Vault¶
This package deploys HashiCorp Vault using the upstream Vault Helm chart 0.34.1. Vault product concepts, architecture, authentication methods, secret engines, and general operations are documented by HashiCorp Vault.
Big Bang integration¶
Big Bang deploys the vault release to the vault namespace. The umbrella configuration entry point is addons.vault; package-specific values are passed under addons.vault.values. The package supplies Big Bang TLS, route, network-policy, dashboard, OpenShift, development initialization, and test integration around the upstream chart.
The package’s upstream value is the passthrough parent for upstream chart configuration. See the versioned upstream values for the full upstream configuration surface. Do not copy upstream nested values into Big Bang documentation; retain only the Big Bang overrides required by the deployment.
When Istio is enabled, the umbrella orders Vault after the required Istio releases. If the package’s optional legacy MinIO integration is enabled, the umbrella also waits for MinIO Operator. Package source selection, Flux reconciliation, ingress credentials, KMS inputs, and dependency ordering are owned by the umbrella.
TLS and routing¶
The umbrella addons.vault.ingress configuration selects the gateway and provides the certificate and key used to expose Vault. When both certificate and key are present, the package creates the vault-tls Secret and configures the upstream server with TLS volumes and listener settings. Keep the listener, route, mounted Secret, and client address aligned when changing TLS.
Do not put certificate or private-key material in values files, examples, tickets, or logs. Use the organization-approved secret-delivery mechanism. For route and gateway configuration, use the Big Bang package configuration documentation and validate the rendered package with the intended umbrella configuration.
Storage, initialization, and unseal¶
Storage and seal configuration are durability contracts. Before changing storage, HA, KMS, or TLS, plan and test backup, restore, initialization, unseal, and recovery using representative non-production infrastructure. The package’s production configuration guide describes the Big Bang integration boundaries; use the upstream Raft deployment guidance for product-specific design and lifecycle details.
autoInit is a development and demonstration feature only. It initializes Vault and writes root-token and unseal material to a Kubernetes Secret; do not enable it for operational deployments. Operational initialization, recovery keys, root tokens, and KMS credentials require a deliberate secure ceremony and external custody. For the AWS KMS integration boundary, see KMS auto-unseal and the upstream AWS KMS seal documentation.
Metrics and secret injection¶
Big Bang maps its monitoring setting to the package’s monitoring integration and allows the monitoring workload to reach Vault metrics when enabled. Metrics authorization and Vault authentication remain operational configuration: see Vault with Prometheus and the upstream telemetry reference. Verify scrapes and access policies in a representative environment; a rendered chart does not prove metrics authorization.
The package supports the upstream Vault Agent Injector and the CSI provider. Workloads using the default package network policy need the vault-ingress: "true" label to reach Vault. The injector also requires Kubernetes API and webhook connectivity. Keep policies least-privilege and review application identity, Vault policy, ServiceAccount, namespace, and injector annotations together. For an upstream injection walkthrough, see Injecting secrets into Kubernetes pods.