Skip to content

Fix Vault Documentation #105

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Mar 1, 2024
Merged

Fix Vault Documentation #105

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 14 additions & 4 deletions docs/vault.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,11 +43,21 @@ vault-agent-injector-7f9f668fd5-wk7tm 1/1 Running 0 55s
### Initialize Vault

``` shell
kubectl exec vault-0 -n vault -- vault operator init -key-shares=5 -key-threshold=3 -format=json > cluster-keys.json
kubectl exec vault-0 -n vault -- vault operator init -key-shares=3 -key-threshold=2 -format=json > cluster-keys.json
```

This command provides unseal keys and a root token in cluster-keys.json. Keep this information secure.


### Unseal Vault(vault-0)

On vault-0 pod, use any of the 2 unseal keys obtained during initialization:
``` shell
kubectl exec -it vault-0 -n vault -- sh
vault operator unseal
```
Repeat the unseal command as needed with different unseal keys.

### Join Vault Pods to Form a Cluster

``` shell
Expand All @@ -60,9 +70,9 @@ kubectl exec -it vault-2 -n vault -- sh
vault operator raft join -leader-ca-cert=@/vault/userconfig/vault-server-tls/ca.crt https://vault-0.vault-internal:8200
```

### Unseal Vault
### Unseal Vault(vault-1, vault-2)

On each Vault pod (vault-0, vault-1, vault-2), use any of the 3 unseal keys obtained during initialization:
On each Vault pod (vault-1, vault-2), use any of the 2 unseal keys obtained during initialization:
``` shell
kubectl exec -it vault-1 -n vault -- sh
vault operator unseal
Expand All @@ -75,7 +85,7 @@ Repeat the unseal command as needed with different unseal keys.
Use the root token obtained during initialization to authenticate:

``` shell
kubectl exec -it vault-0 -- vault login
kubectl exec -it vault-0 -n vault -- vault login
```

## Validation
Expand Down