Dear Hashicorp Vault Team, Hope you are doing well. Thank you for your support.
I am trying to install Vault in standalone mode in Kubernetes using Helm and creating vault-pod on a particular node using nodeSelector option. Now, I understand that to have persistent storage, one of the options is to create a Persistent Volume Claim.
However, what if I required persistent storage on a particular node. For instance, vault folder on the host that gets mounted automatically to the pod.
The reason behind this is … Currently, we are using Rook CEPH to setup up storage class and PVC and we later want to encrypt the CEPH OSD using the keys stored in Vault to provide encryption at rest.
Now, if we create a PVC using Rook CEPH storageclass that stores the PVC for vault and encrypt it using the same keys. That would probably go wrong somewhere.
Hence, we want to create a node specifically for vault, join that node as a worker node and schedule vault pods on that using nodeSelector. Also, the above setup is on a Bare-Metal cluster rather than a cloud. Hence, we require a persistent storage on the host.
Creating two CEPH-rook clusters … one for OSD for storing the vault PVC and one for all the other data (that we want to encrypt) is kinda overkill.
Would appreciate the suggestions. Thank You 