// Module included in the following assemblies:
//
// * security/zero_trust_workload_identity_manageer/zero-trust-manager-oidc-federation.adoc

:_mod-docs-content-type: PROCEDURE
[id="zero-trust-manager-install-vault-oidc_{context}"]

= Installing Vault

[role="_abstract"]
Install HashiCorp Vault to serve as an OpenID Connect (OIDC) provider. This establishes the necessary infrastructure to manage workload identities securely in your {zero-trust-full} environment.

.Prerequisites

* Configure a route. For more information, see link:https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/ingress_and_load_balancing/routes#nw-configuring-routes[Configuring routes]

* Helm is installed.

* A command-line JSON processor for easily reading the output from the Vault API.

* A HashiCorp Helm repository is added.

.Procedure

. Create the `vault-helm-value.yaml` file.
+
[source,yaml]
----
global:
  enabled: true
  openshift: true
  tlsDisable: true
injector:
  enabled: false
server:
  ui:
    enabled: true
  image:
    repository: docker.io/hashicorp/vault
    tag: "1.19.0"
  dataStorage:
    enabled: true
    size: 1Gi
  standalone:
    enabled: true
    config: |
      listener "tcp" {
        tls_disable = 1
        address = "[::]:8200"
        cluster_address = "[::]:8201"
      }
      storage "file" {
        path = "/vault/data"
      }
  extraEnvironmentVars: {}
----
+
* The `openshift` field optimizes the deployment for OpenShift-specific security contexts.

* The `tlsDisable` field disables TLS for Kubernetes objects created by the chart.

* The `datastorage.enabled` field creates a 1Gi persistent volume to store Vault data.

* The `standalone.enabled` field deploys a single Vault pod.

* The `tls_disabled` field tells the Vault server to not use TLS.

. Run the `helm install` command:
+
[source,terminal]
----
$ helm install vault hashicorp/vault \
  --create-namespace -n vault \
  --values ./vault-helm-value.yaml
----

. Expose the Vault service by running the following command:
+
[source,terminal]
----
$ oc expose service vault -n vault
----

. Set the `VAULT_ADDR` environment variable to retrieve the hostname from the new route and then export it by running the following command:
+
[source,terminal]
----
$ export VAULT_ADDR="http://$(oc get route vault -n vault -o jsonpath='{.spec.host}')"
----
+
[NOTE]
====
`http://` is prepended because TLS is disabled.
====

.Verification

* To ensure your Vault instance is running, run the following command:
+
[source,terminal]
----
$ curl -s $VAULT_ADDR/v1/sys/health | jq
----
+
.Example output

[source,JSON]
----
{
  "initialized": true,
  "sealed": true,
  "standby": true,
  "performance_standby": false,
  "replication_performance_mode": "disabled",
  "replication_dr_mode": "disabled",
  "server_time_utc": 1663786574,
  "version": "1.19.0",
  "cluster_name": "vault-cluster-a1b2c3d4",
  "cluster_id": "5e6f7a8b-9c0d-1e2f-3a4b-5c6d7e8f9a0b"
}
----
