docs: add vault helm enterprise examples (#8678)
* docs: add vault helm enterprise examples * Update website/pages/docs/platform/k8s/helm/examples/enterprise-dr-with-raft.mdx Co-Authored-By: Theron Voran <tvoran@users.noreply.github.com> * Update website/pages/docs/platform/k8s/helm/examples/enterprise-dr-with-raft.mdx Co-Authored-By: Theron Voran <tvoran@users.noreply.github.com> * Update website/pages/docs/platform/k8s/helm/examples/enterprise-perf-with-raft.mdx Co-Authored-By: Theron Voran <tvoran@users.noreply.github.com> * Update website/pages/docs/platform/k8s/helm/examples/enterprise-perf-with-raft.mdx Co-Authored-By: Theron Voran <tvoran@users.noreply.github.com> * Update website/pages/docs/platform/k8s/helm/examples/enterprise-with-raft.mdx Co-Authored-By: Theron Voran <tvoran@users.noreply.github.com> * Update website/pages/docs/platform/k8s/helm/examples/enterprise-perf-with-raft.mdx Co-Authored-By: Theron Voran <tvoran@users.noreply.github.com> * Update website/pages/docs/platform/k8s/helm/examples/enterprise-with-raft.mdx Co-Authored-By: Theron Voran <tvoran@users.noreply.github.com> * Update website/pages/docs/platform/k8s/helm/examples/enterprise-dr-with-raft.mdx Co-Authored-By: Theron Voran <tvoran@users.noreply.github.com> * Fix website build * Shorten sidebar titles * Update website/pages/docs/platform/k8s/helm/examples/enterprise-dr-with-raft.mdx Co-Authored-By: Theron Voran <tvoran@users.noreply.github.com> * Update website/pages/docs/platform/k8s/helm/examples/enterprise-perf-with-raft.mdx Co-Authored-By: Theron Voran <tvoran@users.noreply.github.com> * Fix sidebar * Fix sidebar titles Co-authored-by: Theron Voran <tvoran@users.noreply.github.com>
This commit is contained in:
Jason O'Donnell
GitHub
parent
2e11a1cfe5
commit
ffb66ebc83
|
|
@ -324,9 +324,13 @@ export default [
|
|||
'standalone-load-balanced-ui',
|
||||
'standalone-tls',
|
||||
'standalone-audit',
|
||||
'ha-with-consul',
|
||||
'external',
|
||||
'kubernetes-auth',
|
||||
'ha-with-consul',
|
||||
'ha-with-raft',
|
||||
'enterprise-with-raft',
|
||||
'enterprise-dr-with-raft',
|
||||
'enterprise-perf-with-raft',
|
||||
'enterprise-best-practice'
|
||||
]
|
||||
},
|
||||
|
|
|
|||
|
|
@ -393,6 +393,16 @@ and consider if they're appropriate for your deployment.
|
|||
- `enabled` (`boolean: false`) -
|
||||
Enables `ha` mode for the Vault server. This mode uses a highly available backend storage (such as Consul) to store Vault's data. By default this is configured to use [Consul Helm](https://github.com/hashicorp/consul-helm). For a complete list of storage backends, see the [Vault documentation](/docs/configuration).
|
||||
|
||||
- `raft` - This configures `raft` integrated storage mode for the Vault server.
|
||||
|
||||
- `enabled` (`boolean: false`) -
|
||||
Enables `raft` integrated storage mode for the Vault server. This mode uses persistent volumes for storage.
|
||||
|
||||
- `config` (`string: "{}"`) -
|
||||
A raw string of extra HCL or JSON [configuration](/docs/configuration) for Vault servers.
|
||||
This will be saved as-is into a ConfigMap that is read by the Vault servers.
|
||||
This can be used to add additional configuration that isn't directly exposed by the chart.
|
||||
|
||||
- `replicas` (`int: 5`) -
|
||||
The number of pods to deploy to create a highly available cluster of Vault servers.
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,193 @@
|
|||
---
|
||||
layout: "docs"
|
||||
page_title: "Highly Available Vault Enterprise Disaster Recovery Clusters with Raft"
|
||||
sidebar_current: "docs-platform-k8s-examples-enterprise-dr-with-raft"
|
||||
sidebar_title: "HA Enterprise DR Clusters with Raft"
|
||||
description: |-
|
||||
Describes how to set up Diaster Recovery clusters with Integrated Storage (Raft)
|
||||
---
|
||||
|
||||
# Highly Available Vault Enterprise Disaster Recovery Clusters with Integrated Storage (Raft)
|
||||
|
||||
~> **Important Note:** This chart is not compatible with Helm 2. Please use Helm 3 with this chart.
|
||||
|
||||
The following is an example of creating a disaster recovery cluster using Vault Helm.
|
||||
|
||||
For more information on Disaster Recovery, [see the official documentation](docs/enterprise/replication/).
|
||||
|
||||
## Primary Cluster
|
||||
|
||||
First, create the primary cluster:
|
||||
|
||||
```shell
|
||||
helm install vault-primary \
|
||||
--set='server.image.repository=hashicorp/vault-enterprise' \
|
||||
--set='server.image.tag=1.4.0_ent' \
|
||||
--set='server.ha.enabled=true' \
|
||||
--set='server.ha.raft.enabled=true' \
|
||||
https://github.com/hashicorp/vault-helm/archive/v0.5.0.tar.gz
|
||||
```
|
||||
|
||||
Next, initialize and unseal `vault-primary-0` pod:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-primary-0 -- vault operator init
|
||||
kubectl exec -ti vault-primary-0 -- vault operator unseal
|
||||
```
|
||||
|
||||
Finally, join the remaining pods to the Raft cluster and unseal them. The pods
|
||||
will need to communicate directly so we'll configure the pods to use the internal
|
||||
service provided by the Helm chart:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-primary-1 -- vault operator raft join http://vault-primary-0.vault-primary-internal:8200
|
||||
kubectl exec -ti vault-primary-1 -- vault operator unseal
|
||||
|
||||
kubectl exec -ti vault-primary-2 -- vault operator raft join http://vault-primary-0.vault-primary-internal:8200
|
||||
kubectl exec -ti vault-primary-2 -- vault operator unseal
|
||||
```
|
||||
|
||||
To verify if the Raft cluster has successfully been initialized, run the following.
|
||||
|
||||
First, login using the `root` token on the `vault-primary-0` pod:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-primary-0 -- vault login
|
||||
```
|
||||
|
||||
Next, list all the raft peers:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-primary-0 -- vault operator raft list-peers
|
||||
|
||||
Node Address State Voter
|
||||
---- ------- ----- -----
|
||||
a1799962-8711-7f28-23f0-cea05c8a527d vault-primary-0.vault-primary-internal:8201 leader true
|
||||
e6876c97-aaaa-a92e-b99a-0aafab105745 vault-primary-1.vault-primary-internal:8201 follower true
|
||||
4b5d7383-ff31-44df-e008-6a606828823b vault-primary-2.vault-primary-internal:8201 follower true
|
||||
```
|
||||
|
||||
## Secondary Cluster
|
||||
|
||||
With the primary cluster created, next create a secondary cluster and enable
|
||||
disaster recovery replication.
|
||||
|
||||
```shell
|
||||
helm install vault-secondary \
|
||||
--set='server.image.repository=hashicorp/vault-enterprise' \
|
||||
--set='server.image.tag=1.4.0_ent' \
|
||||
--set='server.ha.enabled=true' \
|
||||
--set='server.ha.raft.enabled=true' \
|
||||
https://github.com/hashicorp/vault-helm/archive/v0.5.0.tar.gz
|
||||
```
|
||||
|
||||
Next, initialize and unseal `vault-secondary-0` pod:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-secondary-0 -- vault operator init
|
||||
kubectl exec -ti vault-secondary-0 -- vault operator unseal
|
||||
```
|
||||
|
||||
Finally, join the remaining pods to the Raft cluster and unseal them. The pods
|
||||
will need to communicate directly so we'll configure the pods to use the internal
|
||||
service provided by the Helm chart:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-secondary-1 -- vault operator raft join http://vault-secondary-0.vault-secondary-internal:8200
|
||||
kubectl exec -ti vault-secondary-1 -- vault operator unseal
|
||||
|
||||
kubectl exec -ti vault-secondary-2 -- vault operator raft join http://vault-secondary-0.vault-secondary-internal:8200
|
||||
kubectl exec -ti vault-secondary-2 -- vault operator unseal
|
||||
```
|
||||
|
||||
To verify if the Raft cluster has successfully been initialized, run the following.
|
||||
|
||||
First, login using the `root` token on the `vault-secondary-0` pod:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-secondary-0 -- vault login
|
||||
```
|
||||
|
||||
Next, list all the raft peers:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-secondary-0 -- vault operator raft list-peers
|
||||
|
||||
Node Address State Voter
|
||||
---- ------- ----- -----
|
||||
a1799962-8711-7f28-23f0-cea05c8a527d vault-secondary-0.vault-secondary-internal:8201 leader true
|
||||
e6876c97-aaaa-a92e-b99a-0aafab105745 vault-secondary-1.vault-secondary-internal:8201 follower true
|
||||
4b5d7383-ff31-44df-e008-6a606828823b vault-secondary-2.vault-secondary-internal:8201 follower true
|
||||
```
|
||||
|
||||
## Enable Disaster Recovery Replication On Primary
|
||||
|
||||
With the initial clusters setup, we can now configure them for disaster recovery replication.
|
||||
|
||||
First, on the primary cluster, enable replication:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-primary-0 -- vault write -f sys/replication/dr/primary/enable primary_cluster_addr=https://vault-primary-active:8201
|
||||
```
|
||||
|
||||
Next, create a token the secondary cluster will use to configure replication:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-primary-0 -- vault write sys/replication/dr/primary/secondary-token id=secondary
|
||||
```
|
||||
|
||||
The token in the output will be used when configuring the secondary cluster.
|
||||
|
||||
## Enable Disaster Recovery Replication On Secondary
|
||||
|
||||
Using the token created in the last step, enable disaster recovery replication on the secondary:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-secondary-0 -- vault write sys/replication/dr/secondary/enable token=<TOKEN FROM PRIMARY>
|
||||
```
|
||||
|
||||
Last, delete the remainder secondary pods and unseal them using the primary unseal token
|
||||
after Kubernetes reschedules them:
|
||||
|
||||
```shell
|
||||
kubectl delete pod vault-secondary-1
|
||||
kubectl exec -ti vault-secondary-1 -- vault operator unseal <PRIMARY UNSEAL TOKEN>
|
||||
|
||||
kubectl delete pod vault-secondary-2
|
||||
kubectl exec -ti vault-secondary-2 -- vault operator unseal <PRIMARY UNSEAL TOKEN>
|
||||
```
|
||||
|
||||
## Add License to Vault Enterprise
|
||||
|
||||
First, setup a port-forward tunnel to the Vault Enterprise cluster:
|
||||
|
||||
```shell
|
||||
kubectl port-forward vault-primary-0 8200:8200
|
||||
```
|
||||
|
||||
Next, in a separate terminal, create a `payload.json` file that contains the license key like this example:
|
||||
|
||||
```json
|
||||
{
|
||||
"text": "01ABCDEFG..."
|
||||
}
|
||||
```
|
||||
|
||||
Finally, using curl, apply the license key to the Vault API:
|
||||
|
||||
```bash
|
||||
curl \
|
||||
--header "X-Vault-Token: VAULT_LOGIN_TOKEN_HERE" \
|
||||
--request PUT \
|
||||
--data @payload.json \
|
||||
http://127.0.0.1:8200/v1/sys/license
|
||||
|
||||
```
|
||||
|
||||
To verify that the license installation worked correctly, using `curl`, run the following:
|
||||
|
||||
```shell
|
||||
curl \
|
||||
--header "X-Vault-Token: VAULT_LOGIN_TOKEN_HERE" \
|
||||
http://127.0.0.1:8200/v1/sys/license
|
||||
```
|
||||
|
|
@ -0,0 +1,192 @@
|
|||
---
|
||||
layout: "docs"
|
||||
page_title: "Highly Available Vault Enterprise Performance Clusters with Raft"
|
||||
sidebar_current: "docs-platform-k8s-examples-enterprise-perf-with-raft"
|
||||
sidebar_title: "HA Enterprise Performance Clusters with Raft"
|
||||
description: |-
|
||||
Describes how to set up Performance clusters with Integrated Storage (Raft)
|
||||
---
|
||||
|
||||
# Highly Available Vault Enterprise Performance Clusters with Integrated Storage (Raft)
|
||||
|
||||
~> **Important Note:** This chart is not compatible with Helm 2. Please use Helm 3 with this chart.
|
||||
|
||||
The following is an example of creating a performance cluster using Vault Helm.
|
||||
|
||||
For more information on Disaster Recovery, [see the official documentation](docs/enterprise/replication/).
|
||||
|
||||
## Primary Cluster
|
||||
|
||||
First, create the primary cluster:
|
||||
|
||||
```shell
|
||||
helm install vault-primary \
|
||||
--set='server.image.repository=hashicorp/vault-enterprise' \
|
||||
--set='server.image.tag=1.4.0_ent' \
|
||||
--set='server.ha.enabled=true' \
|
||||
--set='server.ha.raft.enabled=true' \
|
||||
https://github.com/hashicorp/vault-helm/archive/v0.5.0.tar.gz
|
||||
```
|
||||
|
||||
Next, initialize and unseal `vault-primary-0` pod:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-primary-0 -- vault operator init
|
||||
kubectl exec -ti vault-primary-0 -- vault operator unseal
|
||||
```
|
||||
|
||||
Finally, join the remaining pods to the Raft cluster and unseal them. The pods
|
||||
will need to communicate directly so we'll configure the pods to use the internal
|
||||
service provided by the Helm chart:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-primary-1 -- vault operator raft join http://vault-primary-0.vault-primary-internal:8200
|
||||
kubectl exec -ti vault-primary-1 -- vault operator unseal
|
||||
|
||||
kubectl exec -ti vault-primary-2 -- vault operator raft join http://vault-primary-0.vault-primary-internal:8200
|
||||
kubectl exec -ti vault-primary-2 -- vault operator unseal
|
||||
```
|
||||
|
||||
To verify if the Raft cluster has successfully been initialized, run the following.
|
||||
|
||||
First, login using the `root` token on the `vault-primary-0` pod:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-primary-0 -- vault login
|
||||
```
|
||||
|
||||
Next, list all the raft peers:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-primary-0 -- vault operator raft list-peers
|
||||
|
||||
Node Address State Voter
|
||||
---- ------- ----- -----
|
||||
a1799962-8711-7f28-23f0-cea05c8a527d vault-primary-0.vault-primary-internal:8201 leader true
|
||||
e6876c97-aaaa-a92e-b99a-0aafab105745 vault-primary-1.vault-primary-internal:8201 follower true
|
||||
4b5d7383-ff31-44df-e008-6a606828823b vault-primary-2.vault-primary-internal:8201 follower true
|
||||
```
|
||||
|
||||
## Secondary Cluster
|
||||
|
||||
With the primary cluster created, next create a secondary cluster.
|
||||
|
||||
```shell
|
||||
helm install vault-secondary \
|
||||
--set='server.image.repository=hashicorp/vault-enterprise' \
|
||||
--set='server.image.tag=1.4.0_ent' \
|
||||
--set='server.ha.enabled=true' \
|
||||
--set='server.ha.raft.enabled=true' \
|
||||
https://github.com/hashicorp/vault-helm/archive/v0.5.0.tar.gz
|
||||
```
|
||||
|
||||
Next, initialize and unseal `vault-secondary-0` pod:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-secondary-0 -- vault operator init
|
||||
kubectl exec -ti vault-secondary-0 -- vault operator unseal
|
||||
```
|
||||
|
||||
Finally, join the remaining pods to the Raft cluster and unseal them. The pods
|
||||
will need to communicate directly so we'll configure the pods to use the internal
|
||||
service provided by the Helm chart:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-secondary-1 -- vault operator raft join http://vault-secondary-0.vault-secondary-internal:8200
|
||||
kubectl exec -ti vault-secondary-1 -- vault operator unseal
|
||||
|
||||
kubectl exec -ti vault-secondary-2 -- vault operator raft join http://vault-secondary-0.vault-secondary-internal:8200
|
||||
kubectl exec -ti vault-secondary-2 -- vault operator unseal
|
||||
```
|
||||
|
||||
To verify if the Raft cluster has successfully been initialized, run the following.
|
||||
|
||||
First, login using the `root` token on the `vault-secondary-0` pod:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-secondary-0 -- vault login
|
||||
```
|
||||
|
||||
Next, list all the raft peers:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-secondary-0 -- vault operator raft list-peers
|
||||
|
||||
Node Address State Voter
|
||||
---- ------- ----- -----
|
||||
a1799962-8711-7f28-23f0-cea05c8a527d vault-secondary-0.vault-secondary-internal:8201 leader true
|
||||
e6876c97-aaaa-a92e-b99a-0aafab105745 vault-secondary-1.vault-secondary-internal:8201 follower true
|
||||
4b5d7383-ff31-44df-e008-6a606828823b vault-secondary-2.vault-secondary-internal:8201 follower true
|
||||
```
|
||||
|
||||
## Enable Performance Replication On Primary
|
||||
|
||||
With the initial clusters setup, we can now configure them for performance replication.
|
||||
|
||||
First, on the primary cluster, enable replication:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-primary-0 -- vault write -f sys/replication/performance/primary/enable primary_cluster_addr=https://vault-primary-active:8201
|
||||
```
|
||||
|
||||
Next, create a token the secondary cluster will use to configure replication:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-primary-0 -- vault write sys/replication/performance/primary/secondary-token id=secondary
|
||||
```
|
||||
|
||||
The token in the output will be used when configuring the secondary cluster.
|
||||
|
||||
## Enable Performance Replication On Secondary
|
||||
|
||||
Using the token created in the last step, enable performance replication on the secondary:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-secondary-0 -- vault write sys/replication/performance/secondary/enable token=<TOKEN FROM PRIMARY>
|
||||
```
|
||||
|
||||
Last, delete the remainder secondary pods and unseal them using the primary unseal token
|
||||
after Kubernetes reschedules them:
|
||||
|
||||
```shell
|
||||
kubectl delete pod vault-secondary-1
|
||||
kubectl exec -ti vault-secondary-1 -- vault operator unseal <PRIMARY UNSEAL TOKEN>
|
||||
|
||||
kubectl delete pod vault-secondary-2
|
||||
kubectl exec -ti vault-secondary-2 -- vault operator unseal <PRIMARY UNSEAL TOKEN>
|
||||
```
|
||||
|
||||
## Add License to Vault Enterprise
|
||||
|
||||
First, setup a port-forward tunnel to the Vault Enterprise cluster:
|
||||
|
||||
```shell
|
||||
kubectl port-forward vault-primary-0 8200:8200
|
||||
```
|
||||
|
||||
Next, in a separate terminal, create a `payload.json` file that contains the license key like this example:
|
||||
|
||||
```json
|
||||
{
|
||||
"text": "01ABCDEFG..."
|
||||
}
|
||||
```
|
||||
|
||||
Finally, using curl, apply the license key to the Vault API:
|
||||
|
||||
```bash
|
||||
curl \
|
||||
--header "X-Vault-Token: VAULT_LOGIN_TOKEN_HERE" \
|
||||
--request PUT \
|
||||
--data @payload.json \
|
||||
http://127.0.0.1:8200/v1/sys/license
|
||||
|
||||
```
|
||||
|
||||
To verify that the license installation worked correctly, using `curl`, run the following:
|
||||
|
||||
```shell
|
||||
curl \
|
||||
--header "X-Vault-Token: VAULT_LOGIN_TOKEN_HERE" \
|
||||
http://127.0.0.1:8200/v1/sys/license
|
||||
```
|
||||
|
|
@ -0,0 +1,97 @@
|
|||
---
|
||||
layout: "docs"
|
||||
page_title: "Highly Available Vault Enterprise Cluster with Raft"
|
||||
sidebar_current: "docs-platform-k8s-examples-enterprise-with-raft"
|
||||
sidebar_title: "HA Enterprise Cluster with Raft"
|
||||
description: |-
|
||||
Describes how to set up a highly available Vault Enterprise cluster with Integrated Storage (Raft)
|
||||
---
|
||||
|
||||
# Highly Available Vault Enterprise Cluster with Integrated Storage (Raft)
|
||||
|
||||
~> **Important Note:** This chart is not compatible with Helm 2. Please use Helm 3 with this chart.
|
||||
|
||||
Integrated storage (raft) can be enabled using the `server.ha.raft.enabled` value:
|
||||
|
||||
```shell
|
||||
helm install vault \
|
||||
--set='server.image.repository=hashicorp/vault-enterprise' \
|
||||
--set='server.image.tag=1.4.0_ent' \
|
||||
--set='server.ha.enabled=true' \
|
||||
--set='server.ha.raft.enabled=true' \
|
||||
https://github.com/hashicorp/vault-helm/archive/v0.5.0.tar.gz
|
||||
```
|
||||
|
||||
Next, initialize and unseal `vault-0` pod:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-0 -- vault operator init
|
||||
kubectl exec -ti vault-0 -- vault operator unseal
|
||||
```
|
||||
|
||||
Finally, join the remaining pods to the Raft cluster and unseal them. The pods
|
||||
will need to communicate directly so we'll configure the pods to use the internal
|
||||
service provided by the Helm chart:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-1 -- vault operator raft join http://vault-0.vault-internal:8200
|
||||
kubectl exec -ti vault-1 -- vault operator unseal
|
||||
|
||||
kubectl exec -ti vault-2 -- vault operator raft join http://vault-0.vault-internal:8200
|
||||
kubectl exec -ti vault-2 -- vault operator unseal
|
||||
```
|
||||
|
||||
To verify if the Raft cluster has successfully been initialized, run the following.
|
||||
|
||||
First, login using the `root` token on the `vault-0` pod:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-0 -- vault login
|
||||
```
|
||||
|
||||
Next, list all the raft peers:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-0 -- vault operator raft list-peers
|
||||
|
||||
Node Address State Voter
|
||||
---- ------- ----- -----
|
||||
a1799962-8711-7f28-23f0-cea05c8a527d vault-0.vault-internal:8201 leader true
|
||||
e6876c97-aaaa-a92e-b99a-0aafab105745 vault-1.vault-internal:8201 follower true
|
||||
4b5d7383-ff31-44df-e008-6a606828823b vault-2.vault-internal:8201 follower true
|
||||
```
|
||||
|
||||
## Add License to Vault Enterprise
|
||||
|
||||
First, setup a port-forward tunnel to the Vault Enterprise cluster:
|
||||
|
||||
```shell
|
||||
kubectl port-forward vault-0 8200:8200
|
||||
```
|
||||
|
||||
Next, in a separate terminal, create a `payload.json` file that contains the license key like this example:
|
||||
|
||||
```json
|
||||
{
|
||||
"text": "01ABCDEFG..."
|
||||
}
|
||||
```
|
||||
|
||||
Finally, using curl, apply the license key to the Vault API:
|
||||
|
||||
```bash
|
||||
curl \
|
||||
--header "X-Vault-Token: VAULT_LOGIN_TOKEN_HERE" \
|
||||
--request PUT \
|
||||
--data @payload.json \
|
||||
http://127.0.0.1:8200/v1/sys/license
|
||||
|
||||
```
|
||||
|
||||
To verify that the license installation worked correctly, using `curl`, run the following:
|
||||
|
||||
```shell
|
||||
curl \
|
||||
--header "X-Vault-Token: VAULT_LOGIN_TOKEN_HERE" \
|
||||
http://127.0.0.1:8200/v1/sys/license
|
||||
```
|
||||
|
|
@ -2,7 +2,7 @@
|
|||
layout: "docs"
|
||||
page_title: "Highly Available Vault Cluster with Consul"
|
||||
sidebar_current: "docs-platform-k8s-examples-ha-with-consul"
|
||||
sidebar_title: "Highly Available Cluster with Consul"
|
||||
sidebar_title: "HA Cluster with Consul"
|
||||
description: |-
|
||||
Describes how to set up a highly available Vault cluster with Consul backend
|
||||
---
|
||||
|
|
|
|||
|
|
@ -0,0 +1,62 @@
|
|||
---
|
||||
layout: "docs"
|
||||
page_title: "Highly Available Vault Cluster with Raft"
|
||||
sidebar_current: "docs-platform-k8s-examples-ha-with-raft"
|
||||
sidebar_title: "HA Cluster with Raft"
|
||||
description: |-
|
||||
Describes how to set up a highly available Vault cluster with Integrated Storage (Raft)
|
||||
---
|
||||
|
||||
# Highly Available Vault Cluster with Integrated Storage (Raft)
|
||||
|
||||
~> **Important Note:** This chart is not compatible with Helm 2. Please use Helm 3 with this chart.
|
||||
|
||||
Integrated storage (raft) can be enabled using the `server.ha.raft.enabled` value:
|
||||
|
||||
```shell
|
||||
helm install vault \
|
||||
--set='server.ha.enabled=true' \
|
||||
--set='server.ha.raft.enabled=true' \
|
||||
https://github.com/hashicorp/vault-helm/archive/v0.5.0.tar.gz
|
||||
```
|
||||
|
||||
Next, initialize and unseal `vault-0` pod:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-0 -- vault operator init
|
||||
kubectl exec -ti vault-0 -- vault operator unseal
|
||||
```
|
||||
|
||||
Finally, join the remaining pods to the Raft cluster and unseal them. The pods
|
||||
will need to communicate directly so we'll configure the pods to use the internal
|
||||
service provided by the Helm chart:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-1 -- vault operator raft join http://vault-0.vault-internal:8200
|
||||
kubectl exec -ti vault-1 -- vault operator unseal
|
||||
|
||||
kubectl exec -ti vault-2 -- vault operator raft join http://vault-0.vault-internal:8200
|
||||
kubectl exec -ti vault-2 -- vault operator unseal
|
||||
```
|
||||
|
||||
To verify if the Raft cluster has successfully been initialized, run the following.
|
||||
|
||||
First, login using the `root` token on the `vault-0` pod:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-0 -- vault login
|
||||
```
|
||||
|
||||
Next, list all the raft peers:
|
||||
|
||||
```shell
|
||||
kubectl exec -ti vault-0 -- vault operator raft list-peers
|
||||
|
||||
Node Address State Voter
|
||||
---- ------- ----- -----
|
||||
a1799962-8711-7f28-23f0-cea05c8a527d vault-0.vault-internal:8201 leader true
|
||||
e6876c97-aaaa-a92e-b99a-0aafab105745 vault-1.vault-internal:8201 follower true
|
||||
4b5d7383-ff31-44df-e008-6a606828823b vault-2.vault-internal:8201 follower true
|
||||
```
|
||||
|
||||
Vault with integrated storage (Raft) is now ready to use!
|
||||
Loading…
Reference in a new issue