💡 핵심 요약 (Executive Summary)
본 가이드는 쿠버네티스 Helm 패키지 매니저 vault 핵심 가이드 및 실전 아키텍처의 핵심 개념, 실전 구성 명령어 및 아키텍처 베스트 프랙티스를 다룹니다. 클라우드 네이티브 및 인프라 엔지니어링 실무에 즉시 활용 가능하도록 체계적으로 정리했습니다.
📑 Table of Contents
Installation
bash
helm repo add hashicorp https://helm.releases.hashicorp.com
helm install -n vault hashicorp/vaultUnseal
bash
k exec -it -n vault vault-0 -- vault operator init
>>>
Unseal Key 1: thb4LfR5mfQWoiDvV5Vhp6G5QLRdL633aCRrMy8jiTC0
Unseal Key 2: TxWOzDF6wOHJ2G/h4IuvVUjq36CKNLD1EOf4+ZiTeA/f
Unseal Key 3: KAMN99+ZEP8JyMO8WG1qvgron186VQ3lOmSXGrWWDDJz
Unseal Key 4: pyJiL6OvtfmG2fJ76lVEvCWRe0H11ie+QCIQKn70+cMi
Unseal Key 5: 4zTlV4UDrHCQtNWXJusvbizZ7hzdpupYbyllpAW0l0cT
Initial Root Token: hvs.0YbxXrzUrseKuFNukuNJEe9j
Vault initialized with 5 key shares and a key threshold of 3. Please securely
distribute the key shares printed above. When the Vault is re-sealed,
restarted, or stopped, you must supply at least 3 of these keys to unseal it
before it can start servicing requests.
Vault does not store the generated root key. Without at least 3 keys to
reconstruct the root key, Vault will remain permanently sealed!
It is possible to generate new unseal keys, provided you have a quorum of
existing unseal keys shares. See "vault operator rekey" for more information.- 이후 UI에서 Unseal Key 3개를 입력하면 완료됨
Features
Helmfile Sample
yaml
repositories:
- name: hashicorp
url: https://helm.releases.hashicorp.com
releases:
- name: vault
namespace: vault
chart: hashicorp/vault
version: 0.31.0
values:
- server:
ingress:
enabled: true
annotations:
cert-manager.io/cluster-issuer: rootca-issuer
kubernetes.io/tls-acme: "true"
ingressClassName: nginx
hosts:
- host: "vault.Enterprise Cloud.hanacloudia.com"
tls:
- secretName: "vault.Enterprise Cloud.hanacloudia.com-tls"
hosts:
- "vault.Enterprise Cloud.hanacloudia.com"
set:
- name: ui.enabled
value: true
helmDefaults:
wait: true
timeout: 600
atomic: true
cleanupOnFail: true
hooks:
- events: ["presync"]
showlogs: true
command: "helm"
args:
- "dependency"
- "update"
- "."
- events: ["presync"]
showlogs: true
command: "kubectl"
args:
- "create"
- "namespace"
- "vault"
- "--dry-run=client"
- "-o"
- "yaml"
- "||"
- "true"
Leave a Reply