGER_SERVICE_ID}"'","serviceName":"event-ledger","audienceServiceIds":["'"${EVENT_LEDGER_SERVICE_ID}"'"],"maxApiKeysPerUser":8,"maxApiKeyTtlDays":365,"maxAuthzSizeChars":2048,"minAuthzUpdateIntervalSeconds":3} ]') -write_secrets_kv "${VAULT_SECRET_BASE_PATH}/kv" "registrations/services" "services=$SVC_VALUE" +write_secrets_kv "${VAULT_SECRET_BASE_PATH}/kv" "registrations/services" "services=$SVC_VALUE" true diff --git a/migrations/openbao/migrations/22_setup_event-ledger.sh b/migrations/openbao/migrations/22_setup_event-ledger.sh new file mode 100644 index 000000000..be3d49d8f --- /dev/null +++ b/migrations/openbao/migrations/22_setup_event-ledger.sh @@ -0,0 +1,106 @@ +#!/bin/bash +# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + + +set -euo pipefail + +curr_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" +if [ ! -f "${curr_dir}/utils/utils.sh" ]; then + echo "Error: log.sh not found in ${curr_dir}/utils/utils.sh" + return 1 +else + source "${curr_dir}/utils/utils.sh" + source "${curr_dir}/utils/functions.sh" +fi + +SERVICE_ACCOUNT_NAMESPACE="nvcf" +SERVICE_ACCOUNT_NAME="event-ledger" + +#------------------------------------------- +# Set defaults for secret paths and policies +#------------------------------------------- +VAULT_SECRET_BASE_PATH="services/${SERVICE_ACCOUNT_NAME}" +VAULT_POLICY_BASE_PATH="services-${SERVICE_ACCOUNT_NAME}" +VAULT_JWT_AUTH_ROLE_POLICIES="services-all-kv-ro" + +#------------------------------------------- +# Create KV2 secrets engine +#------------------------------------------- +enable_secrets_mount "${VAULT_SECRET_BASE_PATH}/kv" "kv-v2" + +write_secrets_kv "${VAULT_SECRET_BASE_PATH}/kv" "cassandra/creds" "username=event_ledger_app_v0 password=${DEFAULT_CASSANDRA_PASSWORD}" + +#------------------------------------------- +# Create policy for KV access +#------------------------------------------- +policy=$(generate_acl_policy "${VAULT_SECRET_BASE_PATH}/kv/*" "read,list") +write_policy "${VAULT_POLICY_BASE_PATH}-kv-ro" "${policy}" + +# append policy to auth role list +VAULT_JWT_AUTH_ROLE_POLICIES="${VAULT_JWT_AUTH_ROLE_POLICIES},${VAULT_POLICY_BASE_PATH}-kv-ro" + +#-------------------------- +# Create JWT Secret Engine +#-------------------------- +enable_secrets_mount "${VAULT_SECRET_BASE_PATH}/jwt" "vault-plugin-secrets-jwt" + +jwt_secret_mount_config=$(generate_jwt_secret_mount_config) +config_jwt_secret_mount_config "${VAULT_SECRET_BASE_PATH}/jwt" "${jwt_secret_mount_config}" + +#------------------------------------------- +# Add SIS as a caller via JWT Secret Role +# Issuer: http://event-ledger.nvcf.svc.cluster.local +#------------------------------------------- + +SIS_SERVICE_ACCOUNT_NAMESPACE="sis" +SIS_SERVICE_ACCOUNT_NAME="sis-api" +SCOPES="fnds:createEvent,fnds:archiveEvents" + +jwt_secret_role=$(generate_jwt_secret_role "${SERVICE_ACCOUNT_NAMESPACE}" "${SERVICE_ACCOUNT_NAME}" "${SIS_SERVICE_ACCOUNT_NAME}" "${SCOPES}") +create_secret_jwt_role "${VAULT_SECRET_BASE_PATH}/jwt" "${SIS_SERVICE_ACCOUNT_NAME}" "${jwt_secret_role}" + +policy=$(generate_acl_policy "${VAULT_SECRET_BASE_PATH}/jwt/sign/${SIS_SERVICE_ACCOUNT_NAME}" "create,update,read") +policy_name="${VAULT_POLICY_BASE_PATH}-jwt-sign-${SIS_SERVICE_ACCOUNT_NAME}-rw" +write_policy "${policy_name}" "${policy}" + +sis_merged_policies=$(merge_jwt_role_policies "${SIS_SERVICE_ACCOUNT_NAME}" "${policy_name}") +sis_jwt_auth_role=$(generate_jwt_auth_role "${SIS_SERVICE_ACCOUNT_NAME}" "${SIS_SERVICE_ACCOUNT_NAMESPACE}" "${sis_merged_policies}") +create_auth_jwt_role "${SIS_SERVICE_ACCOUNT_NAME}" "${sis_jwt_auth_role}" + +#------------------------------------------- +# Add NVCA as a caller via JWT Secret Role +# Issuer: http://event-ledger.nvcf.svc.cluster.local +#------------------------------------------- + +NVCA_SERVICE_ACCOUNT_NAMESPACE="nvca-system" +NVCA_SERVICE_ACCOUNT_NAME="nvca" + +jwt_secret_role=$(generate_jwt_secret_role "${SERVICE_ACCOUNT_NAMESPACE}" "${SERVICE_ACCOUNT_NAME}" "${NVCA_SERVICE_ACCOUNT_NAME}" "${SCOPES}") +create_secret_jwt_role "${VAULT_SECRET_BASE_PATH}/jwt" "${NVCA_SERVICE_ACCOUNT_NAME}" "${jwt_secret_role}" + +policy=$(generate_acl_policy "${VAULT_SECRET_BASE_PATH}/jwt/sign/${NVCA_SERVICE_ACCOUNT_NAME}" "create,update,read") +policy_name="${VAULT_POLICY_BASE_PATH}-jwt-sign-${NVCA_SERVICE_ACCOUNT_NAME}-rw" +write_policy "${policy_name}" "${policy}" + +nvca_merged_policies=$(merge_jwt_role_policies "${NVCA_SERVICE_ACCOUNT_NAME}" "${policy_name}") +nvca_jwt_auth_role=$(generate_jwt_auth_role "${NVCA_SERVICE_ACCOUNT_NAME}" "${NVCA_SERVICE_ACCOUNT_NAMESPACE}" "${nvca_merged_policies}") +create_auth_jwt_role "${NVCA_SERVICE_ACCOUNT_NAME}" "${nvca_jwt_auth_role}" + +#------------------------------------------- +# Provision JWT Auth Role with policies +#------------------------------------------- +jwt_auth_role=$(generate_jwt_auth_role "${SERVICE_ACCOUNT_NAME}" "${SERVICE_ACCOUNT_NAMESPACE}" "${VAULT_JWT_AUTH_ROLE_POLICIES}") +create_auth_jwt_role "${SERVICE_ACCOUNT_NAME}" "${jwt_auth_role}"