2019-08-05 21:15:28 +00:00
|
|
|
---
|
2020-01-18 00:18:09 +00:00
|
|
|
layout: docs
|
|
|
|
|
page_title: Kubernetes
|
|
|
|
|
sidebar_title: Kubernetes
|
|
|
|
|
description: This section documents the official integration between Vault and Kubernetes.
|
2019-08-05 21:15:28 +00:00
|
|
|
---
|
|
|
|
|
|
|
|
|
|
# Kubernetes
|
|
|
|
|
|
2020-03-30 21:35:08 +00:00
|
|
|
Vault can be deployed into Kubernetes using the official HashiCorp Vault Helm chart.
|
|
|
|
|
The Helm chart allows users to deploy Vault in various configurations:
|
2019-08-05 21:15:28 +00:00
|
|
|
|
2020-03-30 21:35:08 +00:00
|
|
|
- Dev: a single in-memory Vault server for testing Vault
|
|
|
|
|
- Standalone (default): a single Vault server persisting to a volume using the file storage backend
|
|
|
|
|
- High-Availability (HA): a cluster of Vault servers that use an HA storage backend such as Consul (default)
|
|
|
|
|
- External: a Vault Agent Injector server that depends on an external Vault server
|
2019-08-05 21:15:28 +00:00
|
|
|
|
|
|
|
|
## Use Cases
|
|
|
|
|
|
2020-03-30 21:35:08 +00:00
|
|
|
**Running a Vault Service:** The Vault server cluster can run directly on Kubernetes.
|
2020-01-18 00:18:09 +00:00
|
|
|
This can be used by applications running within Kubernetes as well as external to
|
2019-08-05 21:15:28 +00:00
|
|
|
Kubernetes, as long as they can communicate to the server via the network.
|
|
|
|
|
|
2020-01-18 00:18:09 +00:00
|
|
|
**Accessing and Storing Secrets:** Applications using the Vault service running in
|
|
|
|
|
Kubernetes can access and store secrets from Vault using a number of different
|
2019-08-05 21:15:28 +00:00
|
|
|
[secret engines](/docs/secrets) and [authentication methods](/docs/auth).
|
|
|
|
|
|
2020-01-18 00:18:09 +00:00
|
|
|
**Running a Highly Available Vault Service:** By using pod affinities, highly available
|
2020-01-22 20:05:41 +00:00
|
|
|
backend storage (such as Consul) and [auto-unseal](/docs/concepts/seal#auto-unseal),
|
2019-08-05 21:15:28 +00:00
|
|
|
Vault can become a highly available service in Kubernetes.
|
|
|
|
|
|
2020-01-18 00:18:09 +00:00
|
|
|
**Encryption as a Service:** Applications using the Vault service running in Kubernetes
|
|
|
|
|
can leverage the [Transit secret engine](/docs/secrets/transit)
|
|
|
|
|
as "encryption as a service". This allows applications to offload encryption needs
|
2019-10-07 15:53:17 +00:00
|
|
|
to Vault before storing data at rest.
|
2019-08-05 21:15:28 +00:00
|
|
|
|
2020-01-18 00:18:09 +00:00
|
|
|
**Audit Logs for Vault:** Operators can choose to attach a persistent volume
|
2019-08-05 21:15:28 +00:00
|
|
|
to the Vault cluster which can be used to [store audit logs](/docs/audit).
|
|
|
|
|
|
|
|
|
|
**And more!** Vault can run directly on Kubernetes, so in addition to the
|
|
|
|
|
native integrations provided by Vault itself, any other tool built for
|
|
|
|
|
Kubernetes can choose to leverage Vault.
|
