Vault installation

Overview #

HashiCorp Vault provides secure storage, and tight control over access to tokens, passwords, certificates, encryption keys for protecting secrets, and other sensitive data and makes them accessible via UI, CLI, or HTTP API.

Kosmos users can install Vault using Kosmos provided Vault AppTemplate. This relies on the publicly available vault-helm helm chart. When installing Vault in a target cluster, users can utilize this App. The AppTemplate allows you to provide configuration in three ways:

1. No configuration provided. This leads to using default values and install Vault in dev mode.

2. Configure parameters of your interest. This will override default values for those parameters.

3. Configure using parameter which accepts whole set of configurations as raw yaml (should abide to the schema by vault-helm chart values.yaml)

Prerequisites #

Before beginning the installation process, ensure the following requirements are met:

• Cluster Access

  • Fleet Cluster or
  • DevSpace vCluster access

• Namespace

  • When working with Fleets, you must create a namespace.
  • On vcluster, the namespace gets created automatically.

Installation process using CLI #

Step 1: Login to Kosmos #

Login to the Kosmos console using the CLI:

kosmos login console.kosmos.spcplatform.com --access-key <YOUR_ACCESS_KEY>

Example output:

Successfully logged into Kosmos instance https://console.kosmos.spcplatform.com

Verify the logged-in user:

kosmos get currentuser

Step 2: Verify existing Kosmos app #

List available application templates:

kosmos list apps

Ensure the vault app template exists.

Verify using:

kosmos get app --name vault

Example output:

NAME            DISPLAY NAME       DESCRIPTION
vault             Vault            Application template for installing Vault Helm chart.

Step 3: Check customizable parameters #

Retrieve configurable parameters for the application:

kosmos get app --name vault -o json | jq '[.spec.parameters[] | {variable: .variable, type: .type, description: .description}]'

For the list of parameters and configurable items, see below #

Step 4: Configure application parameters #

If none configurations are provided, Vault will install with default parameters. On the other extreme, to have a granular level of configuration, one can use vault_helm_values_raw to provide yaml, which is used verbatim as values.yaml

Example helm override #

global:
  enabled: true
  namespace: "vault"
  imagePullSecrets:
    - name: image-pull-secret
  tlsDisable: true
  psp:
    enable: false
    annotations: |
      seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default,runtime/default
      apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
      seccomp.security.alpha.kubernetes.io/defaultProfileName:  runtime/default
      apparmor.security.beta.kubernetes.io/defaultProfileName:  runtime/default
  serverTelemetry:
    prometheusOperator: false
  image:
    repository: "hashicorp/vault"
    tag: "1.21.2"
    pullPolicy: IfNotPresent
  updateStrategyType: "OnDelete"
  resources:
    requests:
      memory: 256Mi
      cpu: 250m
    limits:
      memory: 256Mi
      cpu: 250m

Create parameter file #

Create a parameter file with format parameter_variable1: <value1>\nparameter_variable2: <value2>\n

vault-params.yaml

Example1: The following example sets vault_helm_values_raw parameter, the multiline value will be used as helm chart values override.

vault_helm_values_raw: |-
  global:
    enabled: true
    namespace: vault
  server:
    standalone:
      enabled: true
    dataStorage:
      enabled: true
      size: 10Gi
      mountPath: "/vault/data"

Example 2: The following example overrides some of the values, and the unspecified will use default values.

server:
  enabled: true
  resources:
    requests:
      memory: 256Mi
      cpu: 250m
    limits:
      memory: 256Mi
      cpu: 250m

Step 5: Install the application #

Deploy the application using the Kosmos CLI:

kosmos install app \
  --name vault \
  --parameter-file vault-params.yaml \
  --release-name vault \
  --target-cluster mks-test-vault \
  --fleet qe-fleet \
  --target-namespace vault

Example output:

Successfully installed App 'vault'

Installation process using Kosmos Management Console #

Step 1: Access the Kosmos console #

Navigate to the Kosmos Management Console .

Log in with your credentials.

Step 2: Navigate to application #

Go to your selected cluster and click the App/Helm tab.

1. Click Install App
2. Find and select Vault from the template list

Step 3: Configure parameters #

1. Default Install: If one does not specify any parameters, the AppTemplate installs Vault helm chart with default values.
2. Partial Overrides: For a partial override of Vault values, use the specifics parameter input fields provided.
3. Full Override: If Kosmos user prefers to provide, the content for values.yaml, he can do so using vault_helm_values_raw parameter.

An example of configuring vault_helm_values_raw parameter is below:

Once installed, one should see Vault app installed in “Apps” tab

Parameter usage and configuration #

Vault consists of parameters required when installing the Vault through the Kosmos application.

Teardown and Cleanup #

When you would not require Vault in the target cluster, navigate to apps, select “Vault” installed app and click “uninstall”.

Successfully deleted Helm Release   {"component": "task-runner", "namespace": "vault", "name": "vault"}

Parameters #

Edit this page on GitHub