blockloop/vault-unseal

Vault Unseal Docker镜像

该镜像基于官方Vault镜像，通过环境变量传递 unseal 密钥，自动完成Vault实例的 unseal 操作，最初设计用于Kubernetes集群内的自动化运维场景，也支持本地Docker环境使用。

核心功能

• 读取环境变量中的Vault地址和 unseal 密钥
• 循环检查Vault状态（最多15次），未 unseal 时自动尝试密钥解锁
• 成功 unseal 后正常退出（状态码0），遇错误则停止执行

使用场景

• Kubernetes集群内Vault实例的自动 unseal
• 本地测试环境中快速解锁Vault
• 自动化运维流程中集成Vault unseal 步骤

配置说明

需设置以下关键环境变量：

1. VAULT_ADDR：Vault服务器地址（需包含协议，如http://vault:8200）
2. VAULT_UNSEAL_KEY_X： unseal 密钥（格式为VAULT_UNSEAL_KEY_1、VAULT_UNSEAL_KEY_2等，数量需满足Vault的 unseal 阈值）
3. VAULT_SKIP_VERIFY（可选）：设置为1可跳过TLS证书验证（仅建议测试环境使用）

更多环境变量参考Vault官方文档。

部署示例

Docker Run示例

bash
docker run -e VAULT_ADDR=http://your-vault:8200 \
           -e VAULT_UNSEAL_KEY_1=your-unseal-key-1 \
           -e VAULT_UNSEAL_KEY_2=your-unseal-key-2 \
           -e VAULT_UNSEAL_KEY_3=your-unseal-key-3 \
           blockloop/vault-unseal

Kubernetes配置示例

yaml
---
# Vault密钥与配置Secret
apiVersion: v1
kind: Secret
metadata:
  name: vault-secret-config-s3
  namespace: default
type: Opaque
data:
  access_key: <base64编码的S3访问密钥>
  secret_key: <base64编码的S3密钥>
  unseal_key_1: <base64编码的 unseal 密钥1>
  unseal_key_2: <base64编码的 unseal 密钥2>
  unseal_key_3: <base64编码的 unseal 密钥3>
  root_token: <base64编码的根令牌>

---
# Vault配置文件ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
  name: vault-config-file
data:
  config.hcl: |-
    backend "s3" {}
    listener "tcp" {
      address = "0.0.0.0:8200"
      tls_disable = 1
    }

---
# Vault Deployment（适配K8s现代版本）
apiVersion: apps/v1
kind: Deployment
metadata:
  name: vault
spec:
  replicas: 1
  selector:
    matchLabels:
      app: vault
  template:
    metadata:
      labels:
        app: vault
    spec:
      volumes:
      - name: configmap
        configMap:
          name: vault-config-file
      containers:
      - name: vault
        image: vault:0.6.4
        args: ["server"]
        securityContext:
          capabilities:
            add: [IPC_LOCK]
        ports:
        - containerPort: 8200
        volumeMounts:
        - mountPath: /vault/config
          name: configmap
        env:
          - name: VAULT_ADDR
            value: [***]
          - name: VAULT_SKIP_VERIFY
            value: "1"
          - name: AWS_S3_BUCKET
            value: <你的S3桶名称>
          - name: AWS_DEFAULT_REGION
            value: <你的区域>
          - name: AWS_ACCESS_KEY_ID
            valueFrom: { secretKeyRef: { name: vault-secret-config-s3, key: access_key } }
          - name: AWS_SECRET_ACCESS_KEY
            valueFrom: { secretKeyRef: { name: vault-secret-config-s3, key: secret_key } }
          - name: VAULT_TOKEN
            valueFrom: { secretKeyRef: { name: vault-secret-config-s3, key: root_token } }

---
# Vault Service
apiVersion: v1
kind: Service
metadata:
  labels: { app: vault }
  name: vault
spec:
  ports: [{ port: 8200, targetPort: 8200 }]
  selector: { app: vault }
  type: ClusterIP

---
# Vault Unseal Job
apiVersion: batch/v1
kind: Job
metadata:
  name: vault-unseal
spec:
  template:
    metadata: { name: vault-unseal }
    spec:
      restartPolicy: OnFailure
      containers:
      - name: vault-unseal
        image: blockloop/vault-unseal
        env:
          - name: VAULT_ADDR
            value: [***]
          - name: VAULT_SKIP_VERIFY
            value: "1"
          - name: VAULT_UNSEAL_KEY_1
            valueFrom: { secretKeyRef: { name: vault-secret-config-s3, key: unseal_key_1 } }
          - name: VAULT_UNSEAL_KEY_2
            valueFrom: { secretKeyRef: { name: vault-secret-config-s3, key: unseal_key_2 } }
          - name: VAULT_UNSEAL_KEY_3
            valueFrom: { secretKeyRef: { name: vault-secret-config-s3, key: unseal_key_3 } }