kubernetes部署vaultwarden

1、准备ssl证书（避免通过IP访问网页报错）

通过openssl生成私钥

参考链接：https://blog.csdn.net/qq_42588134/article/details/129378607

2、pv创建

若动态管理无需手动创建，以下只是手动创建官网模板，需自行按照实际情况修改：

apiVersion: v1
kind: PersistentVolume
metadata:
  name: task-pv-volume
  labels:
    type: local
spec:
  storageClassName: manual
  capacity:
    storage: 10Gi
  accessModes:
    - ReadWriteOnce
  hostPath:
    path: "/mnt/data"

3、pvc创建

若动态管理无需手动创建，以下只是手动创建官网模板，需自行按照实际情况修改：

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: task-pv-claim
spec:
  storageClassName: manual
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 3Gi

4、mysql数据库初始化（版本5.7 使用已经存在的数据库，无需重新部署）

创建数据库

mysql -uroot -p '****' -e 'CREATE DATABASE IF NOT EXISTS vault DEFAULT CHARSET utf8 COLLATE utf8_general_ci;'

创建用户

CREATE USER 'vault'@'%' IDENTIFIED BY ‘********';

授权

GRANT ALL PRIVILEGES ON `vault`.* TO `vault`@`%`;

6、部署vaultwarden

使用deployment部署

apiVersion: apps/v1
kind: Deployment
metadata:
  generation: 44
  labels:
    app: vaultwarden
  name: vaultwarden
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: bitwarden
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/restartedAt: "2024-07-01T21:22:46+08:00"
      creationTimestamp: null
      labels:
        app: vaultwarden
    spec:
      containers:
      - env:
        - name: WEBSOCKET_ENABLED
          value: "true"
        - name: SIGNUPS_ALLOWED
          value: "false"
        - name: ADMIN_TOKEN
          value: eMEt*W4ay7
        - name: ROCKET_TLS
          value: '{certs=/ssl/myCA.crt,key=/ssl/myCA.key}'
        - name: DATABASE_URL
          value: mysql://vault:***@<mysql-host>:3306/vault
        image: harbor.zywjjj.cn:8443/library/vaultwarden/server:1.30.5
        imagePullPolicy: Always
        name: server
        ports:
        - containerPort: 80
          protocol: TCP
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /data
          name: vaultwarden-data
        - mountPath: /ssl
          name: vaultwarden-ssl
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      terminationGracePeriodSeconds: 30
      volumes:
      - name: vaultwarden-data
        persistentVolumeClaim:
          claimName: vaultwarden-data-pvc
      - name: vaultwarden-ssl
        persistentVolumeClaim:
          claimName: vaultwarden-ssl-pvc
status:
  availableReplicas: 1

6、ssl证书导入

将前面生成的ssl证书复制进vaultwarden-ssl挂载路径中

7、创建service类型nodeport

kubectl expose deployment vaultwarden --port=80 --type=NodePort

8、访问验证