Can vault-helm postStart script only be executed in vault-0 pod?

razahuss02 · October 13, 2022, 2:10am

hashicorp/vault-helm/blob/main/values.yaml#L497


      
          # Optional duration in seconds the pod needs to terminate gracefully.
          # See: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
          terminationGracePeriodSeconds: 10
          
          
# Used to set the sleep time during the preStop step
          preStopSleepSeconds: 5
          
          
# Used to define commands to run after the pod is ready.
          # This can be used to automate processes such as initialization
          # or boostrapping auth methods.
          postStart: []
          # - /bin/sh
          # - -c
          # - /vault/userconfig/myscript/run.sh
          
          
# extraEnvironmentVars is a list of extra environment variables to set with the stateful set. These could be
          # used to include variables required for auto-unseal.
          extraEnvironmentVars: {}
            # GOOGLE_REGION: global
            # GOOGLE_PROJECT: myproject
            # GOOGLE_APPLICATION_CREDENTIALS: /vault/userconfig/myproject/myproject-creds.json

I have a postStart script that runs
vault operator init and vault operator unseal but the behavior is that each pod goes through this process. Can I limit it to just vault-0 pod executes this script, so that the other pods can join the raft cluster after the initial init and unseal?

Is there any good examples of post vault automation?

lou.hill · February 21, 2023, 4:30pm

I have this same question. I can’t even get my postStart script to run. I’d love to know how this functions in relation to several pods in a replicaset.