The Vault operator deploys and manages [Vault][vault] clusters on Kubernetes. Vault instances created by the Vault operator are highly available and support automatic failover and upgrade.
# CoreOS vault-operator
[vault-operator](https://coreos.com/blog/introducing-vault-operator-project) Simplify vault cluster configuration and management.
### Project status: beta
The basic features have been completed, and while no breaking API changes are currently planned, the API can change in a backwards incompatible way before the project is declared stable.
__DISCLAIMER:__ While this chart has been well-tested, the vault-operator is still currently in beta. Current project status is available [here](https://github.com/coreos/vault-operator).
## Configuration
Parameter | Description | Default
--------- | ----------- | -------
`rbac.create` | If true, create & use RBAC resources | `true`
`serviceAccounts.create` | If true, create the values-operator service account | `true`
`imagePullPolicy` | all containers image pull policy | `IfNotPresent`
`vaultOperator.replicaCount` | desired number of vault operator controller pod | `1`
`ui.service.name` | Vault UI service name | `vault-ui`
`ui.service.type` | type of ui service to create | `ClusterIP`
`ui.service.externalPort` | Vault UI service target port | `8000`
`ui.service.internalPort` | Vault UI container port | `8000`
`ui.service.nodePort` | Port to be used as the service NodePort (ignored if `server.service.type` is not `NodePort`) | `0`
## Using the Vault cluster
See the [Vault usage guide](https://github.com/coreos/vault-operator/blob/master/doc/user/vault.md) on how to initialize, unseal, and use the deployed Vault cluster.
Consult the [monitoring guide](https://github.com/coreos/vault-operator/blob/master/doc/user/monitoring.md) on how to monitor and alert on a Vault cluster with Prometheus.
See the [recovery guide](https://github.com/coreos/vault-operator/blob/master/doc/user/recovery.md) on how to backup and restore Vault cluster data using the etcd opeartor
For an overview of the default TLS configuration or how to specify custom TLS assets for a Vault cluster see the [TLS setup guide](https://github.com/coreos/vault-operator/blob/master/doc/user/tls_setup.md).
By default the chart will install the recommended RBAC roles and rolebindings.
To determine if your cluster supports this running the following:
```bash
$ kubectl api-versions | grep rbac
```
You also need to have the following parameter on the api server. See the following document for how to enable [RBAC](https://kubernetes.io/docs/admin/authorization/rbac/)
```bash
--authorization-mode=RBAC
```
If the output contains "beta" or both "alpha" and "beta" you can may install rbac by default, if not, you may turn RBAC off as described below.
### RBAC Role/RoleBinding Creation
RBAC resources are enabled by default. To disable RBAC do the following:
Run and manage Vault on Kubernetes simply and securely.
[vault-operator](https://github.com/coreos/vault-operator) Simplify vault cluster configuration and management.
__DISCLAIMER:__ While this chart has been well-tested, the vault-operator is still currently in beta. Current project status is available [here](https://github.com/coreos/vault-operator).
### Prerequisites
### Using the Vault cluster
See the [Vault usage guide](https://github.com/coreos/vault-operator/blob/master/doc/user/vault.md) on how to initialize, unseal, and use the deployed Vault cluster.
- Kubernetes 1.8+
Consult the [monitoring guide](https://github.com/coreos/vault-operator/blob/master/doc/user/monitoring.md) on how to monitor and alert on a Vault cluster with Prometheus.
See the [recovery guide](https://github.com/coreos/vault-operator/blob/master/doc/user/recovery.md) on how to backup and restore Vault cluster data using the etcd opeartor
For an overview of the default TLS configuration or how to specify custom TLS assets for a Vault cluster see the [TLS setup guide](https://github.com/coreos/vault-operator/blob/master/doc/user/tls_setup.md).
**Warning:**
Upgrade `vault-operator` from 0.1.2 to 0.1.3 is not supported, if you wish to use the newest version you will need to re-deploy the `vault-operator 0.1.3`.
__Note__: If you set `cluster.enabled` on install, it will have no effect.
Before you create an etcd cluster, the TPR must be installed by the operator, so this option is ignored during helm installs, but can be used in upgrades.
## Uninstalling the Chart
To uninstall/delete the `my-release` deployment:
```bash
$ helm delete my-release
```
The command removes all the Kubernetes components EXCEPT the persistent volume.
## Updating
Updating the TPR resource will not result in the cluster being update until `kubectl apply` for
TPRs is fixed see [kubernetes/issues/29542](https://github.com/kubernetes/kubernetes/issues/29542)
Work around options are documented [here](https://github.com/coreos/etcd-operator#resize-an-etcd-cluster)
## Configuration
The following table lists the configurable parameters of the etcd-operator chart and their default values.
By default the chart will install the recommended RBAC roles and rolebindings.
To determine if your cluster supports this running the following:
```console
$ kubectl api-versions | grep rbac
```
You also need to have the following parameter on the api server. See the following document for how to enable [RBAC](https://kubernetes.io/docs/admin/authorization/rbac/)
```
--authorization-mode=RBAC
```
If the output contains "beta" or both "alpha" and "beta" you can may install rbac by default, if not, you may turn RBAC off as described below.
### RBAC role/rolebinding creation
RBAC resources are enabled by default. To disable RBAC do the following:
[etcd-operator](https://coreos.com/blog/introducing-the-etcd-operator.html) Simplify etcd cluster configuration and management.
__DISCLAIMER:__ While this chart has been well-tested, the etcd-operator is still currently in beta. Current project status is available [here](https://github.com/coreos/etcd-operator).
## Introduction
This chart bootstraps an etcd-operator and allows the deployment of etcd-cluster(s).
### How to use it
With etcd-operator, users can now create a custom etcd cluster using custom resource definitions(CRDs) like EtcdCluster, EtcdBackup and EtcdRestore . e.g,
```YAML
apiVersion: etcd.database.coreos.com/v1beta2
kind: EtcdCluster
metadata:
name: "example-etcd-cluster"
## Adding this annotation make this cluster managed by clusterwide operators, namespaced operators ignore it
# annotations:
# etcd.database.coreos.com/scope: clusterwide
spec:
size: 3
version: "3.2.25"
```
For more details about CRD spec please refer to the [etcd-operator doc](https://github.com/coreos/etcd-operator/blob/master/doc/user/spec_examples.md).
[vault-operator](https://github.com/coreos/vault-operator) Simplify vault cluster configuration and management.
2. Open a new terminal.
__DISCLAIMER:__ While this chart has been well-tested, the vault-operator is still currently in beta. Current project status is available [here](https://github.com/coreos/vault-operator).
3. Export the following environment for Vault CLI environment:
```
export VAULT_ADDR='https://127.0.0.1:8200'
export VAULT_SKIP_VERIFY="true"
```
### Using the Vault cluster
4. Verify that the Vault server is accessible using the Vault CLI:
```
$vault status
See the [Vault usage guide](https://github.com/coreos/vault-operator/blob/master/doc/user/vault.md) on how to initialize, unseal, and use the deployed Vault cluster.
Error checking seal status: Error making API request.
Consult the [monitoring guide](https://github.com/coreos/vault-operator/blob/master/doc/user/monitoring.md) on how to monitor and alert on a Vault cluster with Prometheus.
URL: GET https://127.0.0.1:8200/v1/sys/seal-status
Code: 400. Errors:
See the [recovery guide](https://github.com/coreos/vault-operator/blob/master/doc/user/recovery.md) on how to backup and restore Vault cluster data using the etcd opeartor
* server is not yet initialized
```
5.Initialize the Vault server to generate the unseal keys and the root token. (https://www.vaultproject.io/intro/getting-started/deploy.html#initializing-the-vault)
Continue with vault unseal to complete unsealing the Vault, normally 3 keys out of 5 unseal keys.
For an overview of the default TLS configuration or how to specify custom TLS assets for a Vault cluster see the [TLS setup guide](https://github.com/coreos/vault-operator/blob/master/doc/user/tls_setup.md).
