The chart is customizable using Helm configuration values.
Use these links to navigate to a particular top-level stanza.
controllercontroller - Top level configuration for the vault secrets operator deployment. This consists of a controller and a kube rbac proxy container.
replicas (integer: 1) - Set the number of replicas for the operator.
strategy (object: "") - Configure update strategy for multi-replica deployments. Kubernetes supports types Recreate, and RollingUpdate ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy Example: strategy: {} rollingUpdate: maxSurge: 1 maxUnavailable: 0 type: RollingUpdate
hostAliases (array<map>) - Host Aliases settings for vault-secrets-operator pod. The value is an array of PodSpec HostAlias maps. ref: https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ Example: hostAliases:
nodeSelector (map) - nodeSelector labels for vault-secrets-operator pod assignment. ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector Example: nodeSelector: beta.kubernetes.io/arch: amd64
tolerations (array<map>) - Toleration Settings for vault-secrets-operator pod. The value is an array of PodSpec Toleration maps. ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ Example: tolerations:
affinity - Affinity settings for vault-secrets-operator pod. The value is a map of PodSpec Affinity maps. ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity Example: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms:
- matchExpressions:
- key: topology.kubernetes.io/zone
operator: In
values:
- antarctica-east1
- antarctica-west1
clusterRoleAggregation - clusterRoleAggregation defines the roles included in the aggregated ClusterRole.
viewerRoles (array<string>: []) - viewerRoles is a list of roles that will be aggregated into the viewer ClusterRole. The role name must be that of any VSO resource type. E.g. "VaultAuth", "HCPAuth". All values are case-insensitive. Specifying '*' as the first element will include all roles in the aggregation.
The ClusterRole name takes the form of <chart-fullname>-aggregate-role-viewer.
Example usages: all roles:
editorRoles (array<string>: []) - editorRoles is a list of roles that will be aggregated into the editor ClusterRole. The role name must be that of any VSO resource type. E.g. "VaultAuth", "HCPAuth". All values are case-insensitive. Specifying '*' as the first element will include all roles in the aggregation.
The ClusterRole name takes the form of <chart-fullname>-aggregate-role-editor.
Example usages: all roles:
userFacingRoles (object: "") - userFacingRoles is a map of roles that will be aggregated into the viewer and editor ClusterRoles. See https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles for more information.
view (boolean: false) - view controls whether the aggregated viewer ClusterRole will be made available to the user-facing 'view' ClusterRole. Requires the viewerRoles to be set.
edit (boolean: false) - view controls whether the aggregated editor ClusterRole will be made available to the user-facing 'edit' ClusterRole. Requires the editorRoles to be set.
kubeRbacProxy - Settings related to the kubeRbacProxy container. This container is an HTTP proxy for the controller manager which performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
image - Image sets the repo and tag of the kube-rbac-proxy image to use for the controller.
pullPolicy (string: IfNotPresent)
repository (string: quay.io/brancz/kube-rbac-proxy)
tag (string: v0.18.1)
resources (map) - Configures the default resources for the kube rbac proxy container. For more information on configuring resources, see the K8s documentation: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
imagePullSecrets (array<map>) - Image pull secret to use for private container registry authentication which will be applied to the controllers service account. Alternatively, the value may be specified as an array of strings. Example:
imagePullSecrets:
- name: pull-secret-name-1
- name: pull-secret-name-2
Refer to https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry.
extraLabels - Extra labels to attach to the deployment. This should be formatted as a YAML object (map)
annotations - This value defines additional annotations for the deployment. This should be formatted as a YAML object (map)
manager - Settings related to the vault-secrets-operator container.
image - Image sets the repo and tag of the vault-secrets-operator image to use for the controller.
pullPolicy (string: IfNotPresent)
repository (string: hashicorp/vault-secrets-operator)
tag (string: 0.10.0)
logging - logging
level (string: info) - Sets the log level for the operator. Builtin levels are: info, error, debug, debug-extended, trace Default: info
timeEncoding (string: rfc3339) - Sets the time encoding for the operator. Options are: epoch, millis, nano, iso8601, rfc3339, rfc3339nano Default: rfc3339
stacktraceLevel (string: panic) - Sets the stacktrace level for the operator. Options are: info, error, panic Default: panic
globalTransformationOptions - Global secret transformation options. In addition to the boolean options below, these options may be set via the VSO_GLOBAL_TRANSFORMATION_OPTIONS environment variable as a comma-separated list. Valid values are: exclude-raw
excludeRaw (boolean: false) - excludeRaw directs the operator to prevent _raw secret data being stored in the destination K8s Secret.globalVaultAuthOptions - Global Vault auth options. In addition to the boolean options below, these options may be set via the VSO_GLOBAL_VAULT_OPTION_OPTIONS environment variable as a comma-separated list. Valid values are: allow-default-globals
allowDefaultGlobals (boolean: true) - allowDefaultGlobals directs the operator search for a "default" VaultAuthGlobal if none is specified on the referring VaultAuth CR. Default: truebackoffOnSecretSourceError (object: "") - Backoff settings for the controller manager. These settings control the backoff behavior when the controller encounters an error while fetching secrets from the SecretSource. For example given the following settings: initialInterval: 5s maxInterval: 60s randomizationFactor: 0.5 multiplier: 1.5
The backoff retry sequence might be something like: 5.5s, 7.5s, 11.25s, 16.87s, 25.3125s, 37.96s, 56.95, 60.95s...
initialInterval (duration: 5s) - Initial interval between retries.
maxInterval (duration: 60s) - Maximum interval between retries.
maxElapsedTime (duration: 0s) - Maximum elapsed time without a successful sync from the secret's source. It's important to note that setting this option to anything other than its default will result in the secret sync no longer being retried after reaching the max elapsed time.
randomizationFactor (float: 0.5) - Randomization factor randomizes the backoff interval between retries. This helps to spread out the retries to avoid a thundering herd. If the value is 0, then the backoff interval will not be randomized. It is recommended to set this to a value that is greater than 0.
multiplier (float: 1.5) - Sets the multiplier that is used to increase the backoff interval between retries. This value should always be set to a value greater than 0. The value must be greater than zero.
clientCache - Configures the client cache which is used by the controller to cache (and potentially persist) vault tokens that are the result of using the VaultAuthMethod. This enables re-use of Vault Tokens throughout their TTLs as well as the ability to renew. Persistence is only useful in the context of Dynamic Secrets, so "none" is an okay default.
persistenceModel (string: "") - Defines the -client-cache-persistence-model which caches+persists vault tokens. May also be set via the VSO_CLIENT_CACHE_PERSISTENCE_MODEL environment variable. Valid values are: "none" - in-memory client cache is used, no tokens are persisted. "direct-unencrypted" - in-memory client cache is persisted, unencrypted. This is NOT recommended for any production workload. "direct-encrypted" - in-memory client cache is persisted encrypted using the Vault Transit engine. Note: It is strongly encouraged to not use the setting of "direct-unencrypted" in production due to the potential of vault tokens being leaked as they would then be stored in clear text.
default: "none"
cacheSize (integer: "") - Defines the size of the in-memory LRU cache in entries, that is used by the client cache controller. May also be set via the VSO_CLIENT_CACHE_SIZE environment variable. Larger numbers will increase memory usage by the controller, lower numbers will cause more frequent evictions of the client cache which can result in additional Vault client counts.
default: 10000
numLocks (integer: "") - Defines the number of locks to use for the Vault client cache controller. May also be set via the VSO_CLIENT_CACHE_NUM_LOCKS environment variable.
Setting this value less than 1 will cause the manager to set the number of locks equal to the number of logical CPUs of the run host.
See the VSO help output for more information.
default: 100
storageEncryption - StorageEncryption provides the necessary configuration to encrypt the client storage cache within Kubernetes objects using (required) Vault Transit Engine. This should only be configured when client cache persistence with encryption is enabled and will deploy an additional VaultAuthMethod to be used by the Vault Transit Engine. E.g. when controller.manager.clientCache.persistenceModel=direct-encrypted Supported Vault authentication methods for the Transit Auth method are: jwt, appRole, aws, and kubernetes. Typically, there should only ever be one VaultAuth configured with StorageEncryption in the Cluster.
enabled (boolean: false) - toggles the deployment of the Transit VaultAuthMethod CR.
vaultConnectionRef (string: default) - Vault Connection Ref to be used by the Transit VaultAuthMethod. Default setting will use the default VaultConnectionRef, which must also be configured.
keyName (string: "") - KeyName to use for encrypt/decrypt operations via Vault Transit.
transitMount (string: "") - Mount path for the Transit VaultAuthMethod.
namespace (string: "") - Vault namespace for the Transit VaultAuthMethod CR.
method (string: kubernetes) - Vault Auth method to be used with the Transit VaultAuthMethod CR.
mount (string: kubernetes) - Mount path for the Transit VaultAuthMethod.
kubernetes - Vault Kubernetes auth method specific configuration
role (string: "") - Vault Auth Role to use This is a required field and must be setup in Vault prior to deploying the helm chart if defaultAuthMethod.enabled=true
serviceAccount (string: "") - Kubernetes ServiceAccount associated with the Transit Vault Auth Role Defaults to using the Operator's service-account.
tokenAudiences (array<string>: []) - Token Audience should match the audience of the vault kubernetes auth role.
jwt - Vault JWT auth method specific configuration
role (string: "") - Vault Auth Role to use This is a required field and must be setup in Vault prior to deploying the helm chart if using JWT for the Transit VaultAuthMethod.
secretRef (string: "") - One of the following is required prior to deploying the helm chart
Name of Kubernetes Secret that has the Vault JWT auth token. The Kubernetes Secret must contain a key named jwt which references the JWT token, and must exist in the namespace of any consuming VaultSecret CR. This is a required field if a JWT token is provided.
serviceAccount (string: default) - Kubernetes ServiceAccount to generate a service account JWT
tokenAudiences (array<string>: []) - Token Audience should match the bound_audiences or the aud list in bound_claims if applicable of the Vault JWT auth role.
appRole - AppRole auth method specific configuration
roleId (string: "") - AppRole Role's RoleID to use for authenticating to Vault. This is a required field when using appRole and must be setup in Vault prior to deploying the helm chart.
secretRef (string: "") - Name of Kubernetes Secret that has the AppRole Role's SecretID used to authenticate with Vault. The Kubernetes Secret must contain a key named id which references the AppRole Role's SecretID, and must exist in the namespace of any consuming VaultSecret CR. This is a required field when using appRole and must be setup in Vault prior to deploying the helm chart.
aws - AWS auth method specific configuration
role (string: "") - Vault Auth Role to use This is a required field and must be setup in Vault prior to deploying the helm chart if using the AWS for the Transit auth method.
region (string: "") - AWS region to use for signing the authentication request Optional, but most commonly will be the EKS cluster region.
headerValue (string: "") - Vault header value to include in the STS signing request
sessionName (string: "") - The role session name to use when creating a WebIdentity provider
stsEndpoint (string: "") - The STS endpoint to use; if not set will use the default
iamEndpoint (string: "") - The IAM endpoint to use; if not set will use the default
secretRef (string: "") - The name of a Kubernetes Secret which holds credentials for AWS. Supported keys include access_key_id, secret_access_key, session_token
irsaServiceAccount (string: "") - Name of a Kubernetes service account that is configured with IAM Roles for Service Accounts (IRSA). Should be annotated with "eks.amazonaws.com/role-arn".
role (string: "") - Vault Auth Role to use This is a required field and must be setup in Vault prior to deploying the helm chart if using GCP for the Transit auth method.
workloadIdentityServiceAccount (string: "") - Name of a Kubernetes service account that is configured for workload identity in GKE.
region (string: "") - GCP Region of the GKE cluster's identity provider. Defaults to the region returned from the operator pod's local metadata server if unspecified.
clusterName (string: "") - GKE cluster name. Defaults to the cluster-name returned from the operator pod's local metadata server if unspecified.
projectID (string: "") - GCP project id. Defaults to the project-id returned from the operator pod's local metadata server if unspecified.
params (map) - Params to use when authenticating to Vault using this auth method. params: param-something1: "foo"
headers ( map: "") - Headers to be included in all Vault requests. headers: X-vault-something1: "foo"
maxConcurrentReconciles (integer: "") - Defines the maximum number of concurrent reconciles for each controller. May also be set via the VSO_MAX_CONCURRENT_RECONCILES environment variable.
default: 100
qps (float: "") - QPS indicates the maximum QPS to the kubernetes API. When the value is 0, the kubernetes client's default is used. May also set via the VSO_KUBE_CLIENT_QPS environment variable. Default: 0
burst (uint: "") - Maximum burst for throttling requests to the kubernetes API. When the value is 0, the kubernetes client's default is used. May also set via the VSO_KUBE_CLIENT_BURST environment variable. Default: 0
extraEnv (array<map>) - Defines additional environment variables to be added to the vault-secrets-operator manager container. Example:
extraEnv:
- name: HTTP_PROXY
value: http://proxy.example.com
- name: VSO_OUTPUT_FORMAT
value: json
- name: VSO_CLIENT_CACHE_SIZE
value: "20000"
- name: VSO_CLIENT_CACHE_PERSISTENCE_MODEL
value: "direct-encrypted"
- name: VSO_MAX_CONCURRENT_RECONCILES
value: "30"
extraArgs (array: []) - Defines additional commandline arguments to be passed to the vault-secrets-operator manager container.
resources (map) - Configures the default resources for the vault-secrets-operator container. For more information on configuring resources, see the K8s documentation: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
podSecurityContext - Configures the Pod Security Context https://kubernetes.io/docs/tasks/configure-pod-container/security-context
runAsNonRoot (boolean: true)securityContext - Configures the Container Security Context https://kubernetes.io/docs/tasks/configure-pod-container/security-context
allowPrivilegeEscalation (boolean: false)controllerConfigMapYaml (map) - Sets the configuration settings used by the controller. Any custom changes will be reflected in the data field of the configmap. For more information on configuring resources, see the K8s documentation: https://kubernetes.io/docs/concepts/configuration/configmap/
healthProbeBindAddress (string: :8081)leaderElect (boolean: true)
resourceName (string: b0d477c0.hashicorp.com)
bindAddress (string: 127.0.0.1:8080)port (integer: 9443)kubernetesClusterDomain (string: cluster.local) - Configures the environment variable KUBERNETES_CLUSTER_DOMAIN used by KubeDNS.
terminationGracePeriodSeconds (integer: 120) - Duration in seconds the pod needs to terminate gracefully. See: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
preDeleteHookTimeoutSeconds (integer: 120) - Timeout in seconds for the pre-delete hook
metricsService (map) - Configure the metrics service ports used by the metrics service. Set the configuration fo the metricsService port.
ports (map) - Set the port settings for the metrics service. For more information on configuring resources, see the K8s documentation: https://kubernetes.io/docs/concepts/services-networking/service/
name (string: https)
port (integer: 8443)
protocol (string: TCP)
targetPort (string: https)
type (string: ClusterIP)
defaultVaultConnection - Configures the default VaultConnection CR which will be used by resources if they do not specify a VaultConnection reference. The name is 'default' and will always be installed in the same namespace as the operator. NOTE:
It is strongly recommended to deploy the vault secrets operator in a secure Vault environment which includes a configuration utilizing TLS and installing Vault into its own restricted namespace.
enabled (boolean: false) - toggles the deployment of the VaultAuthMethod CR
address (string: "") - Address of the Vault Server Example: http://vault.default.svc.cluster.local:8200
caCertSecret (string: "") - CACertSecret is the name of a Kubernetes secret containing the trusted PEM encoded CA certificate chain as ca.crt. Note: This secret must exist prior to deploying the CR.
tlsServerName (string: "") - TLSServerName to use as the SNI host for TLS connections.
skipTLSVerify (boolean: false) - SkipTLSVerify for TLS connections.
headers (map) - Headers to be included in all Vault requests. headers: X-vault-something: "foo"
defaultAuthMethod - Configures and deploys the default VaultAuthMethod CR which will be used by resources if they do not specify a VaultAuthMethod reference. The name is 'default' and will always be installed in the same namespace as the operator. NOTE:
It is strongly recommended to deploy the vault secrets operator in a secure Vault environment which includes a configuration utilizing TLS and installing Vault into its own restricted namespace.
enabled (boolean: false) - toggles the deployment of the VaultAuthMethod CR
namespace (string: "") - Vault namespace for the VaultAuthMethod CR
allowedNamespaces (array<string>: []) - Kubernetes namespace glob patterns which are allow-listed for use with the default AuthMethod.
method (string: kubernetes) - Vault Auth method to be used with the VaultAuthMethod CR
mount (string: kubernetes) - Mount path for the Vault Auth Method.
kubernetes - Vault Kubernetes auth method specific configuration
role (string: "") - Vault Auth Role to use This is a required field and must be setup in Vault prior to deploying the helm chart if defaultAuthMethod.enabled=true
serviceAccount (string: default) - Kubernetes ServiceAccount associated with the default Vault Auth Role
tokenAudiences (array<string>: []) - Token Audience should match the audience of the vault kubernetes auth role.
jwt - Vault JWT auth method specific configuration
role (string: "") - Vault Auth Role to use This is a required field and must be setup in Vault prior to deploying the helm chart if using the JWT for the default auth method.
secretRef (string: "") - One of the following is required prior to deploying the helm chart
Name of Kubernetes Secret that has the Vault JWT auth token. The Kubernetes Secret must contain a key named jwt which references the JWT token, and must exist in the namespace of any consuming VaultSecret CR. This is a required field if a JWT token is provided.
serviceAccount (string: default) - Kubernetes ServiceAccount to generate a service account JWT
tokenAudiences (array<string>: []) - Token Audience should match the bound_audiences or the aud list in bound_claims if applicable of the Vault JWT auth role.
appRole - AppRole auth method specific configuration
roleId (string: "") - AppRole Role's RoleID to use for authenticating to Vault. This is a required field when using appRole and must be setup in Vault prior to deploying the helm chart.
secretRef (string: "") - Name of Kubernetes Secret that has the AppRole Role's SecretID used to authenticate with Vault. The Kubernetes Secret must contain a key named id which references the AppRole Role's SecretID, and must exist in the namespace of any consuming VaultSecret CR. This is a required field when using appRole and must be setup in Vault prior to deploying the helm chart.
aws - AWS auth method specific configuration
role (string: "") - Vault Auth Role to use This is a required field and must be setup in Vault prior to deploying the helm chart if using the AWS for the default auth method.
region (string: "") - AWS region to use for signing the authentication request Optional, but most commonly will be the region where the EKS cluster is running
headerValue (string: "") - Vault header value to include in the STS signing request
sessionName (string: "") - The role session name to use when creating a WebIdentity provider
stsEndpoint (string: "") - The STS endpoint to use; if not set will use the default
iamEndpoint (string: "") - The IAM endpoint to use; if not set will use the default
secretRef (string: "") - The name of a Kubernetes Secret which holds credentials for AWS. Supported keys include access_key_id, secret_access_key, session_token
irsaServiceAccount (string: "") - Name of a Kubernetes service account that is configured with IAM Roles for Service Accounts (IRSA). Should be annotated with "eks.amazonaws.com/role-arn".
role (string: "") - Vault Auth Role to use This is a required field and must be setup in Vault prior to deploying the helm chart if using GCP for the Transit auth method.
workloadIdentityServiceAccount (string: "") - Name of a Kubernetes service account that is configured for workload identity in GKE.
region (string: "") - GCP Region of the GKE cluster's identity provider. Defaults to the region returned from the operator pod's local metadata server if unspecified.
clusterName (string: "") - GKE cluster name. Defaults to the cluster-name returned from the operator pod's local metadata server if unspecified.
projectID (string: "") - GCP project id. Defaults to the project-id returned from the operator pod's local metadata server if unspecified.
params (map) - Params to use when authenticating to Vault params: param-something1: "foo"
headers (map) - Headers to be included in all Vault requests. headers: X-vault-something1: "foo"
vaultAuthGlobalRef - VaultAuthGlobalRef
enabled (boolean: false) - toggles the inclusion of the VaultAuthGlobal configuration in the default VaultAuth CR.
name (string: "") - Name of the VaultAuthGlobal CR to reference.
namespace (string: "") - Namespace of the VaultAuthGlobal CR to reference.
allowDefault (boolean: "") - allow default globals
telemetry - Configures a Prometheus ServiceMonitor
enabled (boolean: false) - The Prometheus operator must be installed before enabling this feature, if not the chart will fail to install due to missing CustomResourceDefinitions provided by the operator.
Instructions on how to install the Helm chart can be found here: https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack More information can be found here: https://github.com/prometheus-operator/prometheus-operator https://github.com/prometheus-operator/kube-prometheus
Enable deployment of the Vault Secrets Operator ServiceMonitor CustomResource.
selectors (string: "") - Selector labels to add to the ServiceMonitor. When empty, defaults to: release: prometheus
scheme (string: https) - Scheme of the service Prometheus scrapes metrics from. This must match the scheme of the metrics service of VSO
port (string: https) - Port at which Prometheus scrapes metrics. This must match the port of the metrics service of VSO
path (string: /metrics) - Path at which Prometheus scrapes metrics
bearerTokenFile (string: /var/run/secrets/kubernetes.io/serviceaccount/token) - File Prometheus reads bearer token from for scraping metrics
interval (string: 30s) - Interval at which Prometheus scrapes metrics
scrapeTimeout (string: 10s) - Timeout for Prometheus scrapes
hooks - Configure the behaviour of Helm hooks.
resources - Resources common to all hooks.
upgradeCRDs - Configure the Helm pre-upgrade hook that handles custom resource definition (CRD) upgrades.
enabled (boolean: true) - Set to true to automatically upgrade the CRDs. Disabling this will require manual intervention to upgrade the CRDs, so it is recommended to always leave it enabled.
backoffLimit (integer: 5) - Limit the number of retries for the CRD upgrade.
executionTimeout (string: 30s) - Set the timeout for the CRD upgrade. The operation should typically take less than 5s to complete.
tests - # Used by unit tests, and will not be rendered except when using helm template, this can be safely ignored.
enabled (boolean: true)The below config.yaml results in a single replica installation of the Vault Secrets Operator with a default vault connection and auth method custom resource deployed. It expects a local Vault installation within the kubernetes cluster accessible via http://vault.default.svc.cluster.local:8200 with TLS disabled, and a Vault Auth Method to be setup against the default ServiceAccount.
# config.yaml
defaultVaultConnection:
enabled: true
defaultAuthMethod:
enabled: true
If you need to extend the Helm chart with additional options, we recommend using a third-party tool, such as kustomize using the project repo config/ path in the vault-secrets-operator project.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4