Run the Vault Secrets Operator on OpenShift

The Vault Secrets Operator may be installed on OpenShift clusters via the embedded OperatorHub or the Helm chart. OpenShift versions 4.12 and later are supported.

OperatorHub

The Vault Secrets Operator is certified by Red Hat and therefore included in the OperatorHub section of an OpenShift cluster's web console.

Navigate to the OperatorHub page of your OpenShift cluster and search for Vault Secrets Operator, then follow the instructions to install.

Options

Set the following environment variables on the subscription to customize the Kubernetes Operator behavior.

• VSO_CLIENT_CACHE_PERSISTENCE_MODEL
• VSO_CLIENT_CACHE_SIZE
• VSO_MAX_CONCURRENT_RECONCILES
• VSO_GLOBAL_TRANSFORMATION_OPTIONS

Helm chart

The Vault Secrets Operator may also be installed in OpenShift using the Helm chart. (See [Helm chart][helm].) The examples below show example values.yaml files for each configuration, which would be used with helm install as below:

$ helm install vault-secrets-operator hashicorp/vault-secrets-operator \
  --create-namespace \
  --namespace vault-secrets-operator \
  --version 0.9.1 \
  --values values.yaml

For OpenShift, increasing the memory requests and limits has proven necessary in some cases, so those settings are included in the examples below.

Default images

These values would use the default operator image from HashiCorp's Docker Hub repository.

controller:
  manager:
    resources:
      limits:
        memory: 256Mi
      requests:
        memory: 128Mi

UBI-based images certified by Red Hat

These values would use UBI-based images from the Red Hat's certified container registry. Authentication may be required.

controller:
  kubeRbacProxy:
    image:
      repository: registry.redhat.io/openshift4/ose-kube-rbac-proxy
      tag: v4.13.0
  manager:
    image:
      repository: registry.connect.redhat.com/hashicorp/vault-secrets-operator
      tag: 0.9.1-ubi
    resources:
      limits:
        memory: 256Mi
      requests:
        memory: 128Mi