⚠️ Repo Archive Notice

As of Nov 13, 2020, charts in this repo will no longer be updated. For more information, see the Helm Charts Deprecation and Archive Notice, and Update.

Vault Helm Chart

This directory contains a Kubernetes chart to deploy a Vault server.

DEPRECATION NOTICE

This chart is deprecated and no longer supported.

Prerequisites Details

• Kubernetes 1.6+

Chart Details

This chart will do the following:

• Implement a Vault deployment
• Optionally, deploy a consul agent in the pod

Please note that a backend service for Vault (for example, Consul) must be deployed beforehand and configured with the vault.config option. YAML provided under this option will be converted to JSON for the final Vault config.json file.

See https://www.vaultproject.io/docs/configuration/ for more information.

Installing the Chart

To install the chart, use the following, this backs Vault with a Consul cluster:

$ helm repo add incubator http://storage.googleapis.com/kubernetes-charts-incubator
$ helm install incubator/vault --set vault.dev=false --set vault.config.storage.consul.address="myconsul-svc-name:8500",vault.config.storage.consul.path="vault"

An alternative example using the Amazon S3 backend can be specified using:

vault:
  config:
    storage:
      s3:
        access_key: "AWS-ACCESS-KEY"
        secret_key: "AWS-SECRET-KEY"
        bucket: "AWS-BUCKET"
        region: "eu-central-1"

Configuration

The following table lists the configurable parameters of the Vault chart and their default values.

Specify each parameter using the --set key=value[,key=value] argument to helm install.

Optional Consul Agent

If you are using the consul storage for vault, you might want a local consul agent to handle health checks. By setting consulAgent.join to your consul server, an agent will be started in the vault pod. In this case, you should configure vault to connect to consul over localhost. For example:

vault:
  dev: False
  config:
    storage:
      consul:
        address: "localhost:8500"
consulAgent:
  join: consul.service.consul

If you are using the stable/consul helm chart, consul communications are encrypted with a gossip key. You can configure a secret with the same format as that chart and specify it in the consulAgent.gossipKeySecretName parameter.

Optional Vault Exporter

If you want to monitor Vault with Prometheus you can simply enable the Vault exporter which then runs as a sidecar container within the same pod as Vault itself. To use the exporter just set vaultExporter.enabled to true and set the other variables according to your needs.

If your Vault is set up with TLS make sure to specify the CA certificate path properly. This is done through the parameter vaultExporter.tlsCAFile.

If you want to use the exporter with the Prometheus Operator you can simply enable the ServiceMonitor with an extraLabel corresponding to your Prometheus scraper label selector. For example:

serviceMonitor:
  enabled: true
  additionalLabels:
    prometheus-scraper: "default"
  interval: 10s
  jobLabel: "vault-exporter"

If you do not want to use the default vaultExporter container, but use your own, you can declare it in the vault.extraContainer part. But you have to expose a named port for the metrics and set this name in the serviceMonitor.podPortName. For exmaple:

vaultExporter:
  enabled: false

serviceMonitor:
  enabled: true
  additionalLabels:
    prometheus-scraper: "default"
  podPortName: "metricPort"

vault:
  extraContainer:
  - name: my-vault-exporter
    image: my-vault-exporter:latest
    ports:
    - containerPort: 8080
      name: metricPort

If you want to add Prometheus alerting rules you can simply enable the alerts and disabling/enabling the defaults rules you want to use. You can add as many custom rules as you want. For example:

  prometheusRules:
    enabled: true
    defaultRules:
      vaultUp: true
      vaultUninitialized: true
      vaultSealed: true
      vaultStandby: false
    extraRules:
    - alert: VaultHTTPErrorRateIsHigh
      annotations:
        description: The ingress is failing more than %15 of the requests for 5m
      expr: sum(rate(nginx_ingress_controller_requests{ingress="vault",status!~"[4-5].*"}[2m])) by (ingress) / sum(rate(nginx_ingress_controller_requests{ingress="vault"}[2m])) by (ingress) < 0.85
      for: 5m
      labels:
        severity: critical

Using Vault

Once the Vault pod is ready, it can be accessed using a kubectl port-forward:

$ kubectl port-forward vault-pod 8200
$ export VAULT_ADDR=http://127.0.0.1:8200
$ vault status

Migrating Custom Secrets

Previous versions of this chart had a configuration option vault.customSecrets. Custom secrets should now be expressed with vault.extraVolumeMounts. For example:

vault:
  customSecrets:
    - secretName: vault-tls
      mountPath: /vault/tls

Would be expressed as:

vault:
  extraVolumes:
    - name: vault-tls
      secret:
        secretName: vault-tls
  extraVolumeMounts:
    - name: vault-tls
      mountPath: /vault/tls
      readOnly: true