Using CD Pipelines to Upgrade Vault at Scale
summary
Describes an automated CD pipeline that upgrades Wix’s multi‑regional, DR‑replicated HashiCorp Vault clusters on Kubernetes by sequencing upgrades from DR secondaries to performance secondaries and finally the primary, enforcing that upstream versions are older than downstream. Uses the official Helm chart which defaults to an on-delete rolling strategy (requiring manual pod deletion), adds a synthetic sidecar that GETs a known secret for functional tests, shifts traffic via DNS and pre‑warms DCs, and runs the pipeline in GitHub Actions with a short maintenance window for the in‑place primary upgrade.
AI-written summary · about
chapters (8)
- 0:00Introduction and background
- 2:28Wix production change approach
- 5:20Vault cluster architecture overview
- 6:23Upgrading DR secondary clusters
- 8:48Upgrading performance secondary clusters
- 10:59Full CD pipeline for Vault upgrades
- 12:26Beyond upgrades: Migrating storage
- 13:30Recap and summary
related talks
01h 03mSecuring Legacy Applications and Container Microservices in Kubernetes
23mTake Control of Your Data by Integrating HashiCorp Vault
25mAutomating Kubernetes Upgrades for Zero Downtime
26mHigh Availability Vault with DynamoDB in Kubernetes
10mLightning Talk: Exploring HashiCorp Vault and ArgoCD - the GitOps Way
49mUsing HashiCorp Vault with Kubernetes
28mSelf-Service Vault in Kubernetes
31mUsing dynamic secrets for third-party Kubernetes applications at scale