# Install HashiCorp Vault

> [HTML Version](install-vault.html)

HashiCorp Vault is an open-source tool that provides secure storage and encryption of confidential data, as well as access to data based on identity through customizable policies.

The installation of HashiCorp Vault consists of the following steps:

1. [Download the Helm chart and Vault configuration file](#install-config-file-vault).

2. [Fill out the Vault configuration file](#vault-parameters).

3. [Install Vault using Helm in a Kubernetes cluster](#install-vault).

4. [Configure Vault](#vault-settings).

## Step 1: Download the Helm chart and Vault configuration file

To install via the internet, obtain the configuration file \[OBJECT\] by running the command:

````
helm repo add brix365 https://charts.brix365.com  
helm repo update  
helm show values brix365/vault > values-vault.yaml

````
Obtaining the configuration file for installation in an isolated environment without internet access

1. On a computer with internet access, download the BRIX images and upload them to the local image registry by running the following command.:

````
helm repo add brix365 https://charts.brix365.com  
helm repo update  
helm pull brix365/vault

````
  
To learn more, see [Download BRIX images](downloadin-images-elma365.md).

2. Copy the downloaded archive of the chart **vault-X.Y.Z.tgz** to the server where the installation will take place.

3. Unpack the chart and copy the default configuration file \[OBJECT\] to \[OBJECT\]:

````
tar -xf vault-X.Y.Z.tgz  
cp vault/values.yaml values-vault.yaml
````

## ````
Step 2: Fill out the Vault configuration file

Fill out the configuration file \[OBJECT\] to install the **Vault **service.

````
\# Vault settings  
vault:  
  global:  
\# if not defined, StorageClass is used by default  
    storageClass: ""  
...

````
Filling in the connection parameters for a private registry for installation in an isolated environment without internet access involves the following steps:

  
To connect to a private **registry**, you need to follow these steps:

1. Download the BRIX images and upload them to your local image registry. For more details, refer to the article [Download BRIX images](downloadin-images-elma365.md).

2. Specify the address and path in the parameters \[OBJECT\], \[OBJECT\], \[OBJECT\] and \[OBJECT\].

3. Specify the name of the secret with access rights to the private registry in the \[OBJECT\] parameter. The secret must be manually created and encrypted in Base64.

````
\# Vault settings  
vault:  
...  
  server:  
\# Parameters for connecting to the private registry  
    image:  
\# address and path for the private registry  
      registry: hub.brix365.com  
      repository: docker/addons/bitnami/vault  
      tag: 1.17.5-debian-12-r0  
\# The secret with access permissions to the private registry must be manually created and encrypted in Base64  
\#      pullSecrets:  
\#        - name: "myRegistryKeySecretName"  
  injector:  
\# Parameters for connecting to the private registry  
    image:  
\# address and path for the private registry  
      registry: hub.brix365.com  
      repository: docker/addons/bitnami/vault-k8s  
      tag: 1.4.2-debian-12-r5  
\# The secret with access permissions to the private registry must be manually created and encrypted in Base64  
\#      pullSecrets:  
\#        - name: "myRegistryKeySecretName"

````
Where: 

- **registry **format is:** **address \[OBJECT\];

- **repository **format is:** **path \[OBJECT\].

## Step 3: Install Vault using Helm in a Kubernetes cluster

Perform the installation of the **Vault** service in a separate \[OBJECT\], for example, **vault**. \[OBJECT\] will be created during installation if it hasn't been created earlier.

For installation with internet access, run the following command:

````
helm upgrade --install vault brix365/vault -f values-vault.yaml -n vault --create-namespace

````
For offline installation (without internet access), navigate to the directory with the downloaded service and run the following command:

````
helm upgrade --install vault ./vault -f values-vault.yaml -n vault --create-namespace

## ````
Step 4: Configure Vault

1. Make sure that the satus of \[OBJECT\] is \[OBJECT\]:

````
kubectl get pods -n vault 

2. ````
Initialize **Vault**:

````
kubectl exec -ti vault-server-0 -n vault -- vault operator init

3. ````
After initialization, retrieve the list of  keys (\[OBJECT\]) and the root token (\[OBJECT\]). Use three keys to unlock the **Vault** service:

````
kubectl exec vault-server-0 -n vault -- vault operator unseal <Unseal Key 1>  
kubectl exec vault-server-0 -n vault -- vault operator unseal <Unseal Key 2>  
kubectl exec vault-server-0 -n vault -- vault operator unseal <Unseal Key 3> 

Начало внимание

````
If the **Vault** service restarts, it will need to be unsealed again using the keys.

````
Конец внимание

4. ````
After initialization and unsealing, connect to \[OBJECT\] and authenticate in **Vault** using the root key (\[OBJECT\]):

````
kubectl exec -ti vault-server-0 -n vault -- /bin/sh  
vault login

5. ````
Check the service state:

````
vault status   

6. ````
Enable the secrets mechanism \[OBJECT\] on the path of \[OBJECT\]:

````
vault secrets enable -path=secret kv-v2  

7. ````
Create a secret at the path \[OBJECT\]. For the secret, use the actual connection strings for the database (\[OBJECT\]) and parameters for connecting to the S3 file storage, following the pattern in [values-brix365.yaml](installing-elma365-enterprise.md#config_file): \[OBJECT\], \[OBJECT\], \[OBJECT\], \[OBJECT\], \[OBJECT\], \[OBJECT\], \[OBJECT\], \[OBJECT\], \[OBJECT\], \[OBJECT\], \[OBJECT\], \[OBJECT\], \[OBJECT\], \[OBJECT\], \[OBJECT\], \[OBJECT\]. 

If a parameter, for example \[OBJECT\], \[OBJECT\], or \[OBJECT\] is not used, create it with an empty value:

````
vault kv put secret/brix365/db \\  
PSQL\_URL="postgresql://postgres:pgpassword@postgres.default.svc.cluster.local:5432/brix365?sslmode=disable" \\  
RO\_POSTGRES\_URL="" \\  
brix365\_POOL\_POSTGRES\_URL="" \\  
MONGO\_URL="mongodb://brix365:mongopassword@mongo.default.svc.cluster.local:27017/brix365?ssl=false\&replicaSet=rs0\&readPreference=secondaryPreferred" \\  
VAHTER\_MONGO\_URL="mongodb://brix365:mongopassword@mongo.default.svc.cluster.local:27017/brix365?ssl=false\&replicaSet=rs0\&readPreference=secondaryPreferred" \\  
REDIS\_URL="redis://redis.default.svc.cluster.local:6379/0" \\  
AMQP\_URL="amqp://brix365:rmqpassword@rabbitmq.default.svc.cluster.local:5672/brix365" \\  
S3\_BACKEND\_ADDRESS="example.com" \\  
S3\_REGION="us-east-1" \\  
S3\_KEY="PZSF73JG72Ksd955JKU1HIA" \\  
S3\_SECRET="aFDkj28Jbs2JKbnvJH678MNwiz88zKjsuNBHHs" \\  
S3\_BUCKET="s3brix365" \\  
S3\_SSL\_ENABLED="false" \\  
S3\_UPLOAD\_METHOD="PUT" \\  
S3\_DUMP\_URL="" \\  
S3\_VIRTUAL\_HOSTED\_STYLE\_ENABLED="false" ````
  

8. Make sure the secret is created at the path \[OBJECT\]:

````
vault kv get secret/brix365/db  

9. ````
Enable the Kubernetes authentication method:

````
vault auth enable kubernetes    

10. ````
Configure the Kubernetes authentication method to use the Kubernetes API location:

````
vault write auth/kubernetes/config \\  
kubernetes\_host="https://\$KUBERNETES\_PORT\_443\_TCP\_ADDR:443"

11. ````
Create a policy for reading secrets at the address \[OBJECT\]:

````
vault policy write read-secret-brix365 - <<EOF  
path "secret/data/brix365/db" \{  
  capabilities = \["read"\]  
\}  
EOF

12. ````
Create a role named **read-secret-brix365**, which links the **read-secret-brix365** policy to the **vault-auth** service account in the \[OBJECT\] where BRIX is installed (e.g., **brix365**). The service account is created with the following command:

````
vault write auth/kubernetes/role/read-secret-brix365 \\  
bound\_service\_account\_names=vault-auth \\  
bound\_service\_account\_namespaces=brix365 \\  
policies=read-secret-brix365 \\  
ttl=24h

13. ````
Exit **Vault**: 

````
exit

14. ````
Create the **vault-auth** service account in the \[OBJECT\] where BRIX is installed (e.g., **brix365**):

````
kubectl create serviceaccount vault-auth -n brix365

````
Secrets in the Kubernetes cluster can be synchronized using HashiCorp Vault with the External Secrets Operator. Read more in [Install External Secrets Operator](install-external-secrets-operator.md).

## Remove Vault using Helm in the Kubernetes cluster

To uninstall the **Vault** service in the **vault** \[OBJECT\], execute the command:

````
helm uninstall vault -n vault
````