Introduction
In this article, we are going to cover the Hashicorp Vault Installation on Kubernetes. Hashicorp Vault has become one of the industry standards when we talk about managing secrets and sensitive data in production environments, and this covers cloud and non-cloud-native deployments. But especially in Kubernetes, this is a critical component. We have already commented that the Kubernetes Secrets are not very secured by default, so HashiCorp Vault solves that problem.
Installation Methods
Hashicorp Vault provides many different installation methods that you can read about on their official page here; most still focus on a traditional environment. But in summary, these are the ones you have available:
- Install from Package Manager
- Install from pre-existing binary
- Install it from the source
- Helm for Kubernetes
As you can imagine, the path we will follow here is the Helm way. I guess you are already familiar with help, but if not, take a look here, and if you are also in the process of creating helm charts, this other one can also help you.
Helm Chart for Hashicorp Vault
For the sake of this article, we are going to what is called a standalone hashicorp vault installation, so we are not going to create in this post an architecture with High-Availability (HA) that is production-ready but something that can help you to start playing with the tool and see how this tool can be integrated with other ones that belong to the same cloud-native environment. To get more information about deploying Hashicorp Vault into a production-ready setup, please look at the following link.
We first need to install the helm chart in our local environment, but we need to be very careful about the helm version we have. When writing this article, Hashicorp Vault Installation requires a 3.7+ Helm Version, so you must first check the version you have installed.
In case you’re running on an older version, you will get the following error:
Error: parse error at (vault/templates/_helpers.tpl:38): unclosed action
You can get more details on this GitHub issue.
At the time of writing this article, the latest version of Helm is 3.9, but this version generates an issue with AWS EKS with this error:
Error: Kubernetes cluster unreachable: exec plugin: invalid apiVersion "client.authentication.k8s.io/v1alpha1."
Failed installing **** with helm
You can get more details on this GitHub issue.
So, in that case, the best way to ensure there will not be a problem with the Hashicorp Vault Installation is to downgrade to 3.8, and you will be able to deploy the helm chart without any issue.
Hashicorp Vault Installation Process
To proceed with the Hashicorp Vault Installation, we need to run the following commands:
helm repo add hashicorp https://helm.releases.hashicorp.com
helm install vault hashicorp/vault
This will install two different components a single vault server as part of a StatefulSet and a vault-agent-injector to manage the injection of vault configuration on the various components and deployments on the other namespaces.
To get the pods running, we need to initialize and unseal the vault before being ready to use. To do that, we need to enter inside the vault-server pod and execute the following commands:
vault operator init
This will generate several essential things:
- It will generate the keys to be able to unseal the vault to be able to start using it. It will prompt a different number of keys, in our sample 5, and you will need at least 3 of them to be able to unseal the vault as
- It will also generate a root token to be able to log into the CLI and interactor with the server to be able to read and write secrets
After that, we will need to run the following command at least three times, providing each of them with a different unseal key:
Vault operator unseal
After that point, all components are Running and Ready and we can conclude our Hashicorp Vault Installation and start interacting with the vault to create your secrets.
