VaultWarden Installation

Summary

VaultWarden을 k3s 환경으로 설치하는 과정을 기록했습니다.

Secret 생성

VaultWarden의 민감한 정보를 Secret이라는 형태로 저장합니다. .env 파일과 동일한 형태로 비밀번호, API 키 등을 보관하면 됩니다.

kubectl create secret generic vaultwarden-secret \
--from-literal=ADMIN_TOKEN=<your-admin-token> \
--from-literal=SMTP_PASSWORD=<your-smtp-password> \
-n <name-space>

yaml

ConfigMap

VaultWarden의 환경 변수를 ConfigMap으로 저장하여 사용합니다.

vaultwarden.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: vaultwarden-config
  namespace: core-infra
data:
  DOMAIN: "https://vault.junbeom.work"
  SIGNUPS_ALLOWED: "false"
  INVITATIONS_ALLOWED: "true"
  SIGNUPS_VERIFY: "true"
  SHOW_PASSWORD_HINT: "false"
  WEB_VAULT_ENABLED: "true"
  WEBSOCKET_ENABLED: "true"
  ROCKET_WORKERS: "10"
  SMTP_HOST: "smtp.resend.com"
  SMTP_FROM: "[email protected]"
  SMTP_FROM_NAME: "My Vault"
  SMTP_PORT: "587"
  SMTP_SECURITY: "starttls"
  SMTP_USERNAME: "resend"
  SMTP_TIMEOUT: "30"
  SMTP_DEBUG: "true"

PVC

VaultWarden의 데이터를 저장하는 공간을 요청합니다.

vaultwarden.yaml

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: vaultwarden-pvc
  namespace: core-infra
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: local-path
  resources:
    requests:
      storage: 5Gi

Service

VaultWarden의 네트워크 설정 관련 객체입니다.

vaultwarden.yaml

apiVersion: v1
kind: Service
metadata:
  name: vaultwarden-svc
  namespace: core-infra
spec:
  type: ClusterIP
  selector:
    app: vaultwarden
  ports:
    - port: 80
      targetPort: 80

Deployment

VaultWarden 애플리케이션의 실행을 담당합니다.

vaultwarden.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: vaultwarden
  namespace: core-infra
  labels:
    app: vaultwarden
    category: security-identity
spec:
  replicas: 1
  selector:
    matchLabels:
      app: vaultwarden
  template:
    metadata:
      labels:
        app: vaultwarden
    spec:
      containers:
        - name: vaultwarden
          image: vaultwarden/server:latest
          ports:
            - containerPort: 80
          
          envFrom:
            - configMapRef:
                name: vaultwarden-config
          
          # ==========================================
          # 환경변수 설정 (일반 설정은 평문, 비밀값은 Secret 참조)
          # ==========================================
          env:
            - name: ADMIN_TOKEN
              valueFrom:
                secretKeyRef:
                  name: vaultwarden-secret
                  key: ADMIN_TOKEN
            - name: SMTP_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: vaultwarden-secret
                  key: SMTP_PASSWORD
 
          # ==========================================
          # 헬스체크 (httpGet 방식으로 최적화)
          # ==========================================
          livenessProbe:
            httpGet:
              path: /alive
              port: 80
            initialDelaySeconds: 30
            periodSeconds: 30
            timeoutSeconds: 10
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /alive
              port: 80
            initialDelaySeconds: 15
            periodSeconds: 10
 
          # ==========================================
          # 리소스 제한
          # ==========================================
          resources:
            requests:
              cpu: "100m"
              memory: "128Mi"
            limits:
              cpu: "1.0"
              memory: "512Mi"
 
          # ==========================================
          # 볼륨 마운트
          # ==========================================
          volumeMounts:
            - name: vaultwarden-data
              mountPath: /data/
 
      volumes:
        - name: vaultwarden-data
          persistentVolumeClaim:
            claimName: vaultwarden-pvc
 

Ingress

VaultWarden의 HTTP/HTTPS 통신 규칙 설정입니다. Traefik으로 SSL 인증서를 자동 발급받습니다.

vaultwarden.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: vaultwarden-ingress
  namespace: core-infra
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-cloudflare"
spec:
  ingressClassName: traefik
  tls:
    - hosts:
        - vault.junbeom.work # 실제 사용할 도메인
      secretName: vaultwarden-tls-secret
  rules:
    - host: vault.junbeom.work # 실제 사용할 도메인
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: vaultwarden-svc
                port:
                  number: 80

Tip

모든 객체는 vaultwarden.yaml에 포함됩니다.

Installation

데이터 마이그레이션

Docker 환경에서 사용할 때의 데이터를 k3s 환경으로 마이그레이션합니다.

1. 파드 일시정지

kubectl scale deployment vaultwarden --replicas=0 -n <name-space>

2. PVC 폴더 이름 확인

sudo ls -l /var/lib/rancher/k3s/storage/ | grep vaultwarden

3. 기존 데이터 복사

sudo cp -a /opt/data/vaultwarden/* /var/lib/rancher/k3s/storage/<directory-name>/

4. 파드 재시작

kubectl scale deployment vaultwarden --replicas=1 -n <name-spcae>

Success