Helm/Vault
helm repo add hashicorp https://helm.releases.hashicorp.com
helm repo update && helm repo list
kubectl config get-contexts
|
Helm » Context
|
Helm » Context | |
|---|---|
export KUBECONFIG="${HOME}/.kube/aws-kubeconfig.yaml"
export KUBECONFIG="${HOME}/.kube/dev-kubeconfig.yaml"
export KUBECONFIG="${HOME}/.kube/gcp-kubeconfig.yaml"
export KUBECONFIG="${HOME}/.kube/config"
|
cat <<'EXE'| sudo bash
mkdir -p /var/minikube/pvc/vault/data-vault-0/
chown -R 100:1000 /var/minikube/pvc/vault/
EXE
|
Helm » Install
|
Helm » Install | |
|---|---|
helm show values hashicorp/vault --version=0.30.1|less
helm show values hashicorp/vault --version=0.31.0|less
| |
export KUBECONFIG="${HOME}/.kube/shahed-ab-kubeconfig.yaml"
kubectl create ns vault || true
|
kubectl get ns|grep vault
kubectl delete ns vault || true
|
|
| |
cat <<'YML'| \
kubectl apply -f -
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: vault-data-vault-0
spec:
capacity:
storage: 1Gi
accessModes:
- ReadWriteOnce
persistentVolumeReclaimPolicy: Retain
storageClassName: hostpath
hostPath:
path: /var/hostpath_pv/vault/data-vault-0
type: DirectoryOrCreate
YML
|
cat << YML | \
kubectl apply -f -
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
labels:
app.kubernetes.io/name: vault
name: data-vault-0
namespace: vault
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
storageClassName: hostpath
volumeName: vault-data-vault-0
YML
|
cat <<'YML' | \
helm -n=vault upgrade -i vault hashicorp/vault --version=0.31.0 -f -
---
global:
enabled: true
injector:
replicas: 1
image:
repository: hashicorp/vault-k8s
tag: 1.7.0
agentImage:
repository: hashicorp/vault
tag: 1.20.1
server:
image:
repository: hashicorp/vault
tag: 1.20.1
resources:
requests:
memory: 256Mi
cpu: 250m
limits:
memory: 512Mi
cpu: 500m
ingress:
enabled: true
annotations:
kubernetes.io/ingress.class: nginx
ingressClassName: nginx
hosts:
- host: vault.shahed.biz.ops
dataStorage:
size: 10Gi
enabled: true
storageClass: standard
dev:
enabled: false
ui:
enabled: true
serviceType: ClusterIP
YML
|
|
kubectl -n vault exec -it svc/vault -- vault operator init
kubectl -n vault exec -it svc/vault -- vault status
kubectl -n vault exec -it svc/vault -- ash
:'
vault operator init
vault operator unseal
vault status
'
|
Unseal Key 1: 2CMJ+UxMNVo7OD9ovT9ZUQmGFCj1nNOaAttIow9TNybq Unseal Key 2: RGbEYaLbwElPYmNfSxvpGCJre+rQe0aJ/qjKilU80rQ0 Unseal Key 3: GMkN2PdMVFgwmyCPBC3hwd1NzNGba7HLr9mP2NCmz4eQ Unseal Key 4: QWn5JBPeptgKd19c7A22PSQ4RZsiNkPgngvBkgUoyC3d Unseal Key 5: expQJJ5HZ1tq30TvUO8dYsjzfYr+fj//hOO8RBhULgpC Initial Root Token: hvs.zv7QKjHDzNPFQOG7UMwTm72y |
helm -n=vault status vault
helm -n=vault get manifest vault
|
telnet vault.shahed.biz.ops 443
setsid open https://vault.shahed.biz.ops >/dev/null 2>&1 &
|
Helm » Ingress
|
Vault » Ingress | |
|---|---|
cat <<'YML' | \
kubectl -n vault apply -f -
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: vault-cert
namespace: vault
spec:
secretName: vault-cert
commonName: vault.shahed.biz.ops
dnsNames:
- vault.shahed.biz.ops
duration: 8760h
renewBefore: 720h
privateKey:
size: 256
encoding: PKCS8
algorithm: ECDSA
rotationPolicy: Always
usages:
- digital signature
- key encipherment
- server auth
- client auth
subject:
countries: ["BD"]
provinces: ["Dhaka"]
postalCodes: ["1500"]
localities: ["Munshiganj"]
organizations: ["Shahed, Inc."]
organizationalUnits: ["vault.shahed.biz.ops"]
streetAddresses: ["256 Khal East, Passport Office"]
issuerRef:
name: shahed-ecc-sub-ca-2025-k8s
kind: ClusterIssuer
YML
|
Shahed_ECC_Root_CA_2025 » Firefox » Settings » Certificates » View Certificates » Import |
cat <<'YML' | \
kubectl -n vault patch ingress/vault --patch-file=/dev/stdin
---
metadata:
annotations:
cert-manager.io/cluster-issuer: shahed-ecc-sub-ca-2025-k8s
spec:
tls:
- hosts:
- vault.shahed.biz.ops
secretName: vault-cert
YML
|
cat <<'YML' | \
kubectl -n vault patch ingress/vault --patch-file=/dev/stdin
---
metadata:
annotations:
cert-manager.io/cluster-issuer: null
spec:
tls: null
YML
|
setsid open http://vault.shahed.biz.ops >/dev/null 2>&1 &
setsid open https://vault.shahed.biz.ops >/dev/null 2>&1 &
|
|
References
|
References | ||
|---|---|---|