Skip to content

Deployment Guide¶

This guide installs AccuKnox Secrets Manager on Kubernetes. It uses the Helm chart in accuknoxsecretmanager.tar, which your AccuKnox point of contact gives you.

Secrets Manager stores encrypted secrets, issues short-lived dynamic secrets, and applies identity-based access control with full audit logs.

Choose a Deployment Model¶

Run Secrets Manager yourself with the Helm chart on this page, or let AccuKnox run a managed instance. Every managed instance runs in high availability mode and is hardened with AccuKnox CWPP.

Managed shared instance Managed dedicated instance Self-hosted
Fits Non-production workloads Production Production, on-premises or air-gapped
Namespaces One, more at extra cost Several Your choice
Backups Daily At the frequency you set Snapshots every 15 minutes, once you turn them on
API request limits Yes No Set by you
Audit logs Every interaction logged On, with a direct feed to your AccuKnox SIEM and CDR subscription Turn on server.auditStorage
Location North America, Europe, the Middle East or India On-premises or air-gapped is available Your cluster
Run by AccuKnox AccuKnox Your team

Source: AccuKnox Secrets Management. The rest of this guide covers the self-hosted install.

Prerequisites¶

Requirement Details
CPU and memory 1 vCPU and 512Mi memory minimum, single node
Storage 10Gi of persistent storage
Requirement Details
Kubernetes version 1.30 or later, with a default StorageClass
Helm version Helm 3
kubectl Configured to talk to your cluster
Requirement Details
Worker nodes 3, one Secrets Manager pod per host, ideally one per availability zone
Storage per pod 10Gi for Raft data, plus 10Gi for the audit log when server.auditStorage is on
Network ports 8200 for the API and UI. 8201 between Secrets Manager pods, for Raft and request forwarding
TLS certificate A certificate and key for the 8200 listener, trusted by every client. The listener accepts TLS 1.2 or later by default. See TLS Protects Every Connection
Snapshot bucket An S3-compatible bucket, plus a Kubernetes secret with its access key
Key holders 5 people to hold the unseal key shares. Any 3 unseal the server
Second region Optional, for disaster recovery. See High Availability and Backup

Read Security and Encryption before you choose between key holders and auto-unseal.

Pre-installation Checks¶

Run these three commands before you start:

kubectl version --client
helm version
kubectl get storageclass

The third command must list at least one StorageClass marked (default). Without it, the server pod stays in Pending. See Troubleshooting.

Architecture¶

AccuKnox Secrets Manager architecture

Install With Helm¶

1. Extract the Chart¶

tar xf accuknoxsecretmanager.tar
cd accuknoxsecretmanager

Extracting the Secrets Manager Helm chart

Files inside the extracted chart directory

2. Install the Chart¶

helm upgrade --install vault .

This installs the Secrets Manager server and the Agent Injector into the default namespace. It uses the settings in values.yaml.

Neither way of connecting applications uses the Agent Injector. To leave it out, add --set injector.enabled=false.

To install into your own namespace instead:

kubectl create namespace accuknox
helm upgrade --install vault . -n accuknox

Helm reports a successful install

Check the pod status:

kubectl get po -n accuknox

Secrets Manager pods running

The server pod shows 0/1 until you unseal it in the next step. That is expected.

3. Initialize the Server¶

The server starts sealed and uninitialized. Initialize it once:

kubectl exec vault-accuknoxsecretmanager-0 -n accuknox -- vault operator init

Output of the operator init command

The command prints 5 unseal keys and an initial root token:

Unseal Key 1: <unseal-key-1>
Unseal Key 2: <unseal-key-2>
Unseal Key 3: <unseal-key-3>
Unseal Key 4: <unseal-key-4>
Unseal Key 5: <unseal-key-5>

Initial Root Token: <root-token>

Save these values now

Secrets Manager shows the unseal keys and the root token one time only. Store them in a safe place and distribute the key shares to different people.

Secrets Manager does not store the root key. Without at least 3 of the 5 keys, the server stays sealed forever and the data is unrecoverable.

4. Unseal the Server¶

The default configuration uses 5 key shares with a threshold of 3. Run the unseal command three times, with a different key each time.

Key 1:

kubectl exec vault-accuknoxsecretmanager-0 -n accuknox -- vault operator unseal <unseal-key-1>

First unseal step, progress 1 of 3

Key 2:

kubectl exec vault-accuknoxsecretmanager-0 -n accuknox -- vault operator unseal <unseal-key-2>

Second unseal step, progress 2 of 3

Key 3:

kubectl exec vault-accuknoxsecretmanager-0 -n accuknox -- vault operator unseal <unseal-key-3>

Third unseal step, the server reports Sealed false

After the third key, Sealed reads false and the pod becomes 1/1 Ready.

A restart re-seals the server

If the pod restarts, Secrets Manager seals itself again. Unseal it with any 3 of your 5 saved keys.

Sign In¶

1. Log In with the Root Token¶

kubectl exec -n accuknox vault-accuknoxsecretmanager-0 -- vault login <root-token>

Successful login with the root token

2. Reach the UI¶

Port-forward the service, or expose it through a NodePort or an Ingress.

kubectl port-forward -n accuknox svc/vault-accuknoxsecretmanager 8200:8200

kubectl port-forward handling connections on port 8200

Open http://localhost:8200/ui/vault/auth?with=token.

Sign in with these values:

Field Value
Namespace /
Method Token
Token Your root token

The Secrets Manager sign-in screen

Replace the root token early

Use the root token to create your first admin user and policy. Then stop using it for day-to-day work. See Sharing Secrets in an Organisation.

Other Installation Options¶

The chart ships alternate setups. Pick the one that matches your environment.

The chart includes a separate values file for security context constraints and routes.

helm upgrade --install vault . -f values.openshift.yaml

This mode mounts secrets into pods as volumes. Install the Secrets Store CSI Driver first.

helm upgrade --install vault . --set csi.enabled=true

Run three nodes on Raft storage. See High Availability and Backup for the join and unseal steps.

helm upgrade --install vault . -n accuknox --set server.ha.enabled=true --set server.ha.raft.enabled=true

Install from an internal registry with no internet access. See Air-Gapped Deployment.

Override any setting in values.yaml with --set or with your own values file.

helm upgrade --install vault . -f my-values.yaml

Verify the Installation¶

kubectl get pods -n accuknox
kubectl exec vault-accuknoxsecretmanager-0 -n accuknox -- vault status
kubectl get pvc -n accuknox

Troubleshooting¶

The Server Pod Stays in Pending¶

kubectl get po -n accuknox

The server pod is stuck in Pending

Describe the pod to read its events:

kubectl describe po vault-accuknoxsecretmanager-0 -n accuknox

The pod events report unbound PersistentVolumeClaims

The event reads pod has unbound immediate PersistentVolumeClaims. The StatefulSet asks for a 10Gi volume through the PVC data-vault-accuknoxsecretmanager-0, and no StorageClass can provision it.

Check what storage the cluster offers:

kubectl get storageclass -n accuknox
kubectl get pvc -n accuknox
kubectl get pv -n accuknox

The PVC shows an empty STORAGECLASS column

The STORAGECLASS column on the PVC is empty. The chart did not set storageClassName, so Kubernetes fell back to the default StorageClass. None of the classes in this cluster carries the (default) marker, so the PVC never binds and the pod stays Pending.

Fix it in one of two ways:

kubectl patch storageclass <your-storage-class> \
  -p '{"metadata":{"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'

Then reinstall the chart. The PVC binds and the pod reaches Running.

helm upgrade --install vault . -n accuknox \
  --set server.dataStorage.storageClass=<your-storage-class>

helm upgrade --install vault . -n accuknox \
  --set server.dataStorage.enabled=false

The pod goes Pending → ContainerCreating → Running with no storage attached. Secrets do not survive a pod restart, so use this to confirm the install and nothing else.

Watch the pod come up:

kubectl get po -n accuknox -w

Other Common Errors¶

Symptom Cause Fix
Vault is sealed on every request The pod restarted Unseal with 3 of your 5 saved keys
permission denied on a path The policy does not grant it, or the token predates the policy Edit the policy, then sign out and sign in again
connection refused on port 8200 The port-forward stopped Run the kubectl port-forward command again
localhost:8080 kubectl error KUBECONFIG is not set in your shell Export KUBECONFIG with the path to your kubeconfig file

Next Steps¶

SCHEDULE DEMO