Back to catalog
Bank-Vaults
Apache-2.0Bank-Vaults automates HashiCorp Vault on Kubernetes with cloud KMS unsealing, declarative CRD configuration, and daemonless pod secret injection.
Open-source alternative to — compare it against:
Overview
Banzai Cloud built Bank-Vaults to automate deploying and operating HashiCorp Vault on Kubernetes. Now a CNCF Sandbox project, it provides a CLI, a Kubernetes operator, and a mutating webhook for automated initialization, KMS unsealing, and direct pod secret injection. That foundation gives platform teams a vendor-neutral way to run production secrets infrastructure on open-source Vault or OpenBao without commercial licenses.
Why Bank-Vaults instead of HashiCorp Vault Enterprise
HashiCorp Vault Enterprise appeals to organizations needing automated cluster operations, cloud KMS unsealing, and compliance without manual key ceremonies. Bank-Vaults delivers those operational capabilities on open-source Vault. Its Kubernetes operator provisions High Availability clusters backed by Raft or etcd, automates TLS certificates, and eliminates Shamir unsealing by encrypting keys with AWS KMS, Azure Key Vault, Google Cloud KMS, or PKCS#11 HSMs. Teams declare auth methods, secret engines, and policies in custom resources, letting GitOps controllers manage configuration changes without bespoke API scripts.
The operational divide centers on internal storage architecture and multi-datacenter topology. Vault Enterprise provides proprietary cross-region replication, automated disaster recovery failover, and multi-tenant namespaces. Bank-Vaults operates within the cluster, leaving cross-datacenter synchronization to external tooling or separate cluster deployments. Operating teams also manage the Kubernetes operator and schedule backups via Velero. For platform engineers running standard Kubernetes clusters who need automated unsealing, declarative configuration, and secret injection, Bank-Vaults delivers Enterprise-grade day-two automation without commercial licensing.
What it does well
- Automated initialization and unsealing: bootstraps Vault and decrypts keys using cloud KMS keyrings or PKCS#11 HSMs, flushing credentials from memory immediately after startup.
- Daemonless secret injection: a mutating webhook injects an in-memory binary that populates environment variables at container launch, leaving no credentials on disk.
- Etcd leakage prevention: bypasses Kubernetes Secret manifests, ensuring sensitive values never persist as plaintext base64 in cluster storage.
- Declarative configuration: reconciles authentication methods, access policies, secret engines, and audit devices directly from Kubernetes custom resources.
