How to configure transit seal automatically about vault-helm

[billimek]

@botzill I wrote some instructions for my own gitops repo about doing just this (using an 'external' vault server as only an transit unsealer). It may be helpful for your use-case: https://github.com/billimek/k8s-gitops/tree/master/kube-system#vault-transit-unseal-server

[botzill]

thx @billimek

But in your case this transit unseal is a separate server and you are connecting to it from your k8s pod, right?

Is there anyway to make this automatically in the same k8s cluster?

I'm new to vault and still trying to understand and learn the basics.

Thx.

[billimek]

I think it could be done such that a second vault server is deployed to the k8s cluster to act as a transit unseal vault server, however:

The second transit vault server will itself become sealed whenever the pod is restarted via the k8s scheduler or some other reason. This will result in the primary vault server not being able to auto-unseal itself while the transit vault server is sealed.

I experimented with this a bit by having two different vault servers act as transit servers for each-other and was dismayed to find that if they both restarted, everything became sealed. Therefore running the vault unseal server externally made more sense (to me at least).

I do wonder if running vault or the vault unseal server in an HA mode would help mitigate the the issues I describe above.