8c2b0de032
Using the etcd v3 api causes vault to suffer from bug https://github.com/hashicorp/vault/issues/4961. But v2 has its own issues *1. This patch switches back to using the v3 api but disables vault from perfomring TLS certificate checks against the etcd cluster. Given that the charm deployed vault only uses etcd to store a token for HA and that token is inturn encrypted by vault it does not seem a significant security risk. *1 As Dmitrii Shcherbakov noted, the vault documentation expresses reservations about the v2 api: https://www.vaultproject.io/docs/configuration/storage/etcd.html "the Etcd storage backend supports high availability. The v2 API has known issues with HA support and should not be used in HA scenarios." Change-Id: I204bcdbfbc7ed2084542fca7781f1bd802bdb77a |
||
|---|---|---|
| .. | ||
| actions | ||
| files/nagios | ||
| lib/charm | ||
| reactive | ||
| templates | ||
| tests | ||
| README.md | ||
| actions.yaml | ||
| config.yaml | ||
| copyright | ||
| icon.svg | ||
| layer.yaml | ||
| metadata.yaml | ||
| test-requirements.txt | ||
| tox.ini | ||
| wheelhouse.txt | ||
README.md
Overview
Vault secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Vault handles leasing, key revocation, key rolling, and auditing. Through a unified API, users can access an encrypted Key/Value store and network encryption-as-a-service, or generate AWS IAM/STS credentials, SQL/NoSQL databases, X.509 certificates, SSH credentials, and more.
About the Charm
This charm installs Vault from the Ubuntu Snap Store and supports the PostgreSQL and MySQL storage backends. Note that Vault itself does not support PostgreSQL 10, so neither does this charm. If you're deploying on bionic, you'll need to deploy a 9.x version of PostgreSQL.
After deploying and relating the charm to postgresql, install the vault snap locally and use "vault init" to create the master key shards and the root token, and store them safely.
Network Spaces support
The vault charm directly supports network binding via the 'access' extra-binding and the 'cluster' peer relation. These allow the Vault API and inter-unit Cluster addresses to be configured using Juju network spaces.