kelseyhightower / vault-init

Automate the initialization and unsealing of HashiCorp Vault on Google Cloud Platform.

vault-init

The vault-init service automates the process of initializing and unsealing HashiCorp Vault instances running on Google Cloud Platform.

After vault-init initializes a Vault server it stores master keys and root tokens, encrypted using Google Cloud KMS, to a user defined Google Cloud Storage bucket.

Usage

The vault-init service is designed to be run alongside a Vault server and communicate over local host.

Kubernetes

Run vault-init in the same Pod as the Vault container. See the vault statefulset for a complete example.

Configuration

The vault-init service supports the following environment variables for configuration:

• CHECK_INTERVAL - The time in seconds between Vault health checks. (300)
• GCS_BUCKET_NAME - The Google Cloud Storage Bucket where the vault master key and root token is stored.
• KMS_KEY_ID - The Google Cloud KMS key ID used to encrypt and decrypt the vault master key and root token.

Example Values

CHECK_INTERVAL="300"
GCS_BUCKET_NAME="vault-storage"
KMS_KEY_ID="projects/my-project/locations/global/keyRings/my-keyring/cryptoKeys/key"

IAM & Permissions

The vault-init service uses the official Google Cloud Golang SDK. This means it supports the common ways of providing credentials to GCP.

To use this service, the service account must have the following minimum scope(s):

https://www.googleapis.com/auth/cloudkms
https://www.googleapis.com/auth/devstorage.read_write

Additionally, the service account must have the following minimum role(s):

roles/cloudkms.cryptoKeyEncrypterDecrypter
roles/storage.objectAdmin OR roles/storage.legacyBucketWriter

For more information on service accounts, please see the Google Cloud Service Accounts documentation.

vault-init's Issues

env VAULT_ADDR

Hello, i trying to use vault-init in a development setup, and I'm not using https.
I think the application is not respecting VAULT_ADDR env var.

Reproduce:

root@vagrant-ubuntu-trusty-64:~# echo $VAULT_ADDR                                                            
http://127.0.0.2:8200                                                                                        
root@vagrant-ubuntu-trusty-64:~# vault-init                                                                                                                                    
2018/09/27 19:35:18 Starting the vault-init service...                                                                                                                                        
2018/09/27 19:35:18 Get https://127.0.0.1:8200/v1/sys/health: http: server gave HTTP response to HTTPS client                                                                               
2018/09/27 19:35:28 Get https://127.0.0.1:8200/v1/sys/health: http: server gave HTTP response to HTTPS client                                                                     
2018/09/27 19:35:38 Get https://127.0.0.1:8200/v1/sys/health: http: server gave HTTP response to HTTPS client    

Vault-init does not support proxy configuration

Please refer to this issue for more details:
sethvargo/vault-on-gke#70

How vault auto init works

Hi Kelsey,

Hope you are doing well!!!

I have been following your youtube videos, blogs to know the practices to be followed on different aspects specifically on container world.

Recently i was evaluating the vault auto unseal feature where i have consul as its storage backend and AWS KMS for auto unseal integration, both consul and vault are running as container workload on k8s platform. I was able to evaluate auto unseal correctly. Post this i was looking about the vault auto init, as i was performing it manually during initial setup. After some googling i landed up on your github repo, i read about it but didn't get it completely. It would be very helpful for me if you can spare some time and share your expert guidance to me in same.

1. process of vault auto init
2. how to retrieve the master and recovery keys

Pointing to the relevant available document is also helpful.

Thanks in advance
Sandeep

Memory leak?

I've deploed the vault-init based on the howto from https://github.com/kelseyhightower/vault-on-google-kubernetes-engine.

But the memory consuption of the vault-init scripts seem to be ever growing, untill the k8s memory limit kicks in and kills the container. Than all starts over again.

name: vault-init
resources:
    limits:
        cpu: 100m
        memory: 512M
    requests:
        cpu: 10m
        memory: 128M