[Yandex Cloud documentation](../../../index.md) > [Yandex Managed Service for Kubernetes](../../index.md) > [Step-by-step guides](../index.md) > Installing applications from Cloud Marketplace > Installing HashiCorp Vault

# Installing HashiCorp Vault with Key Management Service support


[HashiCorp Vault](https://www.vaultproject.io/) is an open-source tool for securely storing and accessing different kinds of secrets, such as passwords, certificates, and tokens.

The application image contains a pre-installed build of HashiCorp Vault with support for [Auto Unseal](https://developer.hashicorp.com/vault/docs/concepts/seal#auto-unseal) via [Yandex Key Management Service](../../../kms/index.md). The build is based on [HashiCorp Vault](https://github.com/hashicorp/vault/tags) of the relevant version.

To install HashiCorp Vault:
1. [Prepare everything you need to get started](#before-you-begin).
1. Install HashiCorp Vault using [Yandex Cloud Marketplace](#marketplace-install) or [Helm](#helm-install).
1. [Initialize the vault](#vault-init).

## Getting started {#before-you-begin}

To use HashiCorp Vault, you need:
* [Service account](../../../iam/concepts/users/service-accounts.md) with the `kms.keys.encrypterDecrypter` [role](../../../iam/concepts/access-control/roles.md).
* [Authorized key](../../../iam/concepts/authorization/key.md).
* [Symmetric encryption key](../../../kms/concepts/key.md).

1. [Create a service account](../../../iam/operations/sa/create.md):

   ```bash
   yc iam service-account create --name vault-kms
   ```

1. [Create an authorized key](../../../iam/operations/authentication/manage-authorized-keys.md#create-authorized-key) for the service account and save it to the `authorized-key.json` file:

   ```bash
   yc iam key create \
     --service-account-name vault-kms \
     --output authorized-key.json
   ```

1. [Create a Key Management Service symmetric key](../../../kms/operations/key.md#create):

   ```bash
   yc kms symmetric-key create \
     --name example-key \
     --default-algorithm aes-256 \
     --rotation-period 24h
   ```

   Save the key `id`. You will need it when installing the application.
1. [Assign](../../../iam/operations/roles/grant.md) the `kms.keys.encrypterDecrypter` role to the service account you created earlier:

   ```bash
   yc resource-manager folder add-access-binding \
     --id <folder_ID> \
     --service-account-name vault-kms \
     --role kms.keys.encrypterDecrypter
   ```

   You can get the folder ID with the [list of folders](../../../resource-manager/operations/folder/get-id.md).

1. [Make sure](../connect/security-groups.md) the security groups for the Managed Service for Kubernetes cluster and its node groups are configured correctly. If a rule is missing, [add it](../../../vpc/operations/security-group-add-rule.md).

    {% note warning %}
    
    The configuration of security groups determines performance and availability of the cluster and the services and applications running in it.
    
    {% endnote %}

1. [Install kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl) and [configure it to work with the new cluster](../connect/index.md#kubectl-connect).

## Installation from Yandex Cloud Marketplace {#marketplace-install}

{% note warning %}

When using Cloud Marketplace to install HashiCorp Vault that supports Key Management Service, the [Agent Injector](https://developer.hashicorp.com/vault/docs/platform/k8s/injector) will be used to render secrets. To use the alternative [Vault CSI provider](https://developer.hashicorp.com/vault/docs/platform/k8s/csi), install the product using a [Helm chart](#helm-install). Learn more about the differences between these mechanisms in [this HashiCorp guide](https://developer.hashicorp.com/vault/docs/platform/k8s/injector-csi).

{% endnote %}

1. In the [management console](https://console.yandex.cloud), select a folder.
1. Navigate to **Managed Service for&nbsp;Kubernetes**.
1. Click the name of the [Managed Service for Kubernetes cluster](../../concepts/index.md#kubernetes-cluster) you need and select the ![Marketplace](../../../_assets/console-icons/shopping-cart.svg) **Marketplace** tab.
1. Under **Application available for installation**, select [HashiCorp Vault with Key Management Service support](https://yandex.cloud/en/marketplace/products/yc/vault-yckms-k8s) and click **Go to install**.
1. Configure the application:
   * **Namespace**: Create a new [namespace](../../concepts/index.md#namespace), e.g., `hashicorp-vault-space`. If you leave the default namespace, HashiCorp Vault may work incorrectly.
   * **Application name**: Specify the application name.
   * **Service account key for Vault**: Paste the contents of the `authorized-key.json` file to this field.
   * **KMS key ID for Vault**: Specify the [previously obtained](#before-you-begin) Key Management Service key ID.
1. Click **Install**.
1. Wait for the application status to change to `Deployed`.

## Installation using a Helm chart {#helm-install}

1. [Install Helm](https://helm.sh/docs/intro/install/) v3.8.0 or higher.
1. [Install kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl) and [configure it to work with the new cluster](../connect/index.md#kubectl-connect).
1. To install a [Helm chart](https://helm.sh/docs/topics/charts/) with HashiCorp Vault, run the following command, specifying the parameters of the resources you created [earlier](#before-you-begin):

   ```bash
   cat <path_to_file_with_authorized_key> | helm registry login cr.yandex \
     --username 'json_key' \
     --password-stdin && \
   helm pull oci://cr.yandex/yc-marketplace/yandex-cloud/vault/chart/vault \
     --version 0.28.1+yckms \
     --untar && \
   helm install \
     --namespace <namespace> \
     --create-namespace \
     --set-file yandexKmsAuthJson=<path_to_file_with_authorized_key> \
     --set yandexKmsKeyId=<KMS_key_ID> \
     hashicorp ./vault/
   ```

   {% note info %}
   
   If you are using a Helm version below 3.8.0, add the `export HELM_EXPERIMENTAL_OCI=1 && \` string at the beginning of the command to enable [Open Container Initiative](https://opencontainers.org/) (OCI) support in the Helm client.
   
   {% endnote %}

   Command parameters:
   * `<path_to_file_with_authorized_key>`: Path to the `authorized-key.json` file you [saved earlier](#before-you-begin).
   * `<namespace>`: New namespace to create for HashiCorp Vault. If you specify the default namespace, HashiCorp Vault may work incorrectly. We recommend specifying a value different from all the existing namespaces, e.g., `hashicorp-vault-space`.
   * `<KMS_key_ID>`: [Previously obtained](#before-you-begin) Key Management Service key ID.

   This command will install HashiCorp Vault with KMS support and the [Agent Injector](https://developer.hashicorp.com/vault/docs/platform/k8s/injector) secret render tool to the cluster. To use the alternative [Vault CSI provider](https://developer.hashicorp.com/vault/docs/platform/k8s/csi), add the following parameters to the command:

   ```bash
   --set "injector.enabled=false" \
   --set "csi.enabled=true"
   ```

   Learn more about the differences between these mechanisms in [this HashiCorp guide](https://developer.hashicorp.com/vault/docs/platform/k8s/injector-csi).

## Initializing the vault {#vault-init}

Once HashiCorp Vault is installed, you need to initialize one of its servers. The initialization generates credentials required to [unseal](https://www.vaultproject.io/docs/concepts/seal#why) all the vault servers.

{% note info %}

While initializing the vault, you do not need to perform the `unseal` operation as the application image is integrated with Key Management Service.

For more information, see [Auto Unseal](../../../kms/tutorials/vault-secret.md) and the [HashiCorp Vault guide](https://learn.hashicorp.com/tutorials/vault/kubernetes-raft-deployment-guide?in=vault/kubernetes#initialize-and-unseal-vault).

{% endnote %}

To initialize the vault:
1. Make sure the application switched to `Running` and has `0/1` ready [pods](../../concepts/index.md#pod):

   ```bash
   kubectl get pods \
     --namespace=<namespace> \
     --selector='app.kubernetes.io/name=vault'
   ```

   Result:

   ```text
   NAME              READY  STATUS   RESTARTS  AGE
   <vault_pod_name>  0/1    Running  0         58s
   ```

1. Initialize the vault:

   ```bash
   kubectl exec \
     --namespace=<namespace> \
     --stdin=true \
     --tty=true <vault_pod_name> \
     -- vault operator init
   ```

   Result:

   ```text
   Recovery Key 1: ulbugw4IKttmCCPprF6JwmUCyx1YfieCQPQi********
   Recovery Key 2: S0kcValC6qSfEI4WJBovSbJWZntBUwtTrtis********
   Recovery Key 3: t44ZRqbzLZNzfChinZNzLCNnwvFN/R52vbD*/*******
   ...

   Recovery key initialized with 5 key shares and a key threshold of 3. Please
   securely distribute the key shares printed above.
   ```

   Save the data you got to a secure location.

1. Request the list of application pods again and make sure that one pod is ready:

   ```bash
   kubectl get pods \
     --namespace=<namespace> \
     --selector='app.kubernetes.io/name=vault'
   ```

   Result:

   ```text
   NAME               READY  STATUS   RESTARTS  AGE
   vault-yckms-k8s-0  1/1    Running  0         5m
   ```

## Useful links {#see-also}

* [HashiCorp Vault documentation](https://developer.hashicorp.com/vault/docs?product_intent=vault)
* [Key Management Service guides](../../../kms/index.md)
* [Using HashiCorp Vault to store secrets](../../tutorials/marketplace/hashicorp-vault.md)
* [Installing the External Secrets Operator with Yandex Lockbox support](external-secrets-operator.md)
* [Syncing with Yandex Lockbox secrets](../../tutorials/kubernetes-lockbox-secrets.md)