Comparison to incubator Vault chart about vault-helm

[jasonodonnell]

Hello @ohaiwalt,

The incubator chart is much older than Vault Helm and has a few extra features. We're always planning more to do here.

From what I can tell at a glance, the incubator chart uses a Deployment and also includes a sidecar Consul client, but this chart uses a StatefulSet

We chose to use a StatefulSet because we offer multiple Vault pods. Deployments with PVCs cannot be scaled because each new pod will mount the same PVC. This means in the future when Raft storage is generally available, multiple Vault servers using a deployment won't be able to scale beyond a single instance. StatefulSets, however, use volumeClaimTemplates and each new pod will get a unique PVC. In the future when Vault Enterprise is supported, multiple Vault pods will also support replication.

and doesn't appear to include the Consul client

Currently we don't add Consul client to our deployment because the Consul Helm project creates a Consul client as a Daemonset on each Kubernetes worker node. This means that Vault can just use the Consul client local to the worker node its running on. If you desire a Consul client, however, we do offer the server.extraContainers configurable that allows you to add any extra containers you may need.

Hope that provides extra context. I may turn this into additional documentation.

[ohaiwalt]

Thanks @jasonodonnell! That's great info.

While we are running the Consul Helm chart, we aren't using the Daemonset Consul clients because we only use Consul for Vault at this time. I'll see about making use of the servers.extraContainers block to meet my needs there.