Skip to content
This repository has been archived by the owner on Dec 6, 2021. It is now read-only.

Latest commit

 

History

History
33 lines (21 loc) · 1.53 KB

README.md

File metadata and controls

33 lines (21 loc) · 1.53 KB

vault-init

This is a port of Kelsey Hightower vault-init to AWS.

The vault-init service automates the process of initializing and unsealing HashiCorp Vault instances running on Amazon Web Services.

After vault-init initializes a Vault server it stores master keys and root tokens, encrypted using AWS Key Management Service, to a user defined Amazon S3 bucket.

Usage

The vault-init service is designed to be run alongside a Vault server and communicate over local host.

Kubernetes

Run vault-init in the same Pod as the Vault container. See the vault statefulset for a complete example.

Configuration

The vault-init service supports the following environment variables for configuration:

  • CHECK_INTERVAL - The time in seconds between Vault health checks. (300)
  • S3_BUCKET_NAME - The Amazon S3 Bucket where the vault master key and root token is stored.
  • KMS_KEY_ID - The Amazon KMS key ID used to encrypt and decrypt the vault master key and root token.
  • VAULT_ADDR - The vault API address.

Example Values

CHECK_INTERVAL="300"
S3_BUCKET_NAME="vault-storage"
KMS_KEY_ID="arn:aws:kms:us-east-1:1234567819:key/dead-beef-dead-beef-deadbeefdead"
VAULT_ADDR="https://vault.service.consul:8200"