[incubator/vault] Add HA configuration (#4709)

* [incubator/vault] Vault enhancements (customization, HA).

* Add support for service customization (ports, annotations)
* Add support for pod annotations
* Add readinessProbe to Vault service (for use in HA)
* Add support for Vault in HA mode (detect pod IP)

* Update how POD_IP is propagated into VAULT_CLUSTER_ADDR.

* [incubator/vault] Improved HA
* Use RollingUpdate with maxUnavailable
* Add PDB with maxUnavailable
* Make readiness default to exclude sealed vaults but configurable
* Remove `.Release.Revision` so `helm upgrade` doesn't require unsealing

incubator/vault/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 description: A Helm chart for Vault, a tool for managing secrets
 name: vault
-version: 0.4.3
+version: 0.5.0
 appVersion: 0.9.0
 home: https://www.vaultproject.io/
 icon: https://www.vaultproject.io/assets/images/mega-nav/logo-vault-0f83e3d2.svg

incubator/vault/templates/configmap.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: "{{ template "vault.fullname" . }}-config-{{ .Release.Revision }}"
+  name: "{{ template "vault.fullname" . }}-config"
   labels:
     app: "{{ template "vault.name" . }}"
     release: {{ .Release.Name | quote }}

incubator/vault/templates/deployment.yaml

@@ -9,11 +9,21 @@ metadata:
     heritage: {{ .Release.Service }}
 spec:
   replicas: {{ .Values.replicaCount }}
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
   template:
     metadata:
       labels:
         app: {{ template "vault.name" . }}
         release: {{ .Release.Name }}
+{{- if .Values.podAnnotations }}
+      annotations:
+      {{- range $key, $value := .Values.podAnnotations }}
+        {{ $key }}: {{ $value | quote }}
+      {{- end }}
+{{- end }}
     spec:
       containers:
       - name: {{ .Chart.Name }}
@@ -26,18 +36,34 @@ spec:
         {{- end }}
         ports:
         - containerPort: {{ .Values.service.port }}
+          name: api
+        - containerPort: 8201
+          name: cluster-address
         livenessProbe:
+          # Alive if it is listening for clustering traffic
           tcpSocket:
             port: {{ .Values.service.port }}
         readinessProbe:
+          # Ready depends on preference
           httpGet:
-            path: /v1/sys/health
+            path: /v1/sys/health?
+              {{- if .Values.vault.readiness.readyIfSealed -}}sealedcode=204&{{- end }}
+              {{- if .Values.vault.readiness.readyIfStandby -}}standbycode=204&{{- end }}
+              {{- if .Values.vault.readiness.readyIfUninitialized -}}uninitcode=204&{{- end }}
             port: {{ .Values.service.port }}
+            scheme: {{ if .Values.vault.config.listener.tcp.tls_disable -}}HTTP{{- else -}}HTTPS{{- end }}
         securityContext:
           readOnlyRootFilesystem: true
           capabilities:
             add:
             - IPC_LOCK
+        env:
+          - name: POD_IP
+            valueFrom:
+              fieldRef:
+                fieldPath: status.podIP
+          - name: VAULT_CLUSTER_ADDR
+            value: "https://$(POD_IP):8201"
         volumeMounts:
         - name: vault-config
           mountPath: /vault/config/
@@ -56,7 +82,7 @@ spec:
       volumes:
         - name: vault-config
           configMap:
-            name: "{{ template "vault.fullname" . }}-config-{{ .Release.Revision }}"
+            name: "{{ template "vault.fullname" . }}-config"
         - name: vault-root
           emptyDir: {}
         {{- range .Values.vault.customSecrets }}

incubator/vault/templates/pdb.yaml

@@ -0,0 +1,10 @@
+apiVersion: policy/v1beta1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ template "vault.fullname" . }}
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app: {{ template "vault.name" . }}
+      release: {{ .Release.Name }}

incubator/vault/templates/service.yaml

@@ -7,19 +7,22 @@ metadata:
     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
+{{- if .Values.service.annotations }}
   annotations:
-    {{- range $key, $value := .Values.service.annotations }}
-      {{ $key }}: {{ $value | quote }}
-    {{- end }}
+  {{- range $key, $value := .Values.service.annotations }}
+    {{ $key }}: {{ $value | quote }}
+  {{- end }}
+{{- end }}
 spec:
   type: {{ .Values.service.type }}
   {{- if .Values.service.clusterIP }}
-  clusterIP: {{ .Values.service.clusterIP }} 
+  clusterIP: {{ .Values.service.clusterIP }}
   {{- end }}
   ports:
-  - port: {{ .Values.service.port }}
+  - port: {{ .Values.service.externalPort }}
     protocol: TCP
-    name: {{ .Values.service.name }}
+    targetPort: {{ .Values.service.port }}
+    name: api
   selector:
     app: {{ template "vault.name" . }}
     release: {{ .Release.Name }}

incubator/vault/values.yaml

@@ -1,7 +1,7 @@
 # Default values for vault.
 # This is a YAML-formatted file.
 # Declare variables to be passed into your templates.
-replicaCount: 1
+replicaCount: 3
 image:
   repository: vault
   tag: 0.9.0
@@ -9,7 +9,9 @@ image:
 service:
   name: vault
   type: ClusterIP
+  externalPort: 8200
   port: 8200
+  annotations: {}
   # clusterIP: None
   # annotations:
   #   cloud.google.com/load-balancer-type: "Internal"
@@ -47,7 +49,7 @@ affinity: |
           matchLabels:
             app: {{ template "vault.fullname" . }}
             release: {{ .Release.Name }}
-
+podAnnotations: {}
 vault:
   # Only used to enable dev mode. When in dev mode, the rest of this config
   # section below is not used to configure Vault. See
@@ -62,12 +64,17 @@ vault:
   customSecrets: []
     # - secretName: vault-tls
     #   mountPath: /vault/tls
+  readiness:
+    readyIfSealed: false
+    readyIfStandby: true
+    readyIfUninitialized: true
   config:
     # A YAML representation of a final vault config.json file.
     # See https://www.vaultproject.io/docs/configuration/ for more information.
     listener:
       tcp:
         address: '[::]:8200'
+        cluster_address: '[::]:8201'
         tls_disable: true
         # tls_cert_file: /vault/tls/server.crt
         # tls_key_file: /vault/tls/server.key