Hello folks<\/p>\n
Today I am going to talk about a great tool from Hashicorp, it’s called Vault (https:\/\/www.vaultproject.io) . This piece of software is in my opinion an essential part it our Devops toolkit. It allows you to safely save, and dynamically generate secrets for your infrastructure. The main use case for me has been to allow me to set passwords in Terraform templates, without exposing the password itself in clear text, \u00a0but for now what I am talking about here is how to install it and get it up and running in your Linux Server, and I will also provide a Dockerfile you can use to spin up a container and play around with vault.<\/p>\n
So let’s get our hands dirty<\/p>\n
1 – Download your binary from\u00a0https:\/\/www.vaultproject.io\/downloads.html , you will see links for MacOS, Linux, BSD etc, choose your own . For example<\/p>\n
#wget\u00a0https:\/\/releases.hashicorp.com\/vault\/0.8.1\/vault_0.8.1_linux_amd64.zip<\/p>\n
2 – Uncompress the archive and copy the file into a directory in $PATH<\/p>\n
#unzip vault_0.8.1_linux_amd64.zip ; cp vault \/usr\/local\/bin<\/p>\n
3 – Test that tou can execute vault.<\/p>\n
#vault -v<\/p>\n
this should return something like<\/p>\n
#vault -v
\nVault v0.8.1 (‘8d76a41854608c547a233f2e6292ae5355154695’)<\/p>\n
Of course your values could be different as newer versions are released. You should also do the same thing on your workstation as the same binary is used for the client too. So download it to your computer expand the zip file and copy it to a location of your choice (as long as that location is in $PATH).<\/p>\n
So , now we have vault in place and we can start the server, this can be done by using the command<\/p>\n
#vault server -config <PATH_TO_CONFIG_FILE><\/p>\n
output will look something like<\/p>\n
Cgo: disabled ==> Vault server started! Log data will stream in below:<\/p>\n Please make sure your firewall allows port 8200\/8201 TCP to this server.<\/p>\n If you want to use Vault inside a docker container you can checkout this git repo , as it contains a Dockerfile and an example configuration file for Vault.<\/p>\n https:\/\/github.com\/ruimoreira\/blogexamples<\/p>\n Ok so now we have vault running. Lets initialize it , I would advise you execute this on your workstation,<\/p>\n Let’s check that we can actually reach it<\/p>\n # vault status URL: GET http:\/\/127.0.0.1:8200\/v1\/sys\/seal-status * server is not yet initialized<\/p>\n so this tells us that we can indeed reach the server, however it’s not initialized.<\/p>\n So let’s do just that.<\/p>\n #vault init<\/p>\n As we can see vault has provided the Unseal Keys, and the Root token to authenticate with.<\/p>\n At this point you need to unseal the vault, and you need to provide 3 keys using vault unseal.<\/p>\n Hope you find this useful and hope to see you again soon.<\/p>\n <\/p>\n Rui Moreira<\/p>\n PS<\/strong>: If you are using a docker container to play around with Vault, the I would like to remind you to use the More information here<\/a><\/p>\n","protected":false},"excerpt":{"rendered":" Hello folks Today I am going to talk about a great tool from Hashicorp, it’s called Vault (https:\/\/www.vaultproject.io) . This piece of software is in my opinion an essential part it our Devops toolkit. It allows you to safely save, and dynamically generate secrets for your infrastructure. The main use case for me has been … Continue reading Hashicorp Vault , keeping things secret – Part 1 install and configure Vault<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":202,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[55,91,6,60,22],"tags":[],"wppr_data":{"cwp_meta_box_check":"No"},"_links":{"self":[{"href":"https:\/\/ruimoreira.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/198"}],"collection":[{"href":"https:\/\/ruimoreira.co.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ruimoreira.co.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ruimoreira.co.uk\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ruimoreira.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=198"}],"version-history":[{"count":16,"href":"https:\/\/ruimoreira.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/198\/revisions"}],"predecessor-version":[{"id":217,"href":"https:\/\/ruimoreira.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/198\/revisions\/217"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ruimoreira.co.uk\/index.php?rest_route=\/wp\/v2\/media\/202"}],"wp:attachment":[{"href":"https:\/\/ruimoreira.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=198"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ruimoreira.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=198"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ruimoreira.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=198"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n==> Vault server configuration:<\/code><\/p>\n
\nListener 1: tcp (addr: “0.0.0.0:8200”, cluster address: “0.0.0.0:8201”, tls: “disabled”)
\nLog Level: info
\nMlock: supported: true, enabled: true
\nStorage: file
\nVersion: Vault v0.8.1
\nVersion Sha: 8d76a41854608c547a233f2e6292ae5355154695<\/p>\nexport VAULT_ADDR='http:\/\/<VAULT_SERVER_IP_ADDRESS>:8200'<\/code><\/pre>\n
\nError checking seal status: Error making API request.<\/p>\n
\nCode: 400. Errors:<\/p>\n
\n#vault init
\nUnseal Key 1: IIeMHIGq+xmIDqXN7Q43Lt7nmi5sLvNad5NgUjOVPoiA
\nUnseal Key 2: phNTpSyjBqobHYeLVOfiaUHQ6iidw2\/BowKnTb3HzaC4
\nUnseal Key 3: jJcuYrSiQRHv0TvD1\/AVrHBpd2f6mjtjriGLa66A2O5b
\nUnseal Key 4: so5WqFp1nmXFeuLE4tUZiglCTEBP2gkc9\/teNZNvVOmz
\nUnseal Key 5: hCNg3wwVfYY\/x0A6TLVmvyKyutilr5qvhkiH4mUDHWXR
\nInitial Root Token: 880fde6a-f672-fe8e-50d0-2e51f566654a
\n<\/code><\/p>\n-p<\/code> option to expose the port of the container you are running vault on.<\/p>\n