AppsCode
    CONTACT SALES
    KubeVault
    github-icon twitter-icon

    Run Production-Grade
    Vault on Kubernetes

    KubeVault is a Git-Ops ready, production-grade solution for deploying and configuring Hashicorp's Vault on Kubernetes.

    Get Started Free Talk to Sales
    Terminal
    $ helm install kubevault \
      oci://ghcr.io/appscode-charts/kubevault \
      --version v2026.2.27 \
      --namespace kubevault --create-namespace
    ✓ KubeVault installed successfully

    Trusted by engineers at

    100 Fortune
    asurion
    Bank al Etihad
    Course Hero
    Emerson
    Enterprise Products Partners L.P.
    NOKIA
    OAK RIDGE
    Orange

    Special Features

    KubeVault is a Git-Ops ready, production-grade solution for deploying and configuring Hashicorp's Vault on Kubernetes.

    vaultserverversions

    Vault Kubernetes Deployment

    You can deploy TLS secured Vault Servers on Kubernetes using KubeVault. You can manage TLS with self-signed or cert-manager managed TLS. Running & managing Vault & it’s resources has never been easier.

    http

    Auto Initialization & Unsealing

    KubeVault provides various ways to automatically initialize & unseal your Vault Servers. You can use your choice of cloud providers among GCP, AWS, Azure, etc. or even K8s secret to store unseal keys & vault token.

    vault-backup-restore

    Vault Backup & Restore

    You can Backup & Restore your Vault cluster managed by KubeVault or deployed with Helm-charts using Stash. Stash simplifies & generalizes the process for Vault regardless of the Storage Backend used by the Vault. It protects your Vault cluster against data corruption or sabotage.

    secrets

    Consume KubeVault Secrets with CSI

    KubeVault works seamlessly with the Secrets Store CSI Driver. Consuming Vault secrets in K8s resources is way more simpler with the automation provided by KubeVault.

    http

    Manage DB Users Privileges

    Managing DB user privileges is a complicated task which is made simple with KubeVault. KubeVault works seamlessly with KubeDB managed DBs. CRDs like SecretAccessRequest, SecretRoleBinding, etc. make grant, revoke, audit user privileges extremely convenient.

    storageclasses

    Storage Backend

    KubeVault lets you choose your preferred way to store & persist Vault data. Each Storage Backend has its own pros and cons. GCS, AWS S3, Azure, Consul, Raft, Etcd, MySQL, Postgres, DynanoDB, etc. to name a few.

    http

    Authentication Method

    You can authenticate to Vault using numerous ways using KubeVault. Each of them has their own use-cases. Kubernetes Service Account token, AWS IAM, Azure, Userpass, JWT/OIDC, etc. to name a few.

    http

    Database Secret Engine

    PostgreSQL, MySQL, Elasticsearch & MongoDB database secret engine in Vault generates database credentials dynamically based on configured roles. Using Vault, you can configure Secret Engine, Create Role and issue dynamic credentials.

    http

    Azure Secret Engine

    Azure Secrets Engine dynamically generates Azure service principals and role assignments. Vault roles can be mapped to one or more Azure roles, providing a simple way to manage the permissions granted to generated service principals.

    http

    AWS Secret Engine

    AWS Secret Engine in Vault generates AWS access credentials dynamically based on IAM policies. Using Vault operator, you can configure AWS secret engine and issue AWS access credentials.

    http

    GCP Secret Engine

    Google Cloud Vault secrets engine dynamically generates Google Cloud service account keys and OAuth tokens based on IAM policies. By using Vault user can easily configure vault GCP Secret Engine and make request to generate Google Cloud account keys and OAuth tokens based on IAM policies.

    http

    Kubectl Plugin

    KubeVault CLI is a kubectl plugin that supports various handy features while using KubeVault. It automates numerous tedious tasks & provides simpler ways to interact with Vault. It’s possible to do CRUD operations on Vault unseal keys, root token stored in different clouds, generate SecretProviderClass, etc. with KubeVault CLI.

    Customer Stories

    Trusted by teams worldwide

    See what engineers are saying about KubeVault in production.

    Get Started

    Ready to use KubeVault?

    KubeVault is free to use on any supported Kubernetes cluster. Deploy in minutes with a 30-day free license.

    Start Free Trial Contact Us