Running operator init on first run about vault-helm

[jasonodonnell]

@christopherbloghett-disney Valid concerns and things we're looking to improve on in the near future based on feedback we've been receiving.

[lostick]

This is an issue indeed.
helm sets the deployment status as FAILED on first deploy, as vault is not init, and the Readiness Probe fails

[Skaronator]

Thats correct IIRC. You need to do initialize the Vault Server first, after that it'll write in the DynamoDB. You can either do that via CLI vault operator init or via the Webinterface.

Your DynamoDB should look like this:

resource "aws_dynamodb_table" "vault" {
  name           = "vault-storage"
  billing_mode   = "PROVISIONED"
  read_capacity  = 10
  write_capacity = 10
  hash_key       = "Path"
  range_key      = "Key"

  point_in_time_recovery {
    enabled = true
  }

  attribute {
    name = "Path"
    type = "S"
  }

  attribute {
    name = "Key"
    type = "S"
  }
}

Provisioned should be cheaper than on demand.

[christopherbloghett-disney]

I have ran the command through helm like the previous person that committed the error. It'd just be nice not to have to go that route. I'm deploying with Gitlab CI through Rancher to get the 100% experience of automation. Had to add an ingress template and a secrets template to load a cert in so I can connect.

Really feeling like this chart shouldn't be public yet. Our prod environment is still running on the incubator scripts over in the Helm charts.

My personal thoughts about the ideal solution for these charts would be a person/team should be able to define HA Mode, a Backend, a Cert, Auth method. Then a functioning cluster gets provisioned. Sadly that is not the case.

[mdgreenwald]

Even after running vault operator init I am still seeing failing readiness probes which prevent the service from becoming accessible. This is true despite the pods showing its "==> Vault server started! Log data will stream in below:" message.

Readiness:      exec [/bin/sh -ec vault status -tls-skip-verify] delay=5s timeout=5s period=3s #success=1 #failure=2

Readiness probe failed: Key                Value

[christopherbloghett-disney]

Looking at the incubator, it looks like the make vault alive if sealed, but not ready. I feel this could be a better option because then we can still connect and take actions with just Vault.

vault.liveness.aliveIfSealed: true
vault.liveness.aliveIfUninitialized: true
vault.readiness.readyIfSealed: false
vault.readiness.readyIfUninitialized: true

[catsby]

Hey @mdgreenwald - are you also unsealing Vault?

[mdgreenwald]

Hi @catsby No, I had not attempted that yet.

[SiM22]

I unseal the vault on eaach pod and it seems to work