<commit_before># Set up Vault-UI on Tectonic

[Vault-UI](https://github.com/djenriquez/vault-ui) is an open source project for managing and interacting with Vault through a web UI. Vault itself does not provide a web UI. All interactions are done using either the Vault CLI or REST API calls.

### Prerequisites

- Set up an initialized and unsealed Vault cluster. Use the [create-cluster][create-cluster] script for a quick setup.
- Install and initialize Helm using the [Helm installation instructions][helm-install]

This example assumes a Vault cluster named `example-vault` in the namespace `vault-services`.

## Install Vault-UI

To install Vault-UI, install and configure the Helm chart provided in the Vault-UI repo.

Clone Vault-UI repository:
```sh
git clone https://github.com/djenriquez/vault-ui
```

Modify the file `vault-ui/kubernetes/chart/vault-ui/templates/deployment.yaml` to add the `NODE_TLS_REJECT_UNAUTHORIZED` environment variable to allow self-signed HTTPS certificates.

```sh
        env:
            - name: VAULT_URL_DEFAULT
              value: {{ .Values.vault.url }}
            - name: VAULT_AUTH_DEFAULT
              value: {{ .Values.vault.auth }}
            - name: NODE_TLS_REJECT_UNAUTHORIZED
              value: '0'

```

Next modify the file `vault-ui/kubernetes/chart/vault-ui/values.yaml` to configure the way to access the Vault-UI using Ingress, ClusterIP, LoadBalancer, or other access means.

**Configuration for Ingress:**

The following example will set up Vault-UI to be accessible at the Ingress host `vault-ui.ingress.staging.core-os.net` in the namespace `vault-services`. Change the Ingress hostname and namespace as needed.

To use Ingress first manually create a TLS certificate that will be used to set up the Ingress resource for Vault-UI, as described in the [Vault TLS setup guide][ingress-tls]:

```sh
KUBE_NS=vault-services \
SERVER_SECRET=vault-ui-server-ingress-tls \
CLIENT_SECRET=vault-ui-client-ingress-tls \
SAN_HOSTS="vault-ui.ingress.staging.core-os.net" \
SERVER_CERT=tls.crt \
SERVER_KEY=tls.key \
hack/tls-gen.sh
```

Use the secrets listed above to modify the `vaules.yaml` file:

```yaml
replicaCount: 1
image:
  repository: djenriquez/vault-ui
  tag: latest
  pullPolicy: IfNotPresent
service:
  name: vault-ui
  type: ClusterIP
  externalPort: 8000
  internalPort: 8000
ingress:
  enabled: true
  hosts:
    - vault-ui.ingress.staging.core-os.net
  annotations:
    kubernetes.io/ingress.class: tectonic
    ingress.kubernetes.io/force-ssl-redirect: "true"
  tls:
    - secretName: vault-ui-server-ingress-tls
      hosts:
        - vault-ui.ingress.staging.core-os.net
resources: {}
vault:
  auth: TOKEN
  url: https://example-vault:8200
```

Use Helm to install Vault-UI within the `vault-services` namespace:

```sh
$ cd vault-ui/kubernetes/chart/vault-ui
$ helm install . --namespace=vault-services
```

## Accessing Vault-UI

After running Helm install it will give you notes on how to access Vault-UI via port-forwarding. If you are unable to access Vault-UI via Ingress you might want to try accessing it via port-forwarding to isolate the issue.

With the Ingress configuration Vault-UI should be accessible at the Ingress host `vault-ui.ingress.staging.core-os.net`. Make sure to set up the DNS record for the Ingress host to make it accessible as described in the [Ingress setup guide][ingress-dns].


[create-cluster]: ../../hack/helper/create-cluster.sh
[helm-install]: https://github.com/kubernetes/helm/blob/master/docs/install.md
[ingress-tls]: ./ingress.md#generate-custom-tls-assets-for-the-ingress-host
[ingress-dns]: ./ingress.md#create-dns-record-for-the-ingress-host<commit_msg>docs: editorial pass on vault-ui.md<commit_after># Set up Vault-UI on Tectonic

[Vault-UI][vault-ui] is an open source project for managing and interacting with Vault through a web UI. Vault itself does not provide a web UI; all interactions are through either the Vault CLI or REST API calls.

### Prerequisites

* Set up an initialized and unsealed Vault cluster. Use the [create-cluster][create-cluster] script for a quick setup.
* Install and initialize Helm using the [Helm installation instructions][helm-install]

This example assumes a Vault cluster named `example-vault` in the namespace `vault-services`.

## Install Vault-UI

To install Vault-UI, install and configure the Helm chart provided in the Vault-UI repo.

Clone the Vault-UI repository:

```sh
git clone https://github.com/djenriquez/vault-ui
```

Modify the file `vault-ui/kubernetes/chart/vault-ui/templates/deployment.yaml` to add the `NODE_TLS_REJECT_UNAUTHORIZED` environment variable to allow self-signed HTTPS certificates.

```sh
        env:
            - name: VAULT_URL_DEFAULT
              value: {{ .Values.vault.url }}
            - name: VAULT_AUTH_DEFAULT
              value: {{ .Values.vault.auth }}
            - name: NODE_TLS_REJECT_UNAUTHORIZED
              value: '0'
```

Next modify the file `vault-ui/kubernetes/chart/vault-ui/values.yaml` to configure the way to access the Vault-UI using Ingress, ClusterIP, LoadBalancer, or other access means.

**Configuration for Ingress:**

The following example will set up Vault-UI to be accessible at the Ingress host `vault-ui.ingress.staging.core-os.net` in the namespace `vault-services`. Change the Ingress hostname and namespace as needed.

To use Ingress, first manually create a TLS certificate that will be used to set up the Ingress resource for Vault-UI, as described in the [Vault TLS setup guide][ingress-tls]:

```sh
KUBE_NS=vault-services \
SERVER_SECRET=vault-ui-server-ingress-tls \
CLIENT_SECRET=vault-ui-client-ingress-tls \
SAN_HOSTS="vault-ui.ingress.staging.core-os.net" \
SERVER_CERT=tls.crt \
SERVER_KEY=tls.key \
hack/tls-gen.sh
```

Use the secrets listed above to modify the `values.yaml` file:

```yaml
replicaCount: 1
image:
  repository: djenriquez/vault-ui
  tag: latest
  pullPolicy: IfNotPresent
service:
  name: vault-ui
  type: ClusterIP
  externalPort: 8000
  internalPort: 8000
ingress:
  enabled: true
  hosts:
    - vault-ui.ingress.staging.core-os.net
  annotations:
    kubernetes.io/ingress.class: tectonic
    ingress.kubernetes.io/force-ssl-redirect: "true"
  tls:
    - secretName: vault-ui-server-ingress-tls
      hosts:
        - vault-ui.ingress.staging.core-os.net
resources: {}
vault:
  auth: TOKEN
  url: https://example-vault:8200
```

Use Helm to install Vault-UI within the `vault-services` namespace:

```sh
$ cd vault-ui/kubernetes/chart/vault-ui
$ helm install . --namespace=vault-services
```

## Accessing Vault-UI

When complete, the Helm installation will provide notes on how to access Vault-UI using port forwarding.

With the Ingress configuration, Vault-UI should be accessible at the Ingress host `vault-ui.ingress.staging.core-os.net`. Make sure to set up the DNS record for the Ingress host to make it accessible as described in the [Ingress guide][ingress-dns]. If you are unable to access Vault-UI via Ingress, try accessing it via port forwarding to isolate the issue.


[create-cluster]: ../../hack/helper/create-cluster.sh
[helm-install]: https://github.com/kubernetes/helm/blob/master/docs/install.md
[ingress-tls]: ingress.md#generate-custom-tls-assets-for-the-ingress-host
[ingress-dns]: ingress.md#create-dns-record-for-the-ingress-host
[vault-ui]: https://github.com/djenriquez/vault-ui
{'fraction_non_alphanumeric': 0.10158472165786266, 'fraction_numerical': 0.0037924962752268723, 'mean_word_length': 3.8135593220338984, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 8, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '193274', 'n_tokens_mistral': 2420, 'n_tokens_neox': 2335, 'n_words': 741}