Installing and upgrading the Vault Secrets Operator

Prerequisites

A Kubernetes cluster running 1.23+
Helm 3.7+

Installation using helm

Install Helm before beginning.

The Vault Secrets Operator Helm chart is the recommended way of installing and configuring the Vault Secrets Operator.

To install a new instance of the Vault Secrets Operator, first add the HashiCorp helm repository and ensure you have access to the chart:

$ helm repo add hashicorp https://helm.releases.hashicorp.com
"hashicorp" has been added to your repositories

$ helm search repo hashicorp/vault-secrets-operator
NAME            CHART VERSION   APP VERSION DESCRIPTION
hashicorp/vault-secrets-operator    0.4.3           0.4.3       Official HashiCorp Vault Secrets Operator Chart

Then install the Operator:

$ helm install --version 0.4.3 --create-namespace --namespace vault-secrets-operator vault-secrets-operator hashicorp/vault-secrets-operator

Upgrading using helm

You can upgrade an existing installation with the helm upgrade command. Please always run Helm with the --dry-run option before any install or upgrade to verify changes.

Update the hashicorp Helm repo:

$ helm repo update hashicorp
Hang tight while we grab the latest from your chart repositories...
...Successfully got an update from the "hashicorp" chart repository
Update Complete. ⎈Happy Helming!⎈

Helm does not automatically update CRDs

You must update all CRDs manually before upgrading VSO. Refer to Updating CRDs.

To upgrade your VSO release, replace <TARGET_VSO_VERSION> with the VSO version you are upgrading to:

$ helm show crds --version <TARGET_VSO_VERSION> hashicorp/vault-secrets-operator | kubectl apply -f -
$ helm upgrade --version <TARGET_VSO_VERSION> --namespace vault-secrets-operator vault-secrets-operator hashicorp/vault-secrets-operator

For example, if you are upgrading to VSO 0.4.3:

$ helm show crds --version 0.4.3 hashicorp/vault-secrets-operator | kubectl apply -f -
$ helm upgrade --version 0.4.3 --namespace vault-secrets-operator vault-secrets-operator hashicorp/vault-secrets-operator

Updating CRDs

You must update the CRDs for VSO manually before you upgrade the operator when the operator is managed by Helm.

Any kubectl warnings related to last-applied-configuration should be safe to ignore.

To update the VSO CRDs, replace <TARGET_VSO_VERSION> with the VSO version you are upgrading to:

$ helm show crds --version <TARGET_VSO_VERSION> hashicorp/vault-secrets-operator | kubectl apply -f -

For example, if you are upgrading to VSO 0.4.3:

$ helm show crds --version 0.4.3 hashicorp/vault-secrets-operator | kubectl apply -f -

customresourcedefinition.apiextensions.k8s.io/hcpauths.secrets.hashicorp.com created
customresourcedefinition.apiextensions.k8s.io/hcpvaultsecretsapps.secrets.hashicorp.com created
Warning: resource customresourcedefinitions/vaultauths.secrets.hashicorp.com is missing the kubectl.kubernetes.io/last-applied-configuration annotation which is required by kubectl apply. kubectl apply should only be used on resources created declaratively by either kubectl create --save-config or kubectl apply. The missing annotation will be patched automatically.
customresourcedefinition.apiextensions.k8s.io/vaultauths.secrets.hashicorp.com configured
Warning: resource customresourcedefinitions/vaultconnections.secrets.hashicorp.com is missing the kubectl.kubernetes.io/last-applied-configuration annotation which is required by kubectl apply. kubectl apply should only be used on resources created declaratively by either kubectl create --save-config or kubectl apply. The missing annotation will be patched automatically.
customresourcedefinition.apiextensions.k8s.io/vaultconnections.secrets.hashicorp.com configured
Warning: resource customresourcedefinitions/vaultdynamicsecrets.secrets.hashicorp.com is missing the kubectl.kubernetes.io/last-applied-configuration annotation which is required by kubectl apply. kubectl apply should only be used on resources created declaratively by either kubectl create --save-config or kubectl apply. The missing annotation will be patched automatically.
customresourcedefinition.apiextensions.k8s.io/vaultdynamicsecrets.secrets.hashicorp.com configured
Warning: resource customresourcedefinitions/vaultpkisecrets.secrets.hashicorp.com is missing the kubectl.kubernetes.io/last-applied-configuration annotation which is required by kubectl apply. kubectl apply should only be used on resources created declaratively by either kubectl create --save-config or kubectl apply. The missing annotation will be patched automatically.
customresourcedefinition.apiextensions.k8s.io/vaultpkisecrets.secrets.hashicorp.com configured
Warning: resource customresourcedefinitions/vaultstaticsecrets.secrets.hashicorp.com is missing the kubectl.kubernetes.io/last-applied-configuration annotation which is required by kubectl apply. kubectl apply should only be used on resources created declaratively by either kubectl create --save-config or kubectl apply. The missing annotation will be patched automatically.
customresourcedefinition.apiextensions.k8s.io/vaultstaticsecrets.secrets.hashicorp.com configured

Chart values

Refer to the VSO helm chart overview for a full list of supported chart values.