Get an overview of HashiCorp's Vault concepts.
Learn how to start a Vault server.
Learn how to use the Vault's postgresql backend.
See an overview of the Vault's SSH backend integration.
This presentation was held on the DigitalOcean Meetup in Berlin. Find more details here: https://www.meetup.com/DigitalOceanBerlin/events/237123195/
30. Start PostgreSQL
$ docker-compose ps
Name Command State Ports
----------------------------------------------------------------------------
vault_db_1 /docker-entrypoint.sh postgres Up 0.0.0.0:9191->5432/tcp
$ docker-compose up -d
31. Mount the PostgreSQL backend
$ vault mount -path=postgresql-test
-default-lease-ttl=30m
-max-lease-ttl=12h
Postgresql
Successfully mounted 'postgresql' at 'postgresql-test'!
32. Verify the PostgreSQL backend
$ vault mounts | head -n1 && vault mounts | grep postgresql
Path Type Default TTL Max TTL Description
postgresql-test/ postgresql 1800 43200
33. Establish connection between
PostgreSQL and Vault
$ source .env.db
$ vault write postgresql-test/config/connection
connection_url="postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@0.0.0.0:9191
/${POSTGRES_DB}?sslmode=disable"
34. Tell Vault how
to create PostgreSQL users
SQL query in readable format
CREATE ROLE "{{name}}" WITH LOGIN PASSWORD "{{password}}"
VALID UNTIL "{{expiration}}";
GRANT SELECT ON ALL TABLES IN SCHEMA public TO "{{name}}";
35. Tell Vault how
to create PostgreSQL users
$ vault write postgresql-test/roles/readonly
sql="CREATE ROLE "{{name}}" WITH LOGIN PASSWORD '{{password}}' VALID
UNTIL '{{expiration}}';
GRANT SELECT ON ALL TABLES IN SCHEMA public TO "{{name}}";"
Success! Data written to: postgresql-test/roles/readonly
36. Generate user with password
$ vault read -format=json
postgresql-test/creds/readonly
| tee postgresql-user-credentials.json
| jq .
40. > SELECT datname AS database,
usename AS user
FROM pg_stat_activity
WHERE state = 'active';
database | user
---------+-------------------------------------------
vault | root-45fb7d50-c99f-dd78-f3c5-e20b9636a300
(1 row)
user with password