Install Vault with DevStream

InstanceID Prefix

The instanceID prefix must be vault, the minimum tools configuration example:

YAML

  1. tools:
  2. - name: helm-installer
  3.   instanceID: vault

Default Configs

keydefault valuedescription
chart.chartPath“”local chart path
chart.chartNamehashicorp/vaultchart name
chart.version“”chart version
chart.timeout5mthis config will wait 5 minutes to deploy
chart.releaseNamevaulthelm release name
chart.upgradeCRDstruedefault update CRD config
chart.waittruewhether to wait until installation is complete
chart.namespacevaultnamespace where helm to deploy
repo.urlhttps://helm.releases.hashicorp.comhelm official repo address
repo.namehashicorphelm repo name

Initialize all the Vault pods

After installing the Vault on k8s, you can initialize all pods of the Vault on k8s. To know more about the Vault, you can refer to:

At first, you must install jq tool: jq is a lightweight and flexible command-line JSON processor. Download jq

In the command below, the variable $NAMESPACE you should replace with “hashicorp” if you do not modify the namespace variable. Otherwise, use the namespace name you replaced.

  1. Initialize vault-0

    Bash

    1. # Initialize vault-0 with one key share and one key threshold.
    2. kubectl exec vault-0 -n $NAMESPACE -- vault operator init -key-shares=1 -key-threshold=1 -format=json > cluster-keys.json

  2. Display the unseal key

    Bash

    1. # Display the unseal key found in cluster-keys.json
    2. cat cluster-keys.json | jq -r ".unseal_keys_b64[]"

  3. Create a variable to capture the Vault unseal key

    Bash

    1. # Create a variable named VAULT_UNSEAL_KEY to capture the Vault unseal key.
    2. VAULT_UNSEAL_KEY=$(cat cluster-keys.json | jq -r ".unseal_keys_b64[]")

  4. Unseal vault-0

    Bash

    1. # Unseal vault-0 running on the vault-0 pod.
    2. kubectl exec vault-0  -n $NAMESPACE -- vault operator unseal $VAULT_UNSEAL_KEY

    You will see the above command’s output like this. Make sure the value of Initialized is ‘true’ and the value of Sealed is ‘false’.

    Bash

    1. Key                     Value
    2. ---                     -----
    3. Seal Type               shamir
    4. Initialized             true
    5. Sealed                  false
    6. Total Shares            1
    7. Threshold               1
    8. Version                 1.9.2
    9. Storage Type            raft
    10. Cluster Name            vault-cluster-14052440
    11. Cluster ID              7630cd33-2ee1-39c1-db3f-e48a6d79970a
    12. HA Enabled              true
    13. HA Cluster              https://vault-0.vault-internal:8201
    14. HA Mode                 active
    15. Active Since            2022-04-23T16:45:47.6060163Z
    16. Raft Committed Index    30
    17. Raft Applied Index      30

  5. Initialize vault-1 and vault-2 like vault-0

Bash

  1. # Initialize vault-1
  2. kubectl exec vault-1 -n $NAMESPACE -- vault operator init -key-shares=1 -key-threshold=1 -format=json > cluster-keys.json
  3. VAULT_UNSEAL_KEY=$(cat cluster-keys.json | jq -r ".unseal_keys_b64[]")
  4. kubectl exec vault-1  -n $NAMESPACE -- vault operator unseal $VAULT_UNSEAL_KEY
  5. # Initialize vault-2
  6. kubectl exec vault-1 -n $NAMESPACE -- vault operator init -key-shares=1 -key-threshold=1 -format=json > cluster-keys.json
  7. VAULT_UNSEAL_KEY=$(cat cluster-keys.json | jq -r ".unseal_keys_b64[]")
  8. kubectl exec vault-1  -n $NAMESPACE -- vault operator unseal $VAULT_UNSEAL_KEY

  1. Verify all the pods status

    Bash

    1. # Verify all the Vault pods are running and ready.
    2. kubectl get pods -n $NAMESPACE

You will see the above command’s outputs like this below. Make sure all the pods are running and ready.

Bash

  1. NAME                                 READY   STATUS    RESTARTS   AGE
  2. vault-0                              1/1     Running   0          2m29s
  3. vault-1                              1/1     Running   0          2m29s
  4. vault-2                              1/1     Running   0          2m29s
  5. vault-agent-injector-68dc986-bnsj2   1/1     Running   0          2m28s
  1. After the above operations, you want to use the Vault to write/read secrets. You need to follow the documentation of the hashicorp Vault:
  2. Set a secret in Vault
  3. Your First Secret