search

coreos / vault-operator

Run and manage Vault on Kubernetes simply and securely
https://coreos.com/blog/introducing-vault-operator-project
Apache License 2.0
758 stars 110 forks source link

Vault as statefulset #323

Open thereallukl opened 6 years ago

thereallukl commented 6 years ago

I'm working on automated deployment of vault with operator. What I noticed is that the operator is setting instances as deployment. It makes unsealing particular instances a bit troublesome (I need to check k8s API for IP of particular instance and then connect to it. I believe migrating to statefulset with known DNS names for each instance would make automated unsealing much easier. What do you think about?

Thanks.

thereallukl commented 6 years ago

Small update for automated unsealing. I had to implement unsealing quickly, so I prototyped a solution with sidecar container[1]. It assumes IAM roles [2] are set for nodes running vault cluster.

[1] https://github.com/coreos/vault-operator/compare/master...lleszczu:add_unsealer?expand=1 [2] https://github.com/jetstack/vault-unsealer/pull/9/files

raoofm commented 6 years ago

@hasbro17 @philips vault-unsealer seems like a good option for #307 and #308