Can I deploy vault-operator with an existing Vault?

[mianrogue77]

Hi!

I'm interested to use vault-secrets-webhook to inject secrets as environment variables and I would like to connect it with an existing vault server instead of use the Vault that is deployed when I execute this command "kubectl apply -f https://raw.githubusercontent.com/bank-vaults/vault-operator/v1.21.0/deploy/examples/cr-raft.yaml", that vault is in another cluster and another AWS account.

Is it possible to do that? Is there any example to do that? or Could you point me in the right to configure vault-operator and vault-secret-webhook with an existing vault correctly?

[csatib02]

Hey @mianrogue77

The Vault Operator is designed to manage Vault instances that are deployed as custom resources (CRs) in Kubernetes. It watches for Vault CRs and manages the lifecycle of the corresponding Vault instances.

If you have an existing Vault instance that was not deployed as a Vault CR, the Vault Operator will not be able to manage it. The Operator needs the Vault CR to know the desired state of the Vault instance and to react to changes. In this case you would need to migrate your Vault data to a Vault CR that can be managed by the Operator.

In case you are using the Vault CR, that can be managed by the Operator, you will only need to deploy the Operator, since by default it will watch for Vault CR's in all namespaces, this behaviour can be changed here.

However, you can use your existing Vault with the Webhook and without the Operator.
Just simply set the right annotations on the resource that contains the Vault references, and you will be good to go.

More info about the latter topic:
https://bank-vaults.dev/docs/mutating-webhook/
https://github.com/bank-vaults/vault-secrets-webhook/tree/main/deploy/charts/vault-secrets-webhook

[mianrogue77]

Hi, @csatib02 ! Thank's a lot for your answer.