Helm/Vault

helm repo add hashicorp https://helm.releases.hashicorp.com helm repo update && helm repo list kubectl config get-contexts

Helm » Context

export KUBECONFIG="${HOME}/.kube/aws-kubeconfig.yaml"
export KUBECONFIG="${HOME}/.kube/dev-kubeconfig.yaml"
export KUBECONFIG="${HOME}/.kube/gcp-kubeconfig.yaml"
export KUBECONFIG="${HOME}/.kube/lke-kubeconfig.yaml"
export KUBECONFIG="${HOME}/.kube/config"

cat <<'EXE'| sudo bash
mkdir -p          /var/minikube/pvc/vault/data-vault-0/
chown -R 100:1000 /var/minikube/pvc/vault/
chmod -R 700      /var/minikube/pvc/vault/
EXE

Helm » Install

Helm » Install
helm show values hashicorp/vault --version=0.30.1\|less helm show values hashicorp/vault --version=0.31.0\|less
export KUBECONFIG="${HOME}/.kube/shahed-ab-kubeconfig.yaml" kubectl create ns vault \|\| true	kubectl get ns\|grep vault kubectl delete ns vault \|\| true
Skipped » Find More 👉 Storage » Mount Skipped » Find More 👉 Storage » Class » Hostpath Skipped » Find More 👉 Storage » Persistent Volume
Persistent Volume	Persistent Volume Claim
cat <<'YML'\| \ kubectl apply -f - --- apiVersion: v1 kind: PersistentVolume metadata: name: vault-data-vault-0 spec: capacity: storage: 1Gi accessModes: - ReadWriteOnce persistentVolumeReclaimPolicy: Retain storageClassName: hostpath hostPath: path: /var/hostpath_pv/vault/data-vault-0 type: DirectoryOrCreate YML	cat << YML \| \ kubectl apply -f - --- apiVersion: v1 kind: PersistentVolumeClaim metadata: labels: app.kubernetes.io/name: vault name: data-vault-0 namespace: vault spec: accessModes: - ReadWriteOnce resources: requests: storage: 1Gi storageClassName: hostpath volumeName: vault-data-vault-0 YML
Install	Notes
cat <<'YML' \| \ helm -n=vault upgrade -i vault hashicorp/vault --version=0.31.0 -f - --- global: enabled: true injector: replicas: 1 image: repository: hashicorp/vault-k8s tag: 1.7.0 agentImage: repository: hashicorp/vault tag: 1.20.1 server: image: repository: hashicorp/vault tag: 1.20.1 resources: requests: memory: 256Mi cpu: 250m limits: memory: 512Mi cpu: 500m ingress: enabled: true annotations: kubernetes.io/ingress.class: nginx ingressClassName: nginx hosts: - host: vault.shahed.biz.ops volumes: - name: data-vault-0 persistentVolumeClaim: claimName: data-vault-0 volumeMounts: - readOnly: false name: data-vault-0 mountPath: /vault/data dataStorage: size: 1Gi enabled: false storageClass: standard dev: enabled: false ui: enabled: true serviceType: ClusterIP YML
Operator Init	Key Shares
sudo sh -c 'ls -alh /var/minikube/pvc/vault/data-vault-0/*' kubectl -n vault exec -it svc/vault -- vault operator init kubectl -n vault exec -it svc/vault -- vault status kubectl -n vault exec -it svc/vault -- ash :' vault operator init vault operator unseal vault status '	Unseal Key 1: /bvRmLPLF8MnfOQQWrhdqAmLBSKfNtSSkcyWY/uXZ0+F Unseal Key 2: Jh5mA+DwX/zlU+3jvxlgNarSzAOBRHvNcF3QOoGtzl/h Unseal Key 3: DqUWoe6MN6oDKi3bYoZuXSbT0ZpT0/Pbg0kpTkhkUfVP Unseal Key 4: rr5filRlKfkJL27iS0hUMDEtK4z2f/Oo6I1PIxwe3FcG Unseal Key 5: zujb7p5mf9djpoo3+ELvlfgE60oRcwC6754e26LqFCJ7 Initial Root Token: hvs.40aTe1S58DWIstRk4bHPgESg Vault initialized with 5 key shares and a key threshold of 3.
helm -n=vault status vault helm -n=vault get manifest vault	telnet vault.shahed.biz.ops 443 setsid open https://vault.shahed.biz.ops >/dev/null 2>&1 &

Helm » Ingress

Vault » Ingress

cat <<'YML' | \
kubectl -n vault apply -f -
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: vault-cert
  namespace: vault
spec:
  secretName: vault-cert
  commonName: vault.shahed.biz.ops
  dnsNames:
    - vault.shahed.biz.ops
  duration: 8760h
  renewBefore: 720h
  privateKey:
    size: 256
    encoding: PKCS8
    algorithm: ECDSA
    rotationPolicy: Always
  usages:
    - digital signature
    - key encipherment
    - server auth
    - client auth
  subject:
    countries: ["BD"]
    provinces: ["Dhaka"]
    postalCodes: ["1500"]
    localities: ["Munshiganj"]
    organizations: ["Shahed, Inc."]
    organizationalUnits: ["vault.shahed.biz.ops"]
    streetAddresses: ["256 Khal East, Passport Office"]
  issuerRef:
    name: shahed-ecc-sub-ca-2025-k8s
    kind: ClusterIssuer
YML

Shahed_ECC_Root_CA_2025 » Firefox » Settings » Certificates » View Certificates » Import

cat <<'CRT' | \
sudo tee /usr/local/share/ca-certificates/Shahed_ECC_Root_CA_2025.crt >/dev/null
-----BEGIN CERTIFICATE-----
MIICVzCCAf0CFGUKRHOSLD3pqFU50HJvLeqYUPq6MAoGCCqGSM49BAMCMIGtMQsw
CQYDVQQGEwJCRDEOMAwGA1UECAwFRGhha2ExEzARBgNVBAcMCk11bnNoaWdhbmox
FTATBgNVBAoMDFNoYWhlZCwgSW5jLjEgMB4GA1UECwwXU2hhaGVkX0VDQ19Sb290
X0NBXzIwMjUxIDAeBgNVBAMMF1NoYWhlZF9FQ0NfUm9vdF9DQV8yMDI1MR4wHAYJ
KoZIhvcNAQkBFg9pbmZvQHNoYWhlZC5iaXowHhcNMjUwODIzMDk1NzMxWhcNNDUw
ODIzMDk1NzMxWjCBrTELMAkGA1UEBhMCQkQxDjAMBgNVBAgMBURoYWthMRMwEQYD
VQQHDApNdW5zaGlnYW5qMRUwEwYDVQQKDAxTaGFoZWQsIEluYy4xIDAeBgNVBAsM
F1NoYWhlZF9FQ0NfUm9vdF9DQV8yMDI1MSAwHgYDVQQDDBdTaGFoZWRfRUNDX1Jv
b3RfQ0FfMjAyNTEeMBwGCSqGSIb3DQEJARYPaW5mb0BzaGFoZWQuYml6MFkwEwYH
KoZIzj0CAQYIKoZIzj0DAQcDQgAEbuTaY9T08dgixHd9zvDCfuVODsZJDLcdpNB1
38haHzpnfsl0fvKVfJP1nYwrKwskBDTWPDYC03nIHJJxi9js+TAKBggqhkjOPQQD
AgNIADBFAiBUPr4rlKCuAD6FnoyZd/XKD/PvbzafUd4ZnRPFvSw3gQIhAMI+5v7a
ea5K8PaGppAIi/55yHqYlXLgaMB4ohu3OsGw
-----END CERTIFICATE-----
CRT

sudo update-ca-certificates --fresh
sudo update-ca-certificates

cat <<'YML' | \
kubectl -n vault patch ingress/vault --patch-file=/dev/stdin
---
metadata:
  annotations:
    cert-manager.io/cluster-issuer: shahed-ecc-sub-ca-2025-k8s
spec:
  tls:
    - hosts:
        - vault.shahed.biz.ops
      secretName: vault-cert
YML

cat <<'YML' | \
kubectl -n vault patch ingress/vault --patch-file=/dev/stdin
---
metadata:
  annotations:
    cert-manager.io/cluster-issuer: null
spec:
  tls: null



YML

setsid open  http://vault.shahed.biz.ops >/dev/null 2>&1 &
setsid open https://vault.shahed.biz.ops >/dev/null 2>&1 &

Helm » Config

Vault » Config

Vault » Revert

# horizontal scale down or shutdown
kubectl -n vault scale sts/vault --replicas=0

# horizontal scale up or startup
kubectl -n vault scale sts/vault --replicas=0

cat <<'YML' | \
kubectl -n vault patch sts/vault --patch-file=/dev/stdin
---
spec:
  replicas: 0
YML

cat <<'YML' | \
kubectl -n vault patch sts/vault --patch-file=/dev/stdin
---
spec:
  replicas: 1
YML

Helm » Debug

kubectl -n vault exec -it $(kubectl -n vault get pod -l component=webhook -o name) -c sidecar-injector -- ash
kubectl -n vault exec -it $(kubectl -n vault get pod -l component=webhook -o name)                     -- ash

kubectl -n vault exec -it svc/vault -c vault -- ash
kubectl -n vault exec -it svc/vault          -- ash

kubectl -n vault exec -it svc/vault -c vault -- cat /etc/resolv.conf
kubectl -n vault exec -it svc/vault -c vault -- cat /etc/hosts

kubectl -n vault logs -f  -l component=webhook -c sidecar-injector
kubectl -n vault logs -f  svc/vault -c vault
kubectl -n vault logs -f  svc/vault

Helm » Rollout

Vault » Rollout
kubectl -n vault annotate sts/vault --overwrite \ kubernetes.io/change-cause="CKI-1\| Initial Deployment"	kubectl -n vault rollout history sts/vault kubectl -n vault scale sts/vault --replicas=0
Vault » Rollout	Vault » Revert
cat <<'YML' \| \ kubectl -n vault patch sts/vault --patch-file=/dev/stdin --- spec: template: spec: containers: - name: vault resources: requests: memory: 128Mi cpu: 100m limits: memory: 256Mi cpu: 250m YML	cat <<'YML' \| \ kubectl -n vault patch sts/vault --patch-file=/dev/stdin --- spec: template: spec: containers: - name: vault resources: requests: memory: 256Mi cpu: 250m limits: memory: 512Mi cpu: 500m YML
kubectl -n vault annotate sts/vault --overwrite \ kubernetes.io/change-cause="CKI-2\| Resources Updated"	kubectl -n vault scale sts/vault --replicas=1 kubectl -n vault rollout history sts/vault
kubectl -n vault rollout undo sts/vault --to-revision=1 kubectl -n vault rollout history sts/vault	kubectl -n vault annotate sts/vault --overwrite \ kubernetes.io/change-cause="CKI-3\| Revert Back to CKI-1"
kubectl -n vault get sts/vault -o yaml \ \| yq -P '.spec.template.spec.containers[]\|select(.name == "vault")\|.resources'	kubectl -n vault get sts/vault -o yaml \ -o jsonpath='{.spec.template.spec.containers[?(@.name=="vault")].resources}' \| yq -P

Helm » Uninstall

Helm » Uninstall
helm -n vault status vault helm -n vault get all vault helm -n vault uninstall vault	kubectl -n vault delete pvc --all kubectl delete ns vault kubectl delete pv vault-data-vault-0

Vault » Install

curl -fsSL https://apt.releases.hashicorp.com/gpg\
 | sudo tee /etc/apt/keyrings/hashicorp.asc >/dev/null

DISTRIBUTION=$(. /etc/os-release && echo "${VERSION_CODENAME}")
cat << SRC | sudo tee /etc/apt/sources.list.d/hashicorp.list >/dev/null
deb [arch=$(dpkg --print-architecture)\
 signed-by=/etc/apt/keyrings/hashicorp.asc]\
 https://apt.releases.hashicorp.com ${DISTRIBUTION} main
SRC

cat <<'EXE' | sudo bash
apt-get update && apt-get install -y vault
systemctl disable --now vault.service
systemctl stop          vault.service
systemctl mask          vault.service
systemctl status        vault.service
vault version
which vault
EXE

export VAULT_TOKEN='hvs.40aTe1S58DWIstRk4bHPgESg'
export VAULT_ADDR='https://vault.shahed.biz.ops'
vault status

export VAULT_SKIP_VERIFY=true
export VAULT_FORMAT=yaml
vault login

Playground

Playground
helm -n vault install vault hashicorp/vault --version=0.30.1 helm -n vault upgrade -i vault hashicorp/vault --version=0.31.0 helm show values hashicorp/vault --version=0.31.0\|less
kubectl -n vault exec -it svc/vault -c vault -- bash kubectl -n vault logs -f svc/vault -c vault kubectl -n vault logs -f svc/vault
kubectl config --kubeconfig=${HOME}/.kube/aws-kubeconfig.yaml view --flatten kubectl config --kubeconfig=${HOME}/.kube/dev-kubeconfig.yaml view --flatten kubectl config --kubeconfig=${HOME}/.kube/gcp-kubeconfig.yaml view --flatten kubectl config --kubeconfig=${HOME}/.kube/config view --flatten
kubectl -n vault delete all --all kubectl -n vault delete ing --all kubectl -n vault delete sts --all	kubectl delete pv vault-data-vault-0 kubectl -n vault delete svc --all kubectl -n vault delete pvc --all
kubectl -n vault rollout history sts/vault kubectl -n vault rollout restart sts/vault kubectl -n vault rollout status sts/vault	kubectl -n vault exec -it svc/vault -c vault -- ash kubectl -n vault logs -f svc/vault -c vault kubectl -n vault logs -f svc/vault
sudo sh -c 'ls -alh /var/minikube/pvc/vault/data-vault-0/' sudo sh -c 'du -sh /var/minikube/pvc/vault/data-vault-0/' sudo sh -c 'du -sh /var/minikube/pvc/vault/*'

References

References
Helm » Pass YAML/JSON using `stdin` Helm » Prometheus Stack Helm » Cert Manager Helm » Harbor Helm » Pi-Hole Helm » Vault Helm	Vault » Docs » Secrets management Vault » Docs » Build your CA Vault » Docs » Monitoring Vault » Docs » How Vault » Docs » Why Vault » Install Vault
K8s » Configure Service Accounts for Pods K8s » Restart Pods With Kubectl K8s » Interactive Pod K8s » Restart Pods Docker » Makefile Kubernetes Minikube Kubectl CURL K8s	K8s » `kubectl rollout` K8s » CSI Hostpath Driver Security » Password K8s » Storage K8s » Ingress K8s » Service K8s » Run MinIO CIDR UFW	Bind9 » Authoritative DNS Server Bind9 » Secondary DNS Server Minikube » Ingress DNS Minikube » Systemd Minikube » MetalLB Minikube » Registry Minikube » Tunnel Localtunnel ZA Proxy

Vault » Rollout
kubectl -n vault annotate sts/vault --overwrite \ kubernetes.io/change-cause="CKI-1\| Initial Deployment"	kubectl -n vault rollout history sts/vault kubectl -n vault scale sts/vault --replicas=0
Vault » Rollout	Vault » Revert
cat <<'YML' \| \ kubectl -n vault patch sts/vault --patch-file=/dev/stdin --- spec: template: spec: containers: - name: vault resources: requests: memory: 128Mi cpu: 100m limits: memory: 256Mi cpu: 250m YML	cat <<'YML' \| \ kubectl -n vault patch sts/vault --patch-file=/dev/stdin --- spec: template: spec: containers: - name: vault resources: requests: memory: 256Mi cpu: 250m limits: memory: 512Mi cpu: 500m YML
kubectl -n vault annotate sts/vault --overwrite \ kubernetes.io/change-cause="CKI-2\| Resources Updated"	kubectl -n vault scale sts/vault --replicas=1 kubectl -n vault rollout history sts/vault
kubectl -n vault rollout undo sts/vault --to-revision=1 kubectl -n vault rollout history sts/vault	kubectl -n vault annotate sts/vault --overwrite \ kubernetes.io/change-cause="CKI-3\| Revert Back to CKI-1"
kubectl -n vault get sts/vault -o yaml \ \| yq -P '.spec.template.spec.containers[]\|select(.name == "vault")\|.resources'	kubectl -n vault get sts/vault -o yaml \ -o jsonpath='{.spec.template.spec.containers[?(@.name=="vault")].resources}' \| yq -P

Helm/Vault

Contents

Helm » Context

Helm » Install

Helm » Ingress

Helm » Config

Helm » Debug

Helm » Rollout

Helm » Uninstall

Vault » Install

Playground

References

Navigation menu

Helm/Vault

Helm » Context

Helm » Install

Helm » Ingress

Helm » Config

Helm » Debug

Helm » Rollout

Helm » Uninstall

Vault » Install

Playground

References

Navigation menu

Search