When pod dies, what happens to secrets Hashicorp Vault

9/28/2018

I am running Hashicorp’s Vault server as a docker image as one of the pods in a Kubernetes cluster. I have defined service too. What will happen to the secret that are stored, if that pod dies.

-- Santosh
hashicorp-vault
kubernetes

2 Answers

11/28/2018

The secrets are stored in the storage backend. The most common storage backend is consul and the secrets remain in the pvc (persistent volume claim). If the vault pod dies and it spins up again, as long as the consul pvc are intact - the secrets would remain.

-- CloudJedi
Source: StackOverflow

9/28/2018

It depends on the storage you used for vault. Vault supports various storage (see here). For example,

  • If you are using In-Memory storage, then data will be vanished after pod dies.

  • If you are using Filesystem, then it will depend on type of volume you use (see here for different types of volumes). For emptyDir volume data will be lost after pod dies.

  • For other storage type like Google Cloud Storage, Amazon S3 data will remain even if pod dies. But if you delete the storage data will be gone.

-- nightfury1204
Source: StackOverflow