MVH

Appearance

HashiCorp Vault ​

In this blog post we'll dive into HashiCorp Vault. Vault is an extensive API for securely accessing & managing secrets.

I'll show you how to easily self-host your own vault instance. I'll also detail several integrations I've done with vault in the past.

If you're looking for a managed solution, you can use HashiCorp's Vault Cloud or other cloud providers like AWS, Azure, or GCP.

Setup ​

I'll be using the official container image. I will show you how to run it with:

Configuration ​

A full list of configuration options can be found in the official documentation.

I will share a minimal example below that should work with our example setups. Feel free to modify it to your needs.

hcl
ui            = true
api_addr      = "http://127.0.0.1:8200"
disable_mlock = true

storage "file" {
  path = "/vault/data"
}

listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_disable = true  # Disable TLS for local testing
}

Initialize, Unseal & Access Vault ​

Once the vault instance is running you'll want to initialize, unseal & access the vault. You may use the following commands to do so:

bash
sudo docker exec -it vault vault operator init
bash
kubectl exec -it vault -n vault -- vault operator init

IMPORTANT

This will generate unseal keys and a root token. Save these keys safely.

Run the following three times with the different generated keys:

bash
sudo docker exec -it vault vault operator unseal <your-unseal-key>
bash
kubectl exec -it vault -n vault -- vault operator unseal <your-unseal-key>

We can now use the root token to login:

bash
sudo docker exec -it vault vault login <your-root-token>
bash
kubectl exec -it vault -n vault -- vault login <your-root-token>

TODO

Reference ​

Integration with External Secrets Operator ​

TODO: only the kv provider is supported. This is enough for us. Create docs of our implementation