$ helm repo add hashicorp https://helm.releases.hashicorp.com "hashicorp" has been added to your repositories $ helm search repo hashicorp/vault NAME CHART VERSION APP VERSION DESCRIPTION hashicorp/vault 0.24.0 1.13.1 Official HashiCorp Vault Chart $ helm search repo hashicorp/vault -l NAME CHART VERSION APP VERSION DESCRIPTION hashicorp/vault 0.25.0 1.14.0 Official HashiCorp Vault Chart hashicorp/vault 0.24.1 1.13.1 Official HashiCorp Vault Chart hashicorp/vault 0.24.0 1.13.1 Official HashiCorp Vault Chart hashicorp/vault 0.23.0 1.12.1 Official HashiCorp Vault Chart hashicorp/vault 0.22.1 1.12.0 Official HashiCorp Vault Chart hashicorp/vault 0.22.0 1.11.3 Official HashiCorp Vault Chart
安装 Vault
安装最新版本的 Vault。Vault 安装是有几种模式，分别对应不同的使用场景
Dev mode - Helm Chart 将会运行一个 Vault Server ，Storage Backend 会使用 Memeory，仅用于学习环境 [3]
Vault initialized with 5 key shares and a key threshold of 3. Please securely distribute the key shares printed above. When the Vault is re-sealed, restarted, or stopped, you must supply at least 3 of these keys to unseal it before it can start servicing requests.
Vault does not store the generated root key. Without at least 3 keys to reconstruct the root key, Vault will remain permanently sealed!
It is possible to generate new unseal keys, provided you have a quorum of existing unseal keys shares. See "vault operator rekey" for more information.
$ kubectl exec -ti vault-0 -- vault operator unseal Unseal Key (will be hidden): Key Value --- ----- Seal Type shamir Initialized true Sealed true Total Shares 5 Threshold 3 Unseal Progress 1/3 Unseal Nonce a72a0446-3449-c8a9-a8af-74580f8e6aee Version 1.14.0 Build Date 2023-06-19T11:40:23Z Storage Type file HA Enabled false $ kubectl exec -ti vault-0 -- vault operator unseal Unseal Key (will be hidden): Key Value --- ----- Seal Type shamir Initialized true Sealed true Total Shares 5 Threshold 3 Unseal Progress 2/3 Unseal Nonce a72a0446-3449-c8a9-a8af-74580f8e6aee Version 1.14.0 Build Date 2023-06-19T11:40:23Z Storage Type file HA Enabled false $ kubectl exec -ti vault-0 -- vault operator unseal Unseal Key (will be hidden): Key Value --- ----- Seal Type shamir Initialized true Sealed false Total Shares 5 Threshold 3 Version 1.14.0 Build Date 2023-06-19T11:40:23Z Storage Type file Cluster Name vault-cluster-12faa106 Cluster ID 59fe0817-641e-0ce1-4dfd-2e3f9cb265c7 HA Enabled false
Sealed 状态为 false 时，表示解封完成，Vault 即可开始处理请求。
配置 UI 访问
使用 Vault Helm Chart 部署后，会自动创建针对 UI (端口 8200) 的 Service
$ vault status Key Value --- ----- Seal Type shamir Initialized true Sealed false Total Shares 5 Threshold 3 Version 1.14.0 Build Date 2023-06-19T11:40:23Z Storage Type file Cluster Name vault-cluster-12faa106 Cluster ID 59fe0817-641e-0ce1-4dfd-2e3f9cb265c7 HA Enabled false
$ vault secrets list Path Type Accessor Description ---- ---- -------- ----------- cubbyhole/ cubbyhole cubbyhole_e5c17df6 per-token private secret storage identity/ identity identity_f0404cf8 identity store sys/ system system_053aea79 system endpoints used for control, policy and debugging transit/ transit transit_aaaaf63d n/a
listener "tcp" { tls_disable = 1 address = "[::]:8200" cluster_address = "[::]:8201" # Enable unauthenticated metrics access (necessary for Prometheus Operator) #telemetry { # unauthenticated_metrics_access = "true" #} } storage "file" { path = "/vault/data" } # Example configuration for using auto-unseal, using Google Cloud KMS. The # GKMS keys must already exist, and the cluster must have a service account # that is authorized to access GCP KMS. #seal "gcpckms" { # project = "vault-helm-dev" # region = "global" # key_ring = "vault-helm-unseal-kr" # crypto_key = "vault-helm-unseal-key" #} # Example configuration for enabling Prometheus metrics in your config. #telemetry { # prometheus_retention_time = "30s" # disable_hostname = true #}
常见错误
pod has unbound immediate PersistentVolumeClaims
使用 Vault Helm Chart 部署 Vault 后，Pod 状态为 Pending
$ kubectl get pods -o wide NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES vault-0 0/1 Pending 0 105s <none> <none> <none> <none> vault-agent-injector-6549d85b8f-8n4ql 1/1 Running 0 106s 10.244.4.204 k8s-worker1 <none>
检查 Pod 的相信描述信息，Pending 的原因为没有绑定到合适的 PV： 0/5 nodes are available: 5 pod has unbound immediate PersistentVolumeClaims
$ $ kubectl describe pod vault-0 Name: vault-0 Namespace: default Priority: 0 Node: <none> Labels: app.kubernetes.io/instance=vault app.kubernetes.io/name=vault component=server controller-revision-hash=vault-546b6ddf48 helm.sh/chart=vault-0.25.0 statefulset.kubernetes.io/pod-name=vault-0 Annotations: <none> Status: Pending ... Conditions: Type Status PodScheduled False Volumes: data: Type: PersistentVolumeClaim (a reference to a PersistentVolumeClaim in the same namespace) ClaimName: data-vault-0 ReadOnly: false config: Type: ConfigMap (a volume populated by a ConfigMa p) Name: vault-config Optional: false home: Type: EmptyDir (a temporary directory that shares a pod's lifetime) Medium: SizeLimit: <unset> kube-api-access-5hvcw: Type: Projected (a volume that contains injected data from multiple sources) TokenExpirationSeconds: 3607 ConfigMapName: kube-root-ca.crt ConfigMapOptional: <nil> DownwardAPI: true QoS Class: BestEffort Node-Selectors: <none> Tolerations: node.kubernetes.io/not-ready:NoExecute op=Exists for 300s node.kubernetes.io/unreachable:NoExecute op=Exists for 300s Events: Type Reason Age From Message ---- ------ ---- ---- ------- Warning FailedScheduling 2m9s default-scheduler 0/5 nodes are available: 5 pod has unbound immediate PersistentVolumeClaims. preemption: 0/5 nodes are available: 5 Preemption is not helpful for scheduling.
