Skip to content

VAULT

9 pages

  • FAQ

    In Module: VAULT

    ReferenceVAULT

    What Does VAULT Do? VAULT supplies KMS (key management) and secrets storage for a Pigsty deployment, covering three main uses: Transparent data encryption: store PGSQL pg_tde master keys so leaked database disks and backups cannot be decrypted …

    What Does VAULT Do? VAULT supplies KMS (key management) and secrets storage for a Pigsty deployment, covering three main uses: Transparent data encryption: store PGSQL pg_tde master keys so leaked database disks and backups cannot be decrypted …

  • Metrics

    In Module: VAULT

    ReferenceVAULT

    This page distinguishes raw OpenBao telemetry from recording metrics evaluated by vmalert. files/victoria/rules/vault.yml defines 14 recording rules. Their results are not available from /v1/sys/metrics. Raw metrics vary with OpenBao version, member …

    This page distinguishes raw OpenBao telemetry from recording metrics evaluated by vmalert. files/victoria/rules/vault.yml defines 14 recording rules. Their results are not available from /v1/sys/metrics. Raw metrics vary with OpenBao version, member …

  • Monitoring

    In Module: VAULT

    ReferenceVAULT

    VAULT reuses Pigsty’s observability stack. OpenBao metrics flow over HTTPS to VictoriaMetrics; service and backup logs flow through Journald / Vector to VictoriaLogs. vmalert loads 14 recording rules and six alerts, and Grafana provides the Vault …

    VAULT reuses Pigsty’s observability stack. OpenBao metrics flow over HTTPS to VictoriaMetrics; service and backup logs flow through Journald / Vector to VictoriaLogs. vmalert loads 14 recording rules and six alerts, and Grafana provides the Vault …

  • Usage

    In Module: VAULT

    ReferenceVAULT

    After configuring and deploying VAULT, use this page to get started. The following engines and authentication methods are enabled by default: Path Type Purpose secret/ KV v2 secrets engine Versioned static secrets such as passwords, API keys, and …

    After configuring and deploying VAULT, use this page to get started. The following engines and authentication methods are enabled by default: Path Type Purpose secret/ KV v2 secrets engine Versioned static secrets such as passwords, API keys, and …

  • Administration

    In Module: VAULT

    TaskVAULT

    Common VAULT administration procedures: Create a Cluster: initialize VAULT. Check Status: inspect cluster, member, and Raft state. Administrator Credentials: use the root token safely. Add Members: add members or scale from one to three nodes. Remove …

    Common VAULT administration procedures: Create a Cluster: initialize VAULT. Check Status: inspect cluster, member, and Raft state. Administrator Credentials: use the root token safely. Add Members: add members or scale from one to three nodes. Remove …

  • Playbooks

    In Module: VAULT

    TaskVAULT

    VAULT provides two playbooks: vault.yml creates, updates, and scales clusters, while vault-rm.yml removes members or the whole cluster. The helper scripts bin/vault-add and bin/vault-rm wrap these playbooks. vault.yml Source: vault.yml Installs, …

    VAULT provides two playbooks: vault.yml creates, updates, and scales clusters, while vault-rm.yml removes members or the whole cluster. The helper scripts bin/vault-add and bin/vault-rm wrap these playbooks. vault.yml Source: vault.yml Installs, …

  • Parameters

    In Module: VAULT

    ReferenceVAULT

    VAULT provides eight parameters in two groups: VAULT: five parameters for deployment and configuration. VAULT_REMOVE: three parameters controlling cluster removal. VAULT deliberately exposes few settings. Member count determines cluster mode, HA …

    VAULT provides eight parameters in two groups: VAULT: five parameters for deployment and configuration. VAULT_REMOVE: three parameters controlling cluster removal. VAULT deliberately exposes few settings. Member count determines cluster mode, HA …

  • Configuration

    In Module: VAULT

    ReferenceVAULT

    Before deploying VAULT, define a group named vault in the inventory. There is no profile or mode parameter: the mode is derived entirely from the number of members in vault. Single node: no HA; suitable for development, testing, demos, and sandboxes. …

    Before deploying VAULT, define a group named vault in the inventory. There is no profile or mode parameter: the mode is derived entirely from the number of members in vault. Single node: no HA; suitable for development, testing, demos, and sandboxes. …

  • Module: VAULT

    In Module: VAULT

    ReferenceVAULT

    OpenBao is an open-source key and secrets management system (MPL-2.0), forked by the community after HashiCorp Vault adopted the BSL license and hosted by the Linux Foundation. Its API is largely compatible with Vault. Pigsty’s VAULT module deploys …

    OpenBao is an open-source key and secrets management system (MPL-2.0), forked by the community after HashiCorp Vault adopted the BSL license and hosted by the Linux Foundation. Its API is largely compatible with Vault. Pigsty’s VAULT module deploys …