Helm/Vault: Difference between revisions

Revision as of 02:56, 23 January 2026

helm repo add hashicorp https://helm.releases.hashicorp.com helm repo update && helm repo list kubectl config get-contexts

Helm » Context

export KUBECONFIG="${HOME}/.kube/aws-kubeconfig.yaml"
export KUBECONFIG="${HOME}/.kube/dev-kubeconfig.yaml"
export KUBECONFIG="${HOME}/.kube/gcp-kubeconfig.yaml"
export KUBECONFIG="${HOME}/.kube/lke-kubeconfig.yaml"
export KUBECONFIG="${HOME}/.kube/config"

cat <<'EXE'| sudo bash
mkdir -p          /var/minikube/pvc/vault/data-vault-0/
chown -R 100:1000 /var/minikube/pvc/vault/
chmod -R 700      /var/minikube/pvc/vault/
EXE

Helm » Install

Helm » Install
helm show values hashicorp/vault --version=0.30.1\|less helm show values hashicorp/vault --version=0.31.0\|less
export KUBECONFIG="${HOME}/.kube/shahed-ab-kubeconfig.yaml" kubectl create ns vault \|\| true	kubectl get ns\|grep vault kubectl delete ns vault \|\| true
Skipped » Find More 👉 Storage » Mount Skipped » Find More 👉 Storage » Class » Hostpath Skipped » Find More 👉 Storage » Persistent Volume
Persistent Volume	Persistent Volume Claim
cat <<'YML'\| \ kubectl apply -f - --- apiVersion: v1 kind: PersistentVolume metadata: name: vault-data-vault-0 spec: capacity: storage: 1Gi accessModes: - ReadWriteOnce persistentVolumeReclaimPolicy: Retain storageClassName: hostpath hostPath: path: /var/hostpath_pv/vault/data-vault-0 type: DirectoryOrCreate YML	cat << YML \| \ kubectl apply -f - --- apiVersion: v1 kind: PersistentVolumeClaim metadata: labels: app.kubernetes.io/name: vault name: data-vault-0 namespace: vault spec: accessModes: - ReadWriteOnce resources: requests: storage: 1Gi storageClassName: hostpath volumeName: vault-data-vault-0 YML
Install	Notes
cat <<'YML' \| \ helm -n=vault upgrade -i vault hashicorp/vault --version=0.31.0 -f - --- global: enabled: true injector: replicas: 1 image: repository: hashicorp/vault-k8s tag: 1.7.0 agentImage: repository: hashicorp/vault tag: 1.20.1 server: image: repository: hashicorp/vault tag: 1.20.1 resources: requests: memory: 256Mi cpu: 250m limits: memory: 512Mi cpu: 500m ingress: enabled: true annotations: kubernetes.io/ingress.class: nginx ingressClassName: nginx hosts: - host: vault.shahed.biz.ops volumes: - name: data-vault-0 persistentVolumeClaim: claimName: data-vault-0 volumeMounts: - readOnly: false name: data-vault-0 mountPath: /vault/data dataStorage: size: 1Gi enabled: false storageClass: standard dev: enabled: false ui: enabled: true serviceType: ClusterIP YML
Operator Init	Key Shares
sudo sh -c 'ls -alh /var/minikube/pvc/vault/data-vault-0/*' kubectl -n vault exec -it svc/vault -- vault operator init kubectl -n vault exec -it svc/vault -- vault status kubectl -n vault exec -it svc/vault -- ash :' vault operator init vault operator unseal vault status '	Unseal Key 1: /bvRmLPLF8MnfOQQWrhdqAmLBSKfNtSSkcyWY/uXZ0+F Unseal Key 2: Jh5mA+DwX/zlU+3jvxlgNarSzAOBRHvNcF3QOoGtzl/h Unseal Key 3: DqUWoe6MN6oDKi3bYoZuXSbT0ZpT0/Pbg0kpTkhkUfVP Unseal Key 4: rr5filRlKfkJL27iS0hUMDEtK4z2f/Oo6I1PIxwe3FcG Unseal Key 5: zujb7p5mf9djpoo3+ELvlfgE60oRcwC6754e26LqFCJ7 Initial Root Token: hvs.40aTe1S58DWIstRk4bHPgESg Vault initialized with 5 key shares and a key threshold of 3.
helm -n=vault status vault helm -n=vault get manifest vault	telnet vault.shahed.biz.ops 443 setsid open https://vault.shahed.biz.ops >/dev/null 2>&1 &

Helm » Ingress

Vault » Ingress

cat <<'YML' | \
kubectl -n vault apply -f -
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: vault-cert
  namespace: vault
spec:
  secretName: vault-cert
  commonName: vault.shahed.biz.ops
  dnsNames:
    - vault.shahed.biz.ops
  duration: 8760h
  renewBefore: 720h
  privateKey:
    size: 256
    encoding: PKCS8
    algorithm: ECDSA
    rotationPolicy: Always
  usages:
    - digital signature
    - key encipherment
    - server auth
    - client auth
  subject:
    countries: ["BD"]
    provinces: ["Dhaka"]
    postalCodes: ["1500"]
    localities: ["Munshiganj"]
    organizations: ["Shahed, Inc."]
    organizationalUnits: ["vault.shahed.biz.ops"]
    streetAddresses: ["256 Khal East, Passport Office"]
  issuerRef:
    name: shahed-ecc-sub-ca-2025-k8s
    kind: ClusterIssuer
YML

Shahed_ECC_Root_CA_2025 » Firefox » Settings » Certificates » View Certificates » Import

cat <<'CRT' | \
sudo tee /usr/local/share/ca-certificates/Shahed_ECC_Root_CA_2025.crt >/dev/null
-----BEGIN CERTIFICATE-----
MIICVzCCAf0CFGUKRHOSLD3pqFU50HJvLeqYUPq6MAoGCCqGSM49BAMCMIGtMQsw
CQYDVQQGEwJCRDEOMAwGA1UECAwFRGhha2ExEzARBgNVBAcMCk11bnNoaWdhbmox
FTATBgNVBAoMDFNoYWhlZCwgSW5jLjEgMB4GA1UECwwXU2hhaGVkX0VDQ19Sb290
X0NBXzIwMjUxIDAeBgNVBAMMF1NoYWhlZF9FQ0NfUm9vdF9DQV8yMDI1MR4wHAYJ
KoZIhvcNAQkBFg9pbmZvQHNoYWhlZC5iaXowHhcNMjUwODIzMDk1NzMxWhcNNDUw
ODIzMDk1NzMxWjCBrTELMAkGA1UEBhMCQkQxDjAMBgNVBAgMBURoYWthMRMwEQYD
VQQHDApNdW5zaGlnYW5qMRUwEwYDVQQKDAxTaGFoZWQsIEluYy4xIDAeBgNVBAsM
F1NoYWhlZF9FQ0NfUm9vdF9DQV8yMDI1MSAwHgYDVQQDDBdTaGFoZWRfRUNDX1Jv
b3RfQ0FfMjAyNTEeMBwGCSqGSIb3DQEJARYPaW5mb0BzaGFoZWQuYml6MFkwEwYH
KoZIzj0CAQYIKoZIzj0DAQcDQgAEbuTaY9T08dgixHd9zvDCfuVODsZJDLcdpNB1
38haHzpnfsl0fvKVfJP1nYwrKwskBDTWPDYC03nIHJJxi9js+TAKBggqhkjOPQQD
AgNIADBFAiBUPr4rlKCuAD6FnoyZd/XKD/PvbzafUd4ZnRPFvSw3gQIhAMI+5v7a
ea5K8PaGppAIi/55yHqYlXLgaMB4ohu3OsGw
-----END CERTIFICATE-----
CRT

sudo update-ca-certificates --fresh
sudo update-ca-certificates

cat <<'YML' | \
kubectl -n vault patch ingress/vault --patch-file=/dev/stdin
---
metadata:
  annotations:
    cert-manager.io/cluster-issuer: shahed-ecc-sub-ca-2025-k8s
spec:
  tls:
    - hosts:
        - vault.shahed.biz.ops
      secretName: vault-cert
YML

cat <<'YML' | \
kubectl -n vault patch ingress/vault --patch-file=/dev/stdin
---
metadata:
  annotations:
    cert-manager.io/cluster-issuer: null
spec:
  tls: null



YML

setsid open  http://vault.shahed.biz.ops >/dev/null 2>&1 &
setsid open https://vault.shahed.biz.ops >/dev/null 2>&1 &

Helm » Config

Helm » Config
Scale » Down	Scale » Up
# horizontal scale down or shutdown kubectl -n vault scale sts/vault --replicas=0	# horizontal scale up or startup kubectl -n vault scale sts/vault --replicas=0

Helm » Debug

kubectl -n vault exec -it $(kubectl -n vault get pod -l component=webhook -o name) -c sidecar-injector -- ash
kubectl -n vault exec -it $(kubectl -n vault get pod -l component=webhook -o name)                     -- ash

kubectl -n vault exec -it svc/vault -c vault -- ash
kubectl -n vault exec -it svc/vault          -- ash

kubectl -n vault exec -it svc/vault -c vault -- cat /etc/resolv.conf
kubectl -n vault exec -it svc/vault -c vault -- cat /etc/hosts

kubectl -n vault logs -f  -l component=webhook -c sidecar-injector
kubectl -n vault logs -f  svc/vault -c vault
kubectl -n vault logs -f  svc/vault

Helm » Rollout

Vault » Rollout
kubectl -n vault annotate sts/vault --overwrite \ kubernetes.io/change-cause="CKI-1\| Initial Deployment"	kubectl -n vault rollout history sts/vault kubectl -n vault scale sts/vault --replicas=0
Vault » Rollout	Vault » Revert
cat <<'YML' \| \ kubectl -n vault patch sts/vault --patch-file=/dev/stdin --- spec: template: spec: containers: - name: vault resources: requests: memory: 128Mi cpu: 100m limits: memory: 256Mi cpu: 250m YML	cat <<'YML' \| \ kubectl -n vault patch sts/vault --patch-file=/dev/stdin --- spec: template: spec: containers: - name: vault resources: requests: memory: 256Mi cpu: 250m limits: memory: 512Mi cpu: 500m YML
kubectl -n vault annotate sts/vault --overwrite \ kubernetes.io/change-cause="CKI-2\| Resources Updated"	kubectl -n vault scale sts/vault --replicas=1 kubectl -n vault rollout history sts/vault
kubectl -n vault rollout undo sts/vault --to-revision=1 kubectl -n vault rollout history sts/vault	kubectl -n vault annotate sts/vault --overwrite \ kubernetes.io/change-cause="CKI-3\| Revert Back to CKI-1"
kubectl -n vault get sts/vault -o yaml \ \| yq -P '.spec.template.spec.containers[]\|select(.name == "vault")\|.resources'	kubectl -n vault get sts/vault -o yaml \ -o jsonpath='{.spec.template.spec.containers[?(@.name=="vault")].resources}' \| yq -P

Helm » Uninstall

Helm » Uninstall
helm -n vault status vault helm -n vault get all vault helm -n vault uninstall vault	kubectl -n vault delete pvc --all kubectl delete ns vault kubectl delete pv vault-data-vault-0

Vault » Install

curl -fsSL https://apt.releases.hashicorp.com/gpg\
 | sudo tee /etc/apt/keyrings/hashicorp.asc >/dev/null

DISTRIBUTION=$(. /etc/os-release && echo "${VERSION_CODENAME}")
cat << SRC | sudo tee /etc/apt/sources.list.d/hashicorp.list >/dev/null
deb [arch=$(dpkg --print-architecture)\
 signed-by=/etc/apt/keyrings/hashicorp.asc]\
 https://apt.releases.hashicorp.com ${DISTRIBUTION} main
SRC

cat <<'EXE' | sudo bash
apt-get update && apt-get install -y vault
systemctl disable --now vault.service
systemctl stop          vault.service
systemctl mask          vault.service
systemctl status        vault.service
vault version
which vault
EXE

export VAULT_TOKEN='hvs.40aTe1S58DWIstRk4bHPgESg'
export VAULT_ADDR='https://vault.shahed.biz.ops'
vault status

export VAULT_SKIP_VERIFY=true
export VAULT_FORMAT=yaml
vault login

Playground

Playground
helm -n vault install vault hashicorp/vault --version=0.30.1 helm -n vault upgrade -i vault hashicorp/vault --version=0.31.0 helm show values hashicorp/vault --version=0.31.0\|less
kubectl -n vault exec -it svc/vault -c vault -- bash kubectl -n vault logs -f svc/vault -c vault kubectl -n vault logs -f svc/vault
kubectl config --kubeconfig=${HOME}/.kube/aws-kubeconfig.yaml view --flatten kubectl config --kubeconfig=${HOME}/.kube/dev-kubeconfig.yaml view --flatten kubectl config --kubeconfig=${HOME}/.kube/gcp-kubeconfig.yaml view --flatten kubectl config --kubeconfig=${HOME}/.kube/config view --flatten
kubectl -n vault delete all --all kubectl -n vault delete ing --all kubectl -n vault delete sts --all	kubectl delete pv vault-data-vault-0 kubectl -n vault delete svc --all kubectl -n vault delete pvc --all
kubectl -n vault rollout history sts/vault kubectl -n vault rollout restart sts/vault kubectl -n vault rollout status sts/vault	kubectl -n vault exec -it svc/vault -c vault -- ash kubectl -n vault logs -f svc/vault -c vault kubectl -n vault logs -f svc/vault
sudo sh -c 'ls -alh /var/minikube/pvc/vault/data-vault-0/' sudo sh -c 'du -sh /var/minikube/pvc/vault/data-vault-0/' sudo sh -c 'du -sh /var/minikube/pvc/vault/*'

References

References
Helm » External Secrets Operator Helm » Vault Secrets Operator Helm » Prometheus Stack Helm » Cert Manager Helm » Harbor Helm » Pi-Hole Helm » Vault Helm	Vault » Docs » Secrets management Vault » Docs » Build your CA Vault » Docs » Monitoring Vault » Docs » How Vault » Docs » Why Vault » Install Vault
K8s » Configure Service Accounts for Pods K8s » Restart Pods With Kubectl K8s » Interactive Pod K8s » Restart Pods Docker » Makefile Kubernetes Minikube Kubectl CURL K8s	K8s » `kubectl rollout` K8s » CSI Hostpath Driver Security » Password K8s » Storage K8s » Ingress K8s » Service K8s » Run MinIO CIDR UFW	Bind9 » Authoritative DNS Server Bind9 » Secondary DNS Server Minikube » Ingress DNS Minikube » Systemd Minikube » MetalLB Minikube » Registry Minikube » Tunnel Localtunnel ZA Proxy

Vault » Rollout
kubectl -n vault annotate sts/vault --overwrite \ kubernetes.io/change-cause="CKI-1\| Initial Deployment"	kubectl -n vault rollout history sts/vault kubectl -n vault scale sts/vault --replicas=0
Vault » Rollout	Vault » Revert
cat <<'YML' \| \ kubectl -n vault patch sts/vault --patch-file=/dev/stdin --- spec: template: spec: containers: - name: vault resources: requests: memory: 128Mi cpu: 100m limits: memory: 256Mi cpu: 250m YML	cat <<'YML' \| \ kubectl -n vault patch sts/vault --patch-file=/dev/stdin --- spec: template: spec: containers: - name: vault resources: requests: memory: 256Mi cpu: 250m limits: memory: 512Mi cpu: 500m YML
kubectl -n vault annotate sts/vault --overwrite \ kubernetes.io/change-cause="CKI-2\| Resources Updated"	kubectl -n vault scale sts/vault --replicas=1 kubectl -n vault rollout history sts/vault
kubectl -n vault rollout undo sts/vault --to-revision=1 kubectl -n vault rollout history sts/vault	kubectl -n vault annotate sts/vault --overwrite \ kubernetes.io/change-cause="CKI-3\| Revert Back to CKI-1"
kubectl -n vault get sts/vault -o yaml \ \| yq -P '.spec.template.spec.containers[]\|select(.name == "vault")\|.resources'	kubectl -n vault get sts/vault -o yaml \ -o jsonpath='{.spec.template.spec.containers[?(@.name=="vault")].resources}' \| yq -P

Helm/Vault: Difference between revisions

Revision as of 02:56, 23 January 2026

Contents

Helm » Context

Helm » Install

Helm » Ingress

Helm » Config

Helm » Debug

Helm » Rollout

Helm » Uninstall

Vault » Install

Playground

References

Navigation menu

@@ Line 19: / Line 19: @@
 export KUBECONFIG="${HOME}/.kube/dev-kubeconfig.yaml"
 export KUBECONFIG="${HOME}/.kube/gcp-kubeconfig.yaml"
+export KUBECONFIG="${HOME}/.kube/lke-kubeconfig.yaml"
 export KUBECONFIG="${HOME}/.kube/config"
 </syntaxhighlight>
@@ Line 27: / Line 28: @@
 mkdir -p          /var/minikube/pvc/vault/data-vault-0/
 chown -R 100:1000 /var/minikube/pvc/vault/
+chmod -R 700      /var/minikube/pvc/vault/
 EXE
 </syntaxhighlight>
@@ Line 41: / Line 43: @@
 helm show   values hashicorp/vault --version=0.31.0|less
 </syntaxhighlight>
 |-
 |valign='top' style='width:50%'|
@@ Line 61: / Line 62: @@
 ----
 * [[K8s/Storage#Storage » Persistent Volume|Skipped » Find More 👉 Storage » Persistent Volume]]
+|-
+!scope='col'| Persistent Volume
+!scope='col'| Persistent Volume Claim
 |-
 |valign='top'|
@@ Line 107: / Line 111: @@
 YML
 </syntaxhighlight>
+|-
+!scope='col'| Install
+!scope='col'| Notes
 |-
 |valign='top'|
@@ Line 141: / Line 148: @@
      hosts:
        - host: vault.shahed.biz.ops
+  volumes:
+    - name: data-vault-0
+      persistentVolumeClaim:
+        claimName: data-vault-0
+  volumeMounts:
+    - readOnly: false
+      name: data-vault-0
+      mountPath: /vault/data
    dataStorage:
-     size: 10Gi
+     size: 1Gi
-     enabled: true
+     enabled: false
      storageClass: standard
    dev:
@@ Line 153: / Line 168: @@
 </syntaxhighlight>
 |valign='top'|
+|-
+!scope='col'| Operator Init
+!scope='col'| Key Shares
 |-
 |valign='top'|
 <syntaxhighlight lang='bash'>
+sudo sh -c 'ls -alh /var/minikube/pvc/vault/data-vault-0/*'
 kubectl -n vault exec -it svc/vault -- vault operator init
 kubectl -n vault exec -it svc/vault -- vault status
@@ Line 166: / Line 185: @@
 </syntaxhighlight>
 |valign='top'|
-  '''Unseal Key 1:''' 2CMJ+UxMNVo7OD9ovT9ZUQmGFCj1nNOaAttIow9TNybq
+  '''Unseal Key 1:''' /bvRmLPLF8MnfOQQWrhdqAmLBSKfNtSSkcyWY/uXZ0+F
-  '''Unseal Key 2:''' RGbEYaLbwElPYmNfSxvpGCJre+rQe0aJ/qjKilU80rQ0
+  '''Unseal Key 2:''' Jh5mA+DwX/zlU+3jvxlgNarSzAOBRHvNcF3QOoGtzl/h
-  '''Unseal Key 3:''' GMkN2PdMVFgwmyCPBC3hwd1NzNGba7HLr9mP2NCmz4eQ
+  '''Unseal Key 3:''' DqUWoe6MN6oDKi3bYoZuXSbT0ZpT0/Pbg0kpTkhkUfVP
-  '''Unseal Key 4:''' QWn5JBPeptgKd19c7A22PSQ4RZsiNkPgngvBkgUoyC3d
+  '''Unseal Key 4:''' rr5filRlKfkJL27iS0hUMDEtK4z2f/Oo6I1PIxwe3FcG
-  '''Unseal Key 5:''' expQJJ5HZ1tq30TvUO8dYsjzfYr+fj//hOO8RBhULgpC
+  '''Unseal Key 5:''' zujb7p5mf9djpoo3+ELvlfgE60oRcwC6754e26LqFCJ7
+ '''Initial Root Token:''' hvs.40aTe1S58DWIstRk4bHPgESg
-  '''Initial Root Token:''' hvs.zv7QKjHDzNPFQOG7UMwTm72y
+  Vault initialized with 5 key shares and a key threshold of 3.
 |-
 |valign='top'|
@@ Line 237: / Line 257: @@
   '''Shahed_ECC_Root_CA_2025''' » Firefox » Settings » Certificates » View Certificates » Import
+<syntaxhighlight lang='bash'>
+cat <<'CRT' | \
+sudo tee /usr/local/share/ca-certificates/Shahed_ECC_Root_CA_2025.crt >/dev/null
+-----BEGIN CERTIFICATE-----
+MIICVzCCAf0CFGUKRHOSLD3pqFU50HJvLeqYUPq6MAoGCCqGSM49BAMCMIGtMQsw
+CQYDVQQGEwJCRDEOMAwGA1UECAwFRGhha2ExEzARBgNVBAcMCk11bnNoaWdhbmox
+FTATBgNVBAoMDFNoYWhlZCwgSW5jLjEgMB4GA1UECwwXU2hhaGVkX0VDQ19Sb290
+X0NBXzIwMjUxIDAeBgNVBAMMF1NoYWhlZF9FQ0NfUm9vdF9DQV8yMDI1MR4wHAYJ
+KoZIhvcNAQkBFg9pbmZvQHNoYWhlZC5iaXowHhcNMjUwODIzMDk1NzMxWhcNNDUw
+ODIzMDk1NzMxWjCBrTELMAkGA1UEBhMCQkQxDjAMBgNVBAgMBURoYWthMRMwEQYD
+VQQHDApNdW5zaGlnYW5qMRUwEwYDVQQKDAxTaGFoZWQsIEluYy4xIDAeBgNVBAsM
+F1NoYWhlZF9FQ0NfUm9vdF9DQV8yMDI1MSAwHgYDVQQDDBdTaGFoZWRfRUNDX1Jv
+b3RfQ0FfMjAyNTEeMBwGCSqGSIb3DQEJARYPaW5mb0BzaGFoZWQuYml6MFkwEwYH
+KoZIzj0CAQYIKoZIzj0DAQcDQgAEbuTaY9T08dgixHd9zvDCfuVODsZJDLcdpNB1
+haHzpnfsl0fvKVfJP1nYwrKwskBDTWPDYC03nIHJJxi9js+TAKBggqhkjOPQQD
+AgNIADBFAiBUPr4rlKCuAD6FnoyZd/XKD/PvbzafUd4ZnRPFvSw3gQIhAMI+5v7a
+ea5K8PaGppAIi/55yHqYlXLgaMB4ohu3OsGw
+-----END CERTIFICATE-----
+CRT
+sudo update-ca-certificates --fresh
+sudo update-ca-certificates
+</syntaxhighlight>
 |-
 |valign='top'|
@@ Line 281: / Line 324: @@
 ==Helm » Config==
 {|class='wikitable mw-collapsible'
+!scope='col' style='text-align:left' colspan='2'|
+Helm » Config
+|-
+!scope='col' style='width:50%'| Scale » Down
+!scope='col' style='width:50%'| Scale » Up
+|-
+|valign='top'|
+<syntaxhighlight lang='bash'>
+# horizontal scale down or shutdown
+kubectl -n vault scale sts/vault --replicas=0
+</syntaxhighlight>
+|valign='top'|
+<syntaxhighlight lang='bash'>
+# horizontal scale up or startup
+kubectl -n vault scale sts/vault --replicas=0
+</syntaxhighlight>
+|}
+==Helm » Debug==
+{|class='wikitable mw-collapsible'
+!scope='col' style='text-align:left'|
+Helm » Debug
+|-
+|valign='top'|
+<syntaxhighlight lang='bash'>
+kubectl -n vault exec -it $(kubectl -n vault get pod -l component=webhook -o name) -c sidecar-injector -- ash
+kubectl -n vault exec -it $(kubectl -n vault get pod -l component=webhook -o name)                     -- ash
+kubectl -n vault exec -it svc/vault -c vault -- ash
+kubectl -n vault exec -it svc/vault          -- ash
+kubectl -n vault exec -it svc/vault -c vault -- cat /etc/resolv.conf
+kubectl -n vault exec -it svc/vault -c vault -- cat /etc/hosts
+kubectl -n vault logs -f  -l component=webhook -c sidecar-injector
+kubectl -n vault logs -f  svc/vault -c vault
+kubectl -n vault logs -f  svc/vault
+</syntaxhighlight>
+|}
+==Helm » Rollout==
+{|class='wikitable mw-collapsible mw-collapsed'
+!scope='col' style='text-align:left' colspan='2'|
+Vault » Rollout
+|-
+|valign='top' style='width:50%'|
+<syntaxhighlight lang='bash'>
+kubectl -n vault annotate        sts/vault --overwrite \
+ kubernetes.io/change-cause="CKI-1| Initial Deployment"
+</syntaxhighlight>
+|valign='top' style='width:50%'|
+<syntaxhighlight lang='bash'>
+kubectl -n vault rollout history sts/vault
+kubectl -n vault scale   sts/vault --replicas=0
+</syntaxhighlight>
+|-
+!scope='col' style='text-align:left' style='width:50%'|
+Vault » Rollout
 !scope='col' style='text-align:left' style='width:50%'|
-Vault » Config
-!scope='col' style='text-align:left'  style='width:50%'|
 Vault » Revert
 |-
-|valign='top'|
+|valign='top' style='width:50%'|
 <syntaxhighlight lang='yaml'>
 cat <<'YML' | \
@@ Line 292: / Line 395: @@
 ---
 spec:
-   replicas: 0
+   template:
+    spec:
+      containers:
+        - name: vault
+          resources:
+            requests:
+              memory: 128Mi
+              cpu: 100m
+            limits:
+              memory: 256Mi
+              cpu: 250m
 YML
 </syntaxhighlight>
-|valign='top'|
+|valign='top' style='width:50%'|
 <syntaxhighlight lang='yaml'>
 cat <<'YML' | \
@@ Line 302: / Line 415: @@
 ---
 spec:
-   replicas: 1
+   template:
+    spec:
+      containers:
+        - name: vault
+          resources:
+            requests:
+              memory: 256Mi
+              cpu: 250m
+            limits:
+              memory: 512Mi
+              cpu: 500m
 YML
+</syntaxhighlight>
+|-
+|valign='top' style='width:50%'|
+<syntaxhighlight lang='bash'>
+kubectl -n vault annotate        sts/vault --overwrite \
+ kubernetes.io/change-cause="CKI-2| Resources Updated"
+</syntaxhighlight>
+|valign='top' style='width:50%'|
+<syntaxhighlight lang='bash'>
+kubectl -n vault scale   sts/vault --replicas=1
+kubectl -n vault rollout history sts/vault
+</syntaxhighlight>
+|-
+|valign='top' style='width:50%'|
+<syntaxhighlight lang='bash'>
+kubectl -n vault rollout undo    sts/vault --to-revision=1
+kubectl -n vault rollout history sts/vault
+</syntaxhighlight>
+|valign='top' style='width:50%'|
+<syntaxhighlight lang='bash'>
+kubectl -n vault annotate        sts/vault --overwrite \
+ kubernetes.io/change-cause="CKI-3| Revert Back to CKI-1"
+</syntaxhighlight>
+|-
+|valign='top' style='width:50%'|
+<syntaxhighlight lang='bash'>
+kubectl -n vault get sts/vault -o yaml \
+ | yq -P '.spec.template.spec.containers[]|select(.name == "vault")|.resources'
+</syntaxhighlight>
+|valign='top' style='width:50%'|
+<syntaxhighlight lang='bash'>
+kubectl -n vault get sts/vault -o yaml \
+  -o jsonpath='{.spec.template.spec.containers[?(@.name=="vault")].resources}' | yq -P
+</syntaxhighlight>
+|}
+==Helm » Uninstall==
+{|class='wikitable mw-collapsible mw-collapsed'
+!scope='col' style='text-align:left' colspan='2'|
+Helm » Uninstall
+|-
+|valign='top' style='width:50%'|
+<syntaxhighlight lang='bash'>
+helm -n vault status    vault
+helm -n vault get all   vault
+helm -n vault uninstall vault
+</syntaxhighlight>
+|valign='top' style='width:50%'|
+<syntaxhighlight lang='bash'>
+kubectl -n vault delete pvc --all
+kubectl          delete ns  vault
+kubectl          delete pv  vault-data-vault-0
 </syntaxhighlight>
 |}
-==Helm » Debug==
+==Vault » Install==
 {|class='wikitable mw-collapsible'
-!scope='col' style='text-align:left'|
+!scope='col' style='text-align:left' colspan='2'|
-Helm » Debug
+Vault » Install
+|-
+|valign='top' style='width:50%'|
+<syntaxhighlight lang='bash'>
+curl -fsSL https://apt.releases.hashicorp.com/gpg\
+ | sudo tee /etc/apt/keyrings/hashicorp.asc >/dev/null
+DISTRIBUTION=$(. /etc/os-release && echo "${VERSION_CODENAME}")
+cat << SRC | sudo tee /etc/apt/sources.list.d/hashicorp.list >/dev/null
+deb [arch=$(dpkg --print-architecture)\
+ signed-by=/etc/apt/keyrings/hashicorp.asc]\
+ https://apt.releases.hashicorp.com ${DISTRIBUTION} main
+SRC
+</syntaxhighlight>
+|valign='top' style='width:50%'|
+<syntaxhighlight lang='bash'>
+cat <<'EXE' | sudo bash
+apt-get update && apt-get install -y vault
+systemctl disable --now vault.service
+systemctl stop          vault.service
+systemctl mask          vault.service
+systemctl status        vault.service
+vault version
+which vault
+EXE
+</syntaxhighlight>
 |-
 |valign='top'|
 <syntaxhighlight lang='bash'>
-kubectl -n vault exec -it $(kubectl -n vault get pod -l component=webhook -o name) -c sidecar-injector -- ash
+export VAULT_TOKEN='hvs.40aTe1S58DWIstRk4bHPgESg'
-kubectl -n vault exec -it $(kubectl -n vault get pod -l component=webhook -o name)                     -- ash
+export VAULT_ADDR='https://vault.shahed.biz.ops'
+vault status
+</syntaxhighlight>
+|valign='top'|
+<syntaxhighlight lang='bash'>
+export VAULT_SKIP_VERIFY=true
+export VAULT_FORMAT=yaml
+vault login
+</syntaxhighlight>
+|}
+==Playground==
+{|class='wikitable mw-collapsible mw-collapsed'
+!scope='col' style='text-align:left' colspan='2'|
+Playground
+|-
+|valign='top' colspan='2'|
+<syntaxhighlight lang='bash'>
+helm -n vault install    vault hashicorp/vault --version=0.30.1
+helm -n vault upgrade -i vault hashicorp/vault --version=0.31.0
+helm show   values             hashicorp/vault --version=0.31.0|less
+</syntaxhighlight>
+|-
+|valign='top' colspan='2'|
+<syntaxhighlight lang='bash'>
+kubectl -n vault exec -it svc/vault -c vault -- bash
+kubectl -n vault logs -f  svc/vault -c vault
+kubectl -n vault logs -f  svc/vault
+</syntaxhighlight>
+|-
+|valign='top' colspan='2'|
+<syntaxhighlight lang='bash'>
+kubectl config --kubeconfig=${HOME}/.kube/aws-kubeconfig.yaml view --flatten
+kubectl config --kubeconfig=${HOME}/.kube/dev-kubeconfig.yaml view --flatten
+kubectl config --kubeconfig=${HOME}/.kube/gcp-kubeconfig.yaml view --flatten
+kubectl config --kubeconfig=${HOME}/.kube/config view --flatten
+</syntaxhighlight>
+|-
+|valign='top' style='width:50%'|
+<syntaxhighlight lang='bash'>
+kubectl -n vault delete all --all
+kubectl -n vault delete ing --all
+kubectl -n vault delete sts --all
+</syntaxhighlight>
-kubectl -n vault exec -it svc/vault -c vault -- ash
+|valign='top' style='width:50%'|
-kubectl -n vault exec -it svc/vault          -- ash
+<syntaxhighlight lang='bash'>
+kubectl          delete pv  vault-data-vault-0
+kubectl -n vault delete svc --all
+kubectl -n vault delete pvc --all
+</syntaxhighlight>
-kubectl -n vault exec -it svc/vault -c vault -- cat /etc/resolv.conf
+|-
-kubectl -n vault exec -it svc/vault -c vault -- cat /etc/hosts
+|valign='top'|
+<syntaxhighlight lang='bash'>
+kubectl -n vault rollout history sts/vault
+kubectl -n vault rollout restart sts/vault
+kubectl -n vault rollout status  sts/vault
+</syntaxhighlight>
-kubectl -n vault logs -f  -l component=webhook -c sidecar-injector
+|valign='top'|
+<syntaxhighlight lang='bash'>
+kubectl -n vault exec -it svc/vault -c vault -- ash
 kubectl -n vault logs -f  svc/vault -c vault
 kubectl -n vault logs -f  svc/vault
 </syntaxhighlight>
+|-
+|valign='top'|
+<syntaxhighlight lang='bash'>
+sudo sh -c 'ls -alh /var/minikube/pvc/vault/data-vault-0/*'
+sudo sh -c 'du -sh  /var/minikube/pvc/vault/data-vault-0/*'
+sudo sh -c 'du -sh  /var/minikube/pvc/vault/*'
+</syntaxhighlight>
+|valign='top'|
 |}
@@ Line 335: / Line 605: @@
 |-
 |valign='top' style='width:33%'|
-* [https://stackoverflow.com/questions/75596795/ Helm » Pass YAML/JSON using <code>stdin</code>]
+* [[Helm/External Secrets Operator|Helm » External Secrets Operator]]
+* [[Helm/Vault Secrets Operator|Helm » Vault Secrets Operator]]
 * [[Helm/Prometheus Stack|Helm » Prometheus Stack]]
 * [[Helm/Cert Manager|Helm » Cert Manager]]
@@ Line 350: / Line 621: @@
 * [https://developer.hashicorp.com/vault/tutorials/get-started/why-use-vault Vault » Docs » Why]
 * [https://developer.hashicorp.com/vault/install Vault » Install]
+* [[Vault]]
 |valign='top' style='width:33%'|

Helm/Vault: Difference between revisions

Revision as of 02:56, 23 January 2026

Helm » Context

Helm » Install

Helm » Ingress

Helm » Config

Helm » Debug

Helm » Rollout

Helm » Uninstall

Vault » Install

Playground

References

Navigation menu

Search