HashiCorp vault-k8s

The vault-k8s binary provides first-class integrations between HashiCorp Vault and Kubernetes. The primary integration currently available is the Agent Inject feature, which uses a mutation webhook controller to automatically inject Vault Agent containers into Kubernetes pods that meet specific annotation criteria.

Note that this project is versioned separately from Vault to allow for faster iteration on Kubernetes-specific features without requiring a full Vault upgrade.

Requirement: Agent Inject requires Vault 1.3.1 or higher.

Agent Inject is a mutation webhook controller. It works by watching for Kubernetes pods that contain specific annotations. When a matching pod is created, the controller injects a Vault Agent container into that pod.

For detailed configuration and annotation specifications, refer to the official Vault documentation: Vault Agent Injector Documentation.

You can install vault-k8s using one of the following three methods depending on your deployment needs:

1. Helm Chart (Recommended): Use the official Vault Helm chart. This is the preferred method as it automatically configures both Vault and the Kubernetes integration to run within your existing cluster.
2. Docker Image: Use the hashicorp/vault-k8s image from Docker Hub. This is suitable for manually running vault-k8s within a scheduled environment.
3. Raw Binaries: Download binaries from the HashiCorp releases directory to run the tool directly or to build custom packages.

The vault-k8s binary provides two primary subcommands for managing Vault integration within Kubernetes: agent-inject and version. These commands are orchestrated via a CLI factory pattern.

Subcommands

• agent-inject: Invokes the Vault Agent Injector logic. This is typically used to manage the injection of Vault secrets into Kubernetes pods via sidecars or init containers.
• version: Displays the current version of the vault-k8s binary.

# Example usage (conceptual)
$ vault-k8s agent-inject [args]
$ vault-k8s version