Who can deploy?

Deployment of IBM Vault Self-Managed for Z and LinuxONE requires collaboration across multiple roles with specific responsibilities for infrastructure, security, and operations.

Overview

Successful deployment requires coordination between infrastructure administrators, security specialists, and operations teams. The specific personas involved depend on your deployment platform (zCX or OpenShift), but core responsibilities remain consistent across both environments.

Core personas (all deployments)

Security Administrator

Primary responsibilities: Manages certificates, security policies, and compliance.

Key activities:

  • Generate and manage CA-signed TLS certificates.
  • Define security policies and access controls.
  • Manage Vault root tokens and unseal keys.
  • Implement certificate rotation procedures.
  • Configure audit log monitoring.
  • Ensure compliance verification.
Vault Administrator

Primary responsibilities: Manages Vault cluster operations and configuration.

Key activities:

  • Initialize and unseal Vault cluster.
  • Manage root tokens and distribute unseal keys securely.
  • Configure Vault policies and authentication methods.
  • Enable and manage secrets engines.
  • Configure audit devices.
  • Monitor HA cluster health and Raft cluster management.
  • Perform backup and disaster recovery operations.
Network Administrator

Primary responsibilities: Manages network connectivity and load balancing.

Key activities:

  • Configure load balancer (HAProxy for zCX, OpenShift routes for OpenShift).
  • Manage network routing and DNS configuration.
  • Configure firewall rules and network policies.
  • Monitor load balancer health and traffic distribution.
  • Troubleshoot connectivity issues.
Application Developer

Primary responsibilities: Integrates applications with Vault.

Key activities:

  • Consume secrets from Vault in applications.
  • Integrate applications with Vault API.
  • Implement authentication methods.
  • Manage secret paths and access patterns.

Platform-specific personas

For Vault on zcx deployments

z/OS System Administrator

Primary responsibilities: Manages zCX environment and resources.

Key activities:

  • Manage zCX environment and resource allocation.
  • Configure network connectivity between z/OS and zCX.
  • Provide access to zCX host system.
  • Monitor zCX resource utilization.
Container/Docker Administrator

Primary responsibilities: Manages Docker containers on zCX.

Key activities:

  • Deploy and manage Docker containers on zCX.
  • Configure Docker volumes and networks.
  • Monitor container health and performance.
  • Manage Docker Compose orchestration.

For Vault on OpenShift deployments

Platform/Infrastructure Administrator

Primary responsibilities: Manages OpenShift cluster and resources.

Key activities:

  • Provide OpenShift cluster access and management.
  • Create and configure namespaces.
  • Provision storage classes (ODF RBD).
  • Configure network and routing.
  • Manage resource quotas and limits.
DevOps/Site Reliability Engineer (SRE)

Primary responsibilities: Manages deployment automation and operations.

Key activities:

  • Deploy and upgrade Helm charts.
  • Manage configuration (values.yml).
  • Configure health checks and readiness probes.
  • Tune resource limits and requests.
  • Set up monitoring and telemetry (Prometheus).
  • Troubleshoot pod issues.
  • Verify PVC and storage management.

Key collaboration points

Successful deployment requires coordination between these personas:

  • Security Administrator: Container/Docker Administrator (zCX) or DevOps/SRE (OpenShift): Provides TLS certificates for Vault deployment.
  • z/OS System Administrator: Container/Docker Administrator (zCX only): Grants access to zCX environment and resources.
  • Platform Administrator: DevOps/SRE (OpenShift only): Provides cluster access and namespace configuration.
  • Vault Administrator: Security Administrator: Collaborates on key management, unseal key distribution, and security policies.
  • Network Administrator: All teams: Coordinates on connectivity, load balancing, and network troubleshooting.
  • Application Developer: Vault Administrator: Coordinates on authentication methods, secret paths, and access policies.
Important: Security Administrator and Vault Administrator roles should remain separate in production environments to maintain proper separation of duties for compliance and security best practices.