hashicorp / hashicorp/vault-helm

Receive all configuration as chart values instead of pre-existing resources

Open
#422 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Shell
Stars
1.3k
Forks
898
Avg merge
3d 1h
Merged PRs (30d)
1

Description

**Is your feature request related to a problem? Please describe.**

The current requirement to create Kubernetes resources before `helm install`ing this chart makes deployment unnecessarily complicated and brittle.

If you're adding config for things like `seal "gcpckms" {}` or `storage "gcs" {}`, you have to create a ConfigMap upfront. And if you need to use `GOOGLE_APPLICATION_CREDENTIALS`, then you have to create a secret upfront.

This requires operators to have logic in place to handle the provisioning, update and deprovisioning of those Kubernetes resources. Moreover, this has to be done in such a way that it's kept in sync with any changes to the Vault release in Helm (e.g., uninstalling the release).

Helm doesn't offer the operator any way to create "resource dependencies" before installing a chart, so operators have to manually use `kubectl` to create/update/delete those resources (Helmfile hooks make this a bit less brittle).

**Describe the solution you'd like**

Just create those resources within the chart itself, which is the most common way to do this kind of things in Kubernetes anyway.

**Describe alternatives you've considered**

I can't think of any.

**Additional context**

Just to give an idea of the complexity this introduces, [here's the script I have to run before installing Vault](https://github.com/relaycorp/cloud-gateway/blob/40887a379197d85c6f69c108e88aef4787fe35a0/charts/vault/pre-install.sh) and [here's the k8s resources it'll create](https://github.com/relaycorp/cloud-gateway/blob/40887a379197d85c6f69c108e88aef4787fe35a0/charts/vault/resources.yml).

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the Vault Helm chart and the linked charts/vault/pre-install.sh and charts/vault/resources.yml examples to identify the ConfigMap and Secret inputs currently created beforehand. Define the chart values and templates needed to create those resources during installation, then verify that install, upgrade, and uninstall keep them synchronized with the release.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes
Domain
devops, infrastructure
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.