External Vault

Important Note: This chart is not compatible with Helm 2. Please use Helm 3.6+ with this chart.

Install the Vault Helm chart configured to address an external Vault

The Vault Helm chart can deploy the Vault Agent Injector service configured to target an external Vault. The injector service enables the authentication and secret retrieval for the applications, by adding Vault Agent containers as they are written to the pod automatically it includes specific annotations.

Use the below values.yaml to set up an external vault server or cluster.

injector:
  externalVaultAddr: 'http://external-vault:8200'

To set this value via the Helm CLI:

helm install vault hashicorp/vault \
  --set injector.externalVaultAddr='http://external-vault:8200'

This deploys an Vault Agent Injector that points to an external Vault server or cluster. The external Vault server or cluster must be reachable from the Kubernetes cluster.

The token for the vault service account is not created automatically, and you must create it explicitly.

apiVersion: v1
kind: Secret
metadata:
  name: vault-token-g955r
  annotations:
    kubernetes.io/service-account.name: vault
type: kubernetes.io/service-account-token
EOF

Learn

Refer to the Integrate a Kubernetes Cluster with an External Vault guide for a step-by-step tutorial.