K3sは標準でIngressもLoadBalancer Serviceもどちらも使える。
VaultデプロイのHelmチャートのパラメタはそれぞれ異なる場所にあるのでメモ。
Ingress
K3sはTraefik Ingress Controllerが標準でインストールされる。
Vaultデプロイ時にIngressを使った外部に公開する最小の設定は以下の通りでserver以下に記述。
yourhost.example.orgに使いたいFQDNを指定する。
server: ingress: enabled: true hosts: - host: yourhost.example.org
デプロイするとこんな感じ
$ helm upgrade --install my-vault hashicorp/vault -n vault --create-namespace -f values.yaml Release "my-vault" does not exist. Installing it now. NAME: my-vault LAST DEPLOYED: Tue Nov 19 09:14:17 2024 NAMESPACE: vault STATUS: deployed REVISION: 1 NOTES: Thank you for installing HashiCorp Vault! Now that you have deployed Vault, you should look over the docs on using Vault with Kubernetes available here: https://developer.hashicorp.com/vault/docs Your release is named my-vault. To learn more about the release, try: $ helm status my-vault $ helm get manifest my-vault $ $ kubectl get pod,svc,ing -n vault NAME READY STATUS RESTARTS AGE pod/my-vault-0 0/1 Running 0 13s pod/my-vault-agent-injector-5fb64f8dfb-rzd7q 1/1 Running 0 13s NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE service/my-vault ClusterIP 10.43.125.114 <none> 8200/TCP,8201/TCP 13s service/my-vault-agent-injector-svc ClusterIP 10.43.233.51 <none> 443/TCP 13s service/my-vault-internal ClusterIP None <none> 8200/TCP,8201/TCP 13s NAME CLASS HOSTS ADDRESS PORTS AGE ingress.networking.k8s.io/my-vault traefik yourhost.example.org 192.168.0.12 80 13s
LoadBalancer Service
K3sは標準でKlipper Load Balancerが含まれているので,type: LoadBalancerの指定で簡単に使用できる。
Vaultデプロイ時にLoadBalancer Serviceを使うための最小の定義は以下の通りでui以下に記述。
externalPortはListenするポート番号で、省略時は8200/TCPになる。
ui: enabled: true serviceType: "LoadBalancer" externalPort: 25080
デプロイするとこの通り。
$ helm upgrade --install my-vault hashicorp/vault -n vault --create-namespace -f value s.yaml Release "my-vault" does not exist. Installing it now. NAME: my-vault LAST DEPLOYED: Tue Nov 19 09:34:24 2024 NAMESPACE: vault STATUS: deployed REVISION: 1 NOTES: Thank you for installing HashiCorp Vault! Now that you have deployed Vault, you should look over the docs on using Vault with Kubernetes available here: https://developer.hashicorp.com/vault/docs Your release is named my-vault. To learn more about the release, try: $ helm status my-vault $ helm get manifest my-vault $ $ kubectl get pod,svc,ing -n vault NAME READY STATUS RESTARTS AGE pod/my-vault-0 0/1 Running 0 45s pod/my-vault-agent-injector-5fb64f8dfb-kzrhv 1/1 Running 0 45s NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE service/my-vault ClusterIP 10.43.16.34 <none> 8200/TCP,8201/TCP 45s service/my-vault-agent-injector-svc ClusterIP 10.43.68.2 <none> 443/TCP 45s service/my-vault-internal ClusterIP None <none> 8200/TCP,8201/TCP 45s service/my-vault-ui LoadBalancer 10.43.88.2 192.168.0.12 25080:30507/TCP 45s
