You are looking at the documentation of a prior release. To read the documentation of the latest release, please
visit here.
New to KubeVault? Please start here.
Etcd
In Etcd storage backend, Vault data will be stored in Etcd. Vault documentation for Etcd storage can be found in here.
apiVersion: kubevault.com/v1alpha1
kind: VaultServer
metadata:
name: vault-with-etcd
namespace: demo
spec:
replicas: 1
version: "1.2.0"
backend:
etcd:
address: "http://example.etcd.svc:2379"
etcdApi: "v3"
spec.backend.etcd
To use Etcd as storage backend in Vault specify spec.backend.etcd
in VaultServer CRD.
spec:
backend:
etcd:
address: "http://example.etcd.svc:2379"
etcdApi: "v3"
Here, we are going to describe the various attributes of the spec.backend.etcd
field.
etcd.address
etcd.address
is a required field that specifies the addresses of the etcd instances.
spec:
backend:
etcd:
address: "http://example.etcd.svc:2379"
etcd.haEnable
etcd.haEnable
is an optional field that specifies if high availability should be enabled. This field accepts boolean value. The default value is false
.
spec:
backend:
etcd:
haEnable: true
etcd.etcdApi
etcd.etcdApi
is an optional field that specifies the version of the API to communicate with etcd. If this field is not specified, then Vault will derive it automatically. If the cluster version is 3.1+ and there has been no data written using the v2 API, the auto-detected default is v3.
spec:
backend:
etcd:
etcdApi: "v3"
etcd.path
etcd.path
is an optional field that specifies the path in etcd where Vault data will be stored. If this field is not specified, then Vault will set default value /vault/
.
spec:
backend:
etcd:
path: "/data/"
etcd.sync
etcd.sync
is an optional field that specifies whether to sync a list of available etcd services on startup. This field accepts boolean value. The default value is false
.
spec:
backend:
etcd:
sync: true
etcd.discoverySrv
etcd.discoverySrv
is an optional field that specifies the domain name to query for SRV records describing cluster endpoints. If this field is not specified, then Vault will set default value example.com
spec:
backend:
etcd:
discoverySrv: "example.com"
etcd.credentialSecretName
etcd.credentialSecretName
is an optional field that specifies the secret name that contains username and password to use when authenticating with the etcd server. The secret contains the following keys:
username
password
spec:
backend:
etcd:
credentialSecretName: "etcd-credential"
etcd.tlsSecretName
etcd.tlsSecretName
is an optional field that specifies the secret name that contains TLS assets for etcd communication. The secret contains following keys:
tls_ca_file
tls_cert_file
tls_key_file