vault-helm

Vault (Helm)

Overview

HashiCorp Vault provides secret management, encryption as a service, and identity-based access. This skill covers deploying Vault on Kubernetes with the official Helm chart in HA+Raft mode.

Latest: chart 0.33.0, app 2.0.2.

No CRDs. Controlled via Helm values and server config.

⚠️ Prefer OpenBao for self-hosting — OpenBao (v2.6.x, MPL-2.0, Linux Foundation) is a drop-in-compatible Vault fork with namespaces (secure multi-tenancy + namespace sealing) built into the open-source build — a feature Vault gates behind paid Enterprise (note: replication is NOT yet in OpenBao). Its killer feature for home/unstable clusters is Static Key Auto-Unseal (seal "static", built-in, no KMS): a 32-byte AES-256-GCM key injected from your secret store at boot, so nodes unseal themselves after any restart/power loss — Vault OSS auto-unseal only works via cloud KMS or a transit peer, otherwise you're typing Shamir keys after every reboot. The hashicorp/vault Helm chart and this skill's values mostly apply to OpenBao deployments too (image swap + config parity; verify engine/auth parity before committing). See the vault router for the full comparison.

Architecture (HA+Raft)

3 Vault pods (StatefulSet)
  → Raft integrated storage (consensus, no external DB)
    → Active node handles requests
      → Standby nodes forward to active
        → Service registration via K8s API

Vault OSS supports:

• Raft HA consensus (3+ nodes)
• Kubernetes auth method
• KV v2 secrets engine
• ACL policies
• Auto-unseal (KMS, Transit)
• Prometheus metrics

Vault OSS does not support:

• Namespaces (enterprise)
• Disaster Recovery replication (enterprise)
• Sentinel policies (enterprise)
• SAML auth (enterprise)
• OTLP traces (enterprise)

Deployment (Flux HelmRelease)

apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: vault
  namespace: vault
spec:
  chart:
    spec:
      chart: vault
      sourceRef:
        kind: HelmRepository
        name: hashicorp
      version: 0.33.0
  values:
    global:
      tlsDisable: true

    injector:
      enabled: false

    server:
      ha:
        enabled: true
        raft:
          enabled: true
          config: |
            ui = true

            listener "tcp" {
              address     = "0.0.0.0:8200"
              tls_disable = true
            }

            storage "raft" {
              path = "/vault/data"
            }

            service_registration "kubernetes" {}

            telemetry {
              prometheus_retention_time = "12h"
              disable_hostname         = true
            }

      service:
        enabled: true

      auditStorage:
        enabled: false

    ui:
      enabled: true
      serviceType: ClusterIP

    dataStorage:
      size: 10Gi
      storageClass: ceph-block