You are looking at the documentation of a prior release. To read the documentation of the latest release, please
visit here.
New to KubeVault? Please start here.
This guide will give an overview on how KubeVault Enterprise operator reconfigures TLS configuration i.e. add TLS, remove TLS, update issuer/cluster issuer or Certificates and rotate the certificates of a VaultServer
.
KubeVault
concepts:The Reconfiguring VaultServer TLS process consists of the following steps:
At first, a user creates a VaultServer
Custom Resource Object (CRO).
KubeVault
operator watches the VaultServer
CRO.
When the operator finds a VaultServer
CR, it creates required number of StatefulSets
and related necessary stuff like secrets, services, etc.
Then, in order to reconfigure the TLS configuration of the VaultServer
the user creates a VaultOpsRequest
CR with desired information.
KubeVault
operator watches the VaultOpsRequest
CR.
When it finds a VaultOpsRequest
CR, it pauses the VaultServer
object which is referred from the VaultOpsRequest
. So, the KubeVault
operator doesn’t perform any operations on the VaultServer
object during the reconfiguring TLS process.
Then the KubeVault
operator will add, remove, update or rotate TLS configuration based on the Ops Request yaml.
Then the KubeVault
operator will restart all the Pods of the database so that they restart with the new TLS configuration defined in the VaultOpsRequest
CR.
After the successful reconfiguring of the VaultServer
TLS, the KubeVault
operator resumes the VaultServer
object so that the KubeVault
Community operator resumes its usual operations.
In the next docs, we are going to show a step by step guide on reconfiguring TLS configuration of a VaultServer using VaultOpsRequest
CRD.