Install aapm-service

aapm service provides direct secret lookup via http requests parameters aapm service parameters parameter meaning agent service the agent's in cluster dns address (\<agent service> \<namespace> svc cluster local) agent port the agent's grpc port pam url the fallback (direct to kron pam) address used if the grpc connection fails must be valid/reachable agent ignorecertificate must be true if the agent's own grpc server uses a self signed certificate interceptor ignorecertificate false is sufficient if kron pam has a publicly trusted certificate vault allowedaccounts\[] accountname the kron pam account name allowed to be accessed via the /vault endpoint (whitelist) vault allowedaccounts\[] accountpath the path of the allowed account within kron pam if agent ignorecertificate=false is left as is, the service starts but /vault requests fail with pkix path building failed (the agent's self signed certificate cannot be validated) this value must be true helm install aapm service kron pam/aapm service \\ \ namespace kron pam aapm \\ \ create namespace \\ \ set agent service="kron aapm agent ns agent svc cluster local" \\ \ set agent port="8080" \\ \ set pam url="https //\<kron pam server address>" \\ \ set agent ignorecertificate=true \\ \ set interceptor ignorecertificate=false \\ \ set "vault allowedaccounts\[0] accountname=\<account name>" \\ \ set "vault allowedaccounts\[0] accountpath=\<account path>" verification kubectl get pods n kron pam aapm kubectl logs n kron pam aapm deploy/aapm service tail=40 success criteria pod is 1/1 running, logs show tomcat started on port 8443 (http) and started aapmapplication in n seconds