Terraform-provider-vault: `vault operator init` resource for initializing the Vault?

[krish7919]

This is more of a question rather than an issue.

What are the ways to initialize vault?
Is there only a _manual_ way to initialize vault?

I understand that Vault must be initialized by a trusted individual/s and that the unseal keys should be maintained by different folks to avoid compromising the security of the credentials infrastructure.

However, our infrastructure is managed by trusted team/individuals who control the overall cluster and it would seem odd to involve a manual step in the way; our terraform.tfstate have a lot of secrets/information which need to be secure, and not just the vault keys. Also, I would like to have a pure infrastructure as code environment to quickly recover or set up a new cluster.

Does it make sense to add a vault_operator_init resource and the vault_operator_unseal resource to the terraform provider to ease deployments and management of vault?

[thardie]

It is strange to me that this has gotten no traction. After installing vault, vault operator init is the first command you have to run. The whole idea of terraform is to automate deployment of infrastructure. Requiring a manual step between creating your infrastructure & deploying vault, then manually initting vault then running another terraform run to configure vault is the antithesis of what terraform is supposed to do. Apparently I'm the only one who feels this way - Did I miss something?

[krish7919]

Exactly. And I run Vault on k8s, and I had started to write a Vault Controller to initialise Vault (https://github.com/krish7919/vault-controller), but have a long way to go there.

This is a core gap in the deployment and usage of Vault.

EDIT: We moved from managing Vault using Terraform a long time ago, as we deployed Vault using Helm on K8s, then do manual stuff, then switch to Terraform to configure, then start using it. It was a pita.