kubee-vault | Vault Operation

kubee vault offers vault operations based on the vault chart.

INIT

kubee vault init will:

• init a fresh vault installation with 5 keys and a threshold of 3 (hardcoded)
• output on the console:
  • the output of the init operation
  • the unseal keys
  • the root token
• store in pass:
  • at kube/vault/keys: the unseal keys
  • at kube/vault/token: the root token

BACKUP

kubee vault backup will:

• stop vault
• start a temporary backup pod with the vault volume
• create a tar file of the data directory
• download the tar file in the KUBEE_BACKUP_DIR
• verify the downloaded tar file by listing it
• delete the temporary backup pod
• start vault
• unseal it

Example:

kubee --cluster SOURCE vault backup
kubee --cluster TARGET vault restore [fileName]

RESTORE

[!WARNING] restore delete the data directory Do a backup first

kubee vault restore will:

• stop vault
• start a temporary backup pod with the vault volume
• upload the tar file of the KUBEE_BACKUP_DIR
  • The default name is: vault-backup-YYYMMDD.tar.gz
  • You can pass a file name as first argument
• delete the data directory
• extract the archive
• delete the temporary backup pod
• start vault
• unseal it

Example:

kubee --cluster SOURCE vault backup
kubee --cluster TARGET vault restore [fileName]

UNSEAL

kubee vault backup will unseal your vault with keys

• stored in pass
• at kube/vault/keys
• with one key by line

DOWN

kubee vault down will scale down the vault deployment.

UP

kubee vault up will scale up to 1 the vault deployment.

You need to execute unseal after it.