Run Production-Grade Vault on Kubernetes
KubeVault is a Git-Ops ready, production-grade solution for deploying and configuring Hashicorp's Vault on Kubernetes.
oci://ghcr.io/appscode-charts/kubevault \
--version v2026.8.7 \
--namespace kubevault --create-namespace \
--set-file global.license=/path/to/the/license.txt
✓ KubeVault installed successfully
Trusted by engineers at
Vault on Kubernetes in 4 steps
A Git-Ops-ready workflow for deploying, unsealing, and operating HashiCorp Vault — declared entirely with Kubernetes-native CRDs.
Install the Operator
Deploy KubeVault via Helm into any Kubernetes cluster — EKS, GKE, AKS, or on-prem. One command, a few minutes.
helm install kubevault …Deploy a VaultServer
A single VaultServer CRD provisions a TLS-secured HashiCorp Vault that is automatically initialized and unsealed using your cloud KMS or a Kubernetes secret.
kind: VaultServerEnable Secret Engines
Declare SecretEngine and role CRDs to issue short-lived, dynamic credentials for AWS, Azure, GCP, and databases — no static secrets to rotate.
kind: SecretEngineRequest Secrets Securely
Workloads get scoped, audited access through SecretAccessRequest and the Secrets Store CSI Driver — secrets are delivered straight into pods.
kind: SecretAccessRequestBuilt for production-grade Vault
A Git-Ops-ready solution for deploying and configuring HashiCorp Vault on Kubernetes — with automated unsealing, dynamic secrets, and fine-grained access control.
Vault Kubernetes Deployment
You can deploy TLS secured Vault Servers on Kubernetes using KubeVault. You can manage TLS with self-signed or cert-manager managed TLS. Running & managing Vault & it’s resources has never been easier.
Read More
Auto Initialization & Unsealing
KubeVault provides various ways to automatically initialize & unseal your Vault Servers. You can use your choice of cloud providers among GCP, AWS, Azure, etc. or even K8s secret to store unseal keys & vault token.
Read More
Vault Backup & Restore
You can Backup & Restore your Vault cluster managed by KubeVault or deployed with Helm-charts using Stash. Stash simplifies & generalizes the process for Vault regardless of the Storage Backend used by the Vault. It protects your Vault cluster against data corruption or sabotage.
Read More
Consume KubeVault Secrets with CSI
KubeVault works seamlessly with the Secrets Store CSI Driver. Consuming Vault secrets in K8s resources is way more simpler with the automation provided by KubeVault.
Read More
Manage DB Users Privileges
Managing DB user privileges is a complicated task which is made simple with KubeVault. KubeVault works seamlessly with KubeDB managed DBs. CRDs like SecretAccessRequest, SecretRoleBinding, etc. make grant, revoke, audit user privileges extremely convenient.
Read More
Storage Backend
KubeVault lets you choose your preferred way to store & persist Vault data. Each Storage Backend has its own pros and cons. GCS, AWS S3, Azure, Consul, Raft, Etcd, MySQL, Postgres, DynanoDB, etc. to name a few.
Read More