Managing secrets, passwords, ssh keys, access keys etc and sharing with teams or end users securely has become very difficult in today’s complex infrastructure environments. This is where Vault makes your life easy by managing all this sensitive information in a microservice. In this article we are going to do basic Vault setup on a Linux machine and then see its use in subsequent articles.
Setup
- Download Vault Binary package and unzip it inside a directory on your Linux machine. Here we are going to use a Ubuntu 14.1 instance for setup.
wget https://releases.hashicorp.com/vault/0.9.5/vault_0.9.5_linux_amd64.zip unzip vault_0.9.5_linux_amd64.zip
We only need the vault binary file extracted after unzipping. Remove the zip file.
rm -rf vault_0.9.5_linux_amd64.zip
- Download Consul (another open source tool from Hashicorp) which will used as storage backend for Vault.
wget https://releases.hashicorp.com/consul/1.0.6/consul_1.0.6_linux_amd64.zip unzip consul_1.0.6_linux_amd64.zip
We only need the consul binary file extracted after unzipping. Remove the zip file.
rm -rf consul_1.0.6_linux_amd64.zip
- Start the Consul agent by running the below command. Leave the terminal open and open a new terminal for further setup.
./consul agent -dev
- Create a config.hcl file with the following configurations and save it.
storage "consul" {
address = "127.0.0.1:8500"
path = "vault"
}
listener "tcp" {
address = "127.0.0.1:8200"
tls_disable = 1
}
These configurations will be used by Vault to map storage to Consul and Listen on port 8200. For more details on configurations please visit link.
- Set the VAULT_ADDR environment variable which will be used by Vault for any commands executed in the terminal- (please set this environment variable in every new terminal window you open to execute Vault commands)
export VAULT_ADDR='http://127.0.0.1:8200'
- Start the Vault server using the config.hcl file created above-
./vault server -config=config.hcl
Leave this terminal window open and start a new terminal window to execute further commands. Remember to set the VAULT_ADDR in the new session as well.
- Now initialize the Vault by running init command. When we initialize Vault, it returns 5 unseal keys and 1 root token. Copy these unseal keys and root token to a secure file as these cannot be requested later.
./vault operator init
Vault is always started in sealed state so we need to unseal it before we login and use it. To understand the concept of Sealed/UnSealed state please visit link.
- Vault can be UnSealed by using any 3 unique keys out of the 5 generated during Vault initialization. Execute the unseal command 3 times and enter a unique unseal key each time. After 3 attempts, Vault will show the Sealed value as ‘false’ which means Vault is now unsealed and ready for login.
./vault operator unseal
- Login to Vault by using the root token generated at the time of initialization.
./vault login <root token>
Root token has admin privileges on Vault and has no expiry. This root token can be used to create new tokens with sub set of privileges based on requirement.
Check Vault status-
./vault status
This confirms that Vault has been setup successfully and is now ready for use. You can now enable different secret engines on Vault and use them to manage keys and sensitive date.
That is all from scope of this article. We will be showing the use different secret engines in subsequent articles.
Please let us know if you run into any issue by posting in comments or via contact us section.
Thanks for checking out !
- Setup and operate ELK Stack on Kubernetes cluster using Argo CD - October 26, 2020
- Auto clear notification using Watcher - June 10, 2020
- All about Alerting in ELK stack - June 4, 2020
