Skip to content

Vault Production Considerations📜

Vault holds security-critical state and should be designed and operated using the upstream production guidance and the Big Bang Vault package’s production configuration.

At minimum, a production deployment should:

  • Disable Big Bang’s development-only autoInit automation. It writes the root token and unseal material to a Kubernetes Secret.
  • Run Vault in high-availability mode with integrated Raft storage or another supported production storage backend.
  • Use auto-unseal and protect recovery keys outside the cluster.
  • Terminate TLS at Vault. Big Bang’s passthrough gateway can pass encrypted traffic directly to the Vault pods.
  • Size persistent storage and resources for the environment, retain volumes during cluster or release recovery, and back up Raft state regularly.
  • Enable and retain audit devices appropriate for the environment. The package enables audit storage by default, but operators must configure and monitor Vault audit devices.

Configure High Availability with Raft📜

The following Big Bang example shows the relevant value paths for a three-node Raft deployment using AWS KMS auto-unseal. Replace the domain, certificate, storage, resource, and KMS settings for the environment.

addons:
  vault:
    enabled: true
    ingress:
      gateway: passthrough
      key: |
        -----BEGIN PRIVATE KEY-----
        <private-key>
        -----END PRIVATE KEY-----
      cert: |
        -----BEGIN CERTIFICATE-----
        <certificate-chain>
        -----END CERTIFICATE-----

    values:
      autoInit:
        enabled: false

      upstream:
        global:
          tlsDisable: false

        server:
          dataStorage:
            enabled: true
            size: 50Gi
            mountPath: /vault/data
            accessMode: ReadWriteOnce

          auditStorage:
            enabled: true

          resources:
            requests:
              cpu: 2000m
              memory: 8Gi
            limits:
              cpu: 2000m
              memory: 8Gi

          ingress:
            enabled: false

          extraEnvironmentVars:
            VAULT_LOG_FORMAT: json

          ha:
            enabled: true
            replicas: 3
            apiAddr: https://vault.dev.bigbang.mil

            raft:
              enabled: true
              setNodeId: true
              config: |
                ui = true

                listener "tcp" {
                  tls_disable = false
                  address = "[::]:8200"
                  cluster_address = "[::]:8201"
                  tls_cert_file = "/vault/tls/tls.crt"
                  tls_key_file  = "/vault/tls/tls.key"
                  telemetry {
                    unauthenticated_metrics_access = true
                  }
                }

                storage "raft" {
                  path = "/vault/data"

                  retry_join {
                    leader_api_addr = "https://vault-vault-0.vault-vault-internal:8200"
                    leader_client_cert_file = "/vault/tls/tls.crt"
                    leader_client_key_file = "/vault/tls/tls.key"
                    leader_tls_servername = "vault.dev.bigbang.mil"
                  }

                  retry_join {
                    leader_api_addr = "https://vault-vault-1.vault-vault-internal:8200"
                    leader_client_cert_file = "/vault/tls/tls.crt"
                    leader_client_key_file = "/vault/tls/tls.key"
                    leader_tls_servername = "vault.dev.bigbang.mil"
                  }

                  retry_join {
                    leader_api_addr = "https://vault-vault-2.vault-vault-internal:8200"
                    leader_client_cert_file = "/vault/tls/tls.crt"
                    leader_client_key_file = "/vault/tls/tls.key"
                    leader_tls_servername = "vault.dev.bigbang.mil"
                  }
                }

                seal "awskms" {
                  region = "us-gov-west-1"
                  kms_key_id = "<kms-key-id>"
                  endpoint = "https://kms.us-gov-west-1.amazonaws.com"
                }

                telemetry {
                  prometheus_retention_time = "24h"
                  disable_hostname = true
                }

                service_registration "kubernetes" {}

The certificate must be valid for the name used by apiAddr and leader_tls_servername. The example intentionally does not set VAULT_SKIP_VERIFY; disabling TLS verification is not an appropriate production default. Configure VAULT_LICENSE only for a licensed Vault Enterprise deployment.

Initialize and Protect Recovery Material📜

After installation, initialize Vault manually with vault operator init, store the recovery keys and initial root token in an approved system outside Kubernetes, and validate Raft snapshots and restore procedures.