Do you support HCP Vault?

[ziheng-dev]

I registered an account on https://www.vaultproject.io/ and created a Vault Secrets app and secret, but how can I use the pg_tde_add_key_provider_vault_v2() to add provider?

[dutow]

Hello

Vault Secrets and the HashiCorp Vault Server are two different things. I never used their online interface before, but by looking at it, I think the equivalent is "Vault Dedicated" - or you can simply set it up yourself on your computer for testing: https://developer.hashicorp.com/vault/docs/concepts/dev-server

[ziheng-dev]

Hello, Thanks for response,

I am trying to use the hashicorp/vault docker image to run the vault on my computer, but it shows error when I try to set the principal key, here are the steps to reproduce:

Config the Vault:

1. run vault docker: docker run --name vault --cap-add=IPC_LOCK -p 8200:8200 hashicorp/vault
2. after run the command, it shows the Root Token, record {Vault root token} for the next steps.
3. open the link http://127.0.0.1:8200/ and input the {Vault root token} to login.
4. on Dashboard page, click the secret/ in Secretes engines.
5. click the Create secret button
6. input the path (test), Secret key (testkey) and value (123456789), then save
7. it shows the API path is /v1/secret/data/test, and I can get key using Postman (Auth Type: Bearer Token {Vault root token}) form this link: http://127.0.0.1:8200/v1/secret/data/test.

Config the pg_tde:

1. run the pg_tde docker: docker run --name pg-tde -e POSTGRES_PASSWORD=mysecretpassword -p 5432:5432 -d perconalab/pg_tde
2. use PgAmdmin to connect to the database and open Query tool.
3. use function to add key provider:
   SELECT pg_tde_add_key_provider_vault_v2( 'vault-provider', '{Vault root token}', 'http://127.0.0.1:8200', 'secret', NULL);
4. I can verify the provider is added by this function: SELECT * FROM pg_tde_list_all_key_providers();
5. set the principal key: select pg_tde_set_principal_key('testkey','vault-provider'), I also tried select pg_tde_set_principal_key('test','vault-provider') and select pg_tde_set_principal_key('test/testkey','vault-provider'), they are showing the same error.

WARNING:  HTTP(S) request to keyring provider "vault-provider" failed

ERROR:  Error code: 6failed to retrieve principal key from keyring provider :"vault-provider" 

ERROR:  failed to retrieve principal key from keyring provider :"vault-provider"
SQL state: XX000
Detail: Error code: 6

I have a question here, how to set the path (test)?

Maybe I'm not using the function's parameters correctly, please help to check.
Thanks again.

[dutow]

Hello!

5 - there's no need to create a secret manually, it will be created by pg_tde

Regarding the error, the problem is there in the output:

WARNING:  HTTP(S) request to keyring provider "vault-provider" failed

Which means pg_tde can't connect to the address you specified (http://127.0.0.1:8200)

This is most likely because both of them are docker containers, and this is not how networking works in docker. Ports are only mapped to the host, not inside the container. Inside a container you have to specify the proper ip, and to query that you have to use docker inspect on the vault container.

[ziheng-dev]

Thanks for the help, it's working now after I changed the link to http://host.docker.internal:8200 in pg_tde_add_key_provider_vault_v2 function.