如何通过Terraform或Helm自动化执行vault operator init初始化操作

你遇到的首次初始化失败问题核心原因通常有三类：

• 容器启动时序问题：vault-init sidecar和Vault主容器同步启动，首次部署时Vault主进程还未完成启动、未监听8200端口，init容器执行初始化请求直接失败退出，没有重试到Vault就绪的时间点
• 权限传播延迟/配置缺失：首次部署时Vault用到的GCS存储、KMS密钥的IAM权限还未完成全局传播，或者必要的初始化参数被注释导致逻辑不符合预期
• 重试机制缺失：默认配置下vault-init没有配置足够的重试次数，首次失败后没有持续重试直到Vault就绪

1. 修正Vault values配置 #

首先放开你注释的必要参数，同时给vault-init容器增加启动等待、重试机制，修改后的vault.tmpl配置如下：

server:
  # 给Vault主容器加就绪探针，确保启动完成后再触发初始化
  readinessProbe:
    enabled: true
    path: "/v1/sys/health?standbyok=true&sealedcode=200&uninitcode=200"
  extraContainers:
  - name: vault-init
    image: registry.hub.docker.com/sethvargo/vault-init:0.2.0
    imagePullPolicy: IfNotPresent
    env:
      - name: VAULT_SKIP_VERIFY
        value: "true"
      - name: CHECK_INTERVAL
        value: "10"
      - name: MAX_RETRIES
        value: "20" # 最大重试20次，每次间隔10秒，足够等Vault启动和权限传播
      - name: VAULT_ADDR
        value: "http://127.0.0.1:8200"
      - name: VAULT_SECRET_SHARES
        value: "1" # 可按实际需求调整分片数
      - name: VAULT_SECRET_THRESHOLD
        value: "1" # 可按实际需求调整阈值
      - name: VAULT_AUTO_UNSEAL
        value: "true"
      - name: GCS_BUCKET_NAME
        value: ${bucket} # 直接使用模板传入的变量，避免硬编码错误
      - name: KMS_KEY_ID
        value: "projects/${project}/locations/${region}/keyRings/${keyring}/cryptoKeys/${cryptokey}" # 模板变量自动填充
  # 可选：增加init容器提前检查Vault端口就绪，进一步避免时序问题
  initContainers:
  - name: wait-for-vault
    image: busybox:1.36
    command: ['sh', '-c', 'until nc -z 127.0.0.1 8200; do echo waiting for vault; sleep 2; done;']

2. 补全IAM权限配置（Terraform侧添加） #

确保Vault的Kubernetes服务账号有GCS和KMS的访问权限，在现有Terraform配置中增加以下资源即可：

# 创建Vault用的GCP服务账号，绑定Workload Identity
resource "google_service_account" "vault" {
  account_id = "vault-gke-sa"
  display_name = "Vault GKE Service Account"
}

# 给服务账号绑定GCS bucket的读写权限
resource "google_storage_bucket_iam_binding" "vault_bucket" {
  bucket = var.vault_bucket
  role = "roles/storage.objectAdmin"
  members = [
    "serviceAccount:${google_service_account.vault.email}"
  ]
}

# 给服务账号绑定KMS密钥的加解密权限
resource "google_kms_crypto_key_iam_binding" "vault_kms" {
  crypto_key_id = "projects/${data.google_client_config.current.project}/locations/${var.region}/keyRings/${var.keyring_name}/cryptoKeys/${var.cryptokey}"
  role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
  members = [
    "serviceAccount:${google_service_account.vault.email}"
  ]
}

# 绑定K8S SA和GCP SA的Workload Identity映射
resource "kubernetes_service_account" "vault" {
  metadata {
    name = "vault"
    namespace = "vault"
    annotations = {
      "iam.gke.io/gcp-service-account" = google_service_account.vault.email
    }
  }
}

# 给原helm_release增加依赖，确保权限配置完成后再部署Vault
resource "helm_release" "vault" {
  name                        = "vault"
  repository                  = "https://helm.releases.hashicorp.com"
  chart                       = "vault"
  namespace                   = "vault"
  reset_values                = true
  # 新增依赖，确保服务账号、权限都配置完成再部署
  depends_on = [
    google_storage_bucket_iam_binding.vault_bucket,
    google_kms_crypto_key_iam_binding.vault_kms,
    kubernetes_service_account.vault
  ]
  values                      = [
    templatefile("../values/vault.tmpl", {
      tls_disable             = 1
      region                  = var.region
      project                 = data.google_client_config.current.project
      replicas                = var.vault_replicas
      keyring                 = var.keyring_name
      cryptokey               = var.cryptokey
      bucket                  = var.vault_bucket
    })
  ]
  # 配置使用我们创建的K8S服务账号
  set {
    name = "server.serviceAccount.name"
    value = kubernetes_service_account.vault.metadata[0].name
  }
}

3. 可选替代方案：用Terraform null_resource实现初始化 #

如果不想依赖第三方sidecar镜像，可以直接用Terraform的null_resource在helm部署完成后自动执行初始化命令，完全纳入Terraform流程：

resource "null_resource" "vault_init" {
  depends_on = [helm_release.vault]
  provisioner "local-exec" {
    command = <<EOT
#!/bin/bash
# 等待Vault Pod就绪
kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=vault -n vault --timeout=300s
# 检查Vault是否已经初始化
INIT_STATUS=$(kubectl exec -n vault $(kubectl get pods -l app.kubernetes.io/name=vault -n vault -o jsonpath='{.items[0].metadata.name}') -- vault status -format=json | jq -r '.initialized')
if [ "$INIT_STATUS" == "false" ]; then
  # 执行初始化，输出的密钥可自动保存到GCP Secret Manager
  kubectl exec -n vault $(kubectl get pods -l app.kubernetes.io/name=vault -n vault -o jsonpath='{.items[0].metadata.name}') -- vault operator init -key-shares=1 -key-threshold=1 -format=json > vault-init-creds.json
  # 可选：把初始化密钥上传到GCP Secret Manager持久化保存
  gcloud secrets create vault-root-token --data-file=<(jq -r '.root_token' vault-init-creds.json)
  gcloud secrets create vault-unseal-key --data-file=<(jq -r '.unseal_keys_b64[0]' vault-init-creds.json)
fi
EOT
  }
}

内容的提问来源于stack exchange，提问作者terraform-ftw