I am running Hashicorp’s Vault server as a docker image as one of the pods in a Kubernetes cluster. I have defined service too. What will happen to the secret that are stored, if that pod dies.
The secrets are stored in the storage backend. The most common storage backend is consul and the secrets remain in the pvc (persistent volume claim). If the vault pod dies and it spins up again, as long as the consul pvc are intact - the secrets would remain.
It depends on the storage you used for vault. Vault supports various storage (see here). For example,
If you are using In-Memory
storage, then data will be vanished after pod dies.
If you are using Filesystem
, then it will depend on type of volume you use (see here for different types of volumes). For emptyDir
volume data will be lost after pod dies.
For other storage type like Google Cloud Storage
, Amazon S3
data will remain even if pod dies. But if you delete the storage data will be gone.