Vault HashiCorp Integration

Connecting Vault, issuing secrets to applications in the cluster.

Introduction

HashiCorp Vault allows you to centrally store and issue secrets (passwords, keys, certificates). Integrating Vault with the Shturval platform makes it possible to automatically deliver data to the cluster and perform its rotation without storing sensitive information in Git repositories, Helm chart configuration files and Kubernetes manifests.

HashiCorp Vault and Vault Secrets Operator are supplied as a separate bundle on request and are not included in the platform bundle.

Integration of Cert-Manager with Vault

The platform allows you to configure Cert-Manager integration with Vault from the GUI. This allows TLS certificates to be issued to applications from Vault (for example, through the PKI engine) instead of or in addition to the usual Issuer/ClusterIssuer.

  • Go to Cluster → Administration → Certificate Manager (or the equivalent path in your version of the interface).
  • In the Namespace → Security → Issuers / Issuer section, when creating or editing an Issuer, you can configure integration with Vault. Integration is implemented using Service Account for authentication to Vault from the cluster.

The exact steps and fields (Vault address, path, roles) depend on the platform version; If necessary, check the documentation for the Certificate Manager and for configuring Issuer in the cluster administrator section.

Using Vault by applications in a cluster

Applications in a cluster can obtain secrets from Vault using:

  • Vault Agent Injector (if deployed in a cluster) - injection of secrets into the pod in the form of files or environment variables.
  • Kubernetes Auth Method in Vault - authentication of pods using ServiceAccount; Once logged in, the app reads secrets through the Vault API.
  • Vault Secrets Operator - synchronization of secrets from Vault to Kubernetes via resources VaultConnection, VaultAuth and VaultStaticSecret. Suitable for scenarios where you need to retrieve secrets from Vault into the cluster namespace and use a typical configuration for client clusters.
  • External Secrets Operator or equivalent - synchronization of secrets from Vault to Kubernetes Secret with updating according to a schedule or event.

For an integration scenario via client cluster profiles and vault-secrets-operator, use the following step-by-step instructions:

Briefly

  • Cert-Manager + Vault - configured via GUI (Issuer, Service Account integration).
  • Secrets for applications - via Vault Agent, Kubernetes Auth or secrets synchronization operators; The general setup depends on the selected method and platform version.
← Exporting security logs to external systems
Setting up integration with Vault in a deployed cluster →