hashicorp / vault-secrets-operator

The Vault Secrets Operator (VSO) allows Pods to consume Vault secrets natively from Kubernetes Secrets.
https://hashicorp.com
Other
471 stars 102 forks source link

Add documentation for production use #933

Open maggie44 opened 1 month ago

maggie44 commented 1 month ago

The only reference I can find to using this operator is the tutorial: https://developer.hashicorp.com/vault/docs/platform/k8s/vso

I'm not looking for a tutorial, but deployment documentation for connecting to the Hasicorp Vault Cloud. I do not want to use Minikube for testing, nor do I need a learn-vault-secrets-operator repo to learn operator.

Instead I am looking for documentation to use operator. What does this do:

vault write auth/demo-auth-mount/config \
   kubernetes_host="https://$KUBERNETES_PORT_443_TCP_ADDR:443"

Is it persistent? Why from inside a container? Why demo-auth-mount? I am not looking for a demo.

vault kv put kvv2/webapp/config username="static-user" password="static-password"

I do not need to create secrets, I have secrets already.

In production you do not want default_ttl="1m" or max_ttl="1m" set. This is too short and a longer TTL should be used. It is only done this way in this tutorial for demonstration purposes.

☝️ Ok, but then where is the production deployment documentation?

In short, there is a big difference between 'tutorial' and 'documentation'. I am looking for documentation to be able to deploy operator and use it in production so logging this here as a feature request.