Clearer README? about vault-helm

[jasonodonnell]

@magicalbanana This suggests you haven't initialized and unsealed Vault. There is no mechanism to auto-init so you would need to exec in to do that:

kubectl exec -ti <name of vault pod> -- vault operator init
kubectl exec -ti <name of vault pod> -- vault operator unseal

We're actively working on learn guides for Vault Helm but I would suggest taking a look at our official documentation for Vault: https://learn.hashicorp.com/vault

Additionally checkout this blog post for Vault Helm specifics: https://www.hashicorp.com/blog/announcing-the-vault-helm-chart

[fdlk]

The README currently is very developer-oriented, I think. Most users coming here eventually will not be interested in writing tests for the chart but in configuring and running the chart on their cluster.

[shibumi]

Ok never mind. I see the problem here. I need to invoke vault with 3 unseal keys.

[neumachen]

@jasonodonnell I actually figured this out. I kept re-installing the chart and when I delete it (even with purge) the PVC is retained (which makes sense).

But one thing though is the readiness probe needs to be a bit more liberal because if it's still sealed, it'll fail the ready status causing the deploy to fail.

[aparedero]

@jasonodonnell I've been thinking about creating an initContainer or a job. A k8s initContainer maybe is not the best option because is launched in a separated container before launching the vault one. The other option is to append a init script in the same Vault instance.

Could be possible to add an extra variable to determinate whether the helm install is a new one or an upgrade and determinate if the init script need to be executed?

[shibumi]

Sorry for reviving this issue. I ran into the same issue, the pod didn't satisfy the readinessProbe. So I initialized vault correctly.. the log messages seem okay now, but the pod is still not marked as ready.

Logs:

2020-10-30T10:21:15.718Z [INFO]  core: seal configuration missing, not initialized
2020-10-30T10:21:20.678Z [INFO]  core: seal configuration missing, not initialized
2020-10-30T10:21:25.670Z [INFO]  core: seal configuration missing, not initialized
2020-10-30T10:21:30.681Z [INFO]  core: seal configuration missing, not initialized
2020-10-30T10:21:31.485Z [INFO]  core: security barrier not initialized
2020-10-30T10:21:31.490Z [INFO]  core: security barrier initialized: stored=1 shares=5 threshold=3
2020-10-30T10:21:31.497Z [INFO]  core: post-unseal setup starting
2020-10-30T10:21:31.511Z [INFO]  core: loaded wrapping token key
2020-10-30T10:21:31.511Z [INFO]  core: successfully setup plugin catalog: plugin-directory=
2020-10-30T10:21:31.511Z [INFO]  core: no mounts; adding default mount table
2020-10-30T10:21:31.517Z [INFO]  core: successfully mounted backend: type=cubbyhole path=cubbyhole/
2020-10-30T10:21:31.518Z [INFO]  core: successfully mounted backend: type=system path=sys/
2020-10-30T10:21:31.518Z [INFO]  core: successfully mounted backend: type=identity path=identity/
2020-10-30T10:21:31.533Z [INFO]  core: successfully enabled credential backend: type=token path=token/
2020-10-30T10:21:31.533Z [INFO]  core: restoring leases
2020-10-30T10:21:31.533Z [INFO]  rollback: starting rollback manager
2020-10-30T10:21:31.534Z [INFO]  expiration: lease restore complete
2020-10-30T10:21:31.538Z [INFO]  identity: entities restored
2020-10-30T10:21:31.538Z [INFO]  identity: groups restored
2020-10-30T10:21:31.538Z [INFO]  core: usage gauge collection is disabled
2020-10-30T10:21:31.544Z [INFO]  core: post-unseal setup complete
2020-10-30T10:21:31.563Z [INFO]  core: root token generated
2020-10-30T10:21:31.563Z [INFO]  core: pre-seal teardown starting
2020-10-30T10:21:31.563Z [INFO]  rollback: stopping rollback manager
2020-10-30T10:21:31.563Z [INFO]  core: pre-seal teardown complete

Events:

Events:
  Type     Reason            Age                 From               Message
  ----     ------            ----                ----               -------
  Warning  FailedScheduling  12m                 default-scheduler  error while running "VolumeBinding" filter plugin for pod "vault-0": pod has unbound immediate PersistentVolumeClaims
  Normal   Scheduled         12m                 default-scheduler  Successfully assigned vault/vault-0 to k8sworker1
  Normal   Pulling           12m                 kubelet            Pulling image "vault:1.5.4"
  Normal   Pulled            11m                 kubelet            Successfully pulled image "vault:1.5.4"
  Normal   Created           11m                 kubelet            Created container vault
  Normal   Started           11m                 kubelet            Started container vault
  Warning  Unhealthy         10m (x21 over 11m)  kubelet            Readiness probe failed: Key                Value