Vault Deployed in K8s with S3 storage and TLS_Enabled

Vault
,
1

Here I want to deploy S3 in k8s cluster with manual approach instead of Helm. But Meet some error here.
NAME READY STATUS RESTARTS AGE
vault-569865f876-mhtjm 0/1 CrashLoopBackOff 505 (35s ago) 42h

This is my deployment :
apiVersion: apps/v1
kind: Deployment
metadata:
name: vault
namespace: vault
spec:
replicas: 3
selector:
matchLabels:
app: vault
template:
metadata:
labels:
app: vault
spec:
serviceAccountName: vault-auth
containers:
- command:
- /bin/sh
name: vault
image: 162618157205.dkr.ecr.eu-west-1.amazonaws.com/gccc-secret-manager-imagerepo:v0.0.31
imagePullPolicy: IfNotPresent
lifecycle:
preStop:
exec:
command:
- /bin/sh
- -c
- sleep 5 && kill -SIGTERM (pidof vault) ports: - containerPort: 8200 name: vault-api - containerPort: 8201 name: vault-cluster readinessProbe: exec: command: - /bin/sh - -ec - vault status -tls-skip-verify failureThreshold: 2 initialDelaySeconds: 5 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 3 securityContext: allowPrivilegeEscalation: false capabilities: add: ["IPC_LOCK"] terminationMessagePath: /dev/termination-log terminationMessagePolicy: File env: - name: SKIP_CHOWN value: "true" - name: SKIP_SETCAP value: "true" - name: VAULT_K8S_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: HOST_IP valueFrom: fieldRef: fieldPath: status.hostIP - name: POD_IP valueFrom: fieldRef: fieldPath: status.podIP - name: VAULT_K8S_POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: HOSTNAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: VAULT_CLUSTER_ADDR value: https://(HOSTNAME).vault-internal:8201
resources:
requests:
memory: “512Mi”
cpu: “250m”
limits:
memory: “1Gi”
cpu: “500m”
volumeMounts:
- name: config
mountPath: /vault/config
readOnly: true
dnsPolicy: ClusterFirst
schedulerName: default-scheduler
securityContext:
fsGroup: 1000
runAsGroup: 1000
runAsNonRoot: true
runAsUser: 100
volumes:
- name: config
configMap:
name: vault-config

How can I deploy vault in K8s cluster without Helm

2

This is my config hcl:
listener “tcp” {
address = “[::]:8200”
cluster_address = “[::]:8201”
tls_disable = “true”
}

storage “s3” {
bucket = “secret-s3-bucket-demo”
region = “eu-west-1”
access_key = “your-access-key”
secret_key = “your-secret-key”
}

service_registration “kubernetes” {
namespace = “vault” # 设置命名空间
}

ui = true
disable_mlock = true
api_addr = “http://${POD_IP}:8200”
cluster_addr = “http://${POD_IP}:8201”

3

This is my docker file:
FROM hashicorp/vault:1.18.2

WORKDIR /vault

RUN apk add --no-cache jq

COPY vault-config.hcl /vault/config/config.hcl

COPY init-vault.sh /vault/init-vault.sh

Ensure the init-vault.sh script is executable

RUN chmod +x /vault/init-vault.sh

#ENTRYPOINT [“sh”, “/vault/init-vault.sh”]

4

I would suggest testing if you can bring up your Vault container manually - if it comes up then we can focus on your deployment file, if it doesnt start as expected just running the container then it is likely a problem with your install.