HashiCorp Vault with Yandex KMS support

HashiCorp Vault is an open source tool for securely storing and accessing secrets (for example, passwords, certificates, and tokens). The image contains a pre-installed build of HashiCorp Vault with added support for Auto Unseal via Yandex Key Management Service. The build is based on HashiCorp Vault 2.0.3.

1. Create a service account, which is required for HashiCorp Vault:

yc iam service-account create --name vault-kms

2. Create an authorized key for the service account and save it to the file authorized-key.json:

yc iam key create \
    --service-account-name vault-kms \
    --output authorized-key.json

3. Create a Yandex Key Management Service key:

yc kms symmetric-key create \
    --name example-key \
    --default-algorithm aes-256 \
    --rotation-period 24h

Save the key ID (id). You will need it when installing the application.

4. Assign the service account the kms.keys.encrypterDecrypter role for the Yandex Key Management Service key:

yc kms symmetric-key add-access-binding \
    --name example-key \
    --service-account-name vault-kms \
    --role kms.keys.encrypterDecrypter

5. Configure the application:

• Namespace: Create a new namespace, e.g., hashicorp-vault-space. If you leave the default namespace, HashiCorp Vault may work incorrectly.
• Application name: Enter an application name.
• Service account key: Copy the contents of the authorized-key.json file to this field.
• KMS key ID: Specify the ID of the Yandex Key Management Service key that you got earlier.

6. Click Install.

7. Make sure that the application switched to Running and has 0/1 ready pods:

kubectl get pods --selector='app.kubernetes.io/name=vault'

Expected output:

NAME                READY   STATUS    RESTARTS   AGE
<vault pod name>    0/1     Running   0          58s

8. Initialize the vault:

kubectl exec --stdin=true --tty=true <vault pod name> -- vault operator init

Expected output:

Recovery Key 1: ulbugw4IKttmCCPprF6JwmUCyx1YfieCQPQiI2S0VV9o
Recovery Key 2: S0kcValC6qSfEI4WJBovSbJWZntBUwtTrtisSIcS3n0e
Recovery Key 3: t44ZRqbzLZNzfChinZNzLCNnwvFN/R52vbDq/UueHPPg
Recovery Key 4: af4PRlm3VdXRzEHoDpYEnSgbwj4oc4zLCwkJG36cOUER
Recovery Key 5: rw9LXcyGEhoO4y4O5IA32IwiDS2t76zd52eiVqfpu+b6

Initial Root Token: s.4ddyD9kkIKVrslVBQBX1I5Pq

Success! Vault is initialized

Recovery key initialized with 5 key shares and a key threshold of 3. Please
securely distribute the key shares printed above.

Don’t run the unseal operation when initializing the vault. For more information, see Auto Unseal and the HashiCorp Vault documentation.

9. Query the list of application pods again and make sure that one pod is ready:

kubectl get pods --selector='app.kubernetes.io/name=vault'

Expected output:

NAME                READY   STATUS    RESTARTS   AGE
vault-yckms-k8s-0   1/1     Running   0          1h

• Secure secrets storage.
• Managing access to secrets.

Yandex Cloud technical support is available 24/7. The types of requests you can submit and the appropriate response time depend on your pricing plan. You can switch to the paid support plan in the management console. You can learn more about the technical support terms here. You can also get help from the community.