A Vault Tutorial. Part 1

Published: Feb 5, 2019 by Isaac Johnson

While Vault can be installed to a variety of platforms (www.vaultproject.io/downloads.html), one very straight forward approach that will work for later cloud migration is to use the published docker container.

To start, you will still need to download the Vault binary for your local machine in order to use the Vault client.

$ docker run -p 8200:8200
--cap-add=IPC_LOCK -d --name=dev-vault vault

# If you’ve already launched in the past but don’t see it running with docker ps, just start your vault:
$ docker run vault

# If you want to force a token (for automation later, this will become useful):
$ docker run -p 8200:8200
--cap-add=IPC_LOCK -e 'VAULT_DEV_ROOT_TOKEN_ID=5l8v34FMhOVBozD9IAAkHREj' vault
==> Vault server configuration:

             Api Address: http://0.0.0.0:8200
                     Cgo: disabled
         Cluster Address: https://0.0.0.0:8201

Once launched, verify your container is listening on 8200, login with vault login.

#determine the IP
docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
44597b284377 vault "docker-entrypoint.s…" 2 minutes ago Up 2 minutes 0.0.0.0:8200->8200/tcp vigorous_darwin

#login
vault login -address=http://0.0.0.0:8200
Token (will be hidden): 
Success! You are now authenticated. The token information displayed below
is already stored in the token helper. You do NOT need to run "vault login"
again. Future Vault requests will automatically use this token.

Key Value
--- -----
token 5l8v34FMhOVBozD9IAAkHREj
token_accessor 5g5IJ5WZtfIrQ7KpWhFBWELq
token_duration ∞
token_renewable false
token_policies ["root"]
identity_policies []
policies ["root"]

One can create a credential file (plain text) and pass it in with “-” for non-interactive sessions.

You may also use the REST API to login non-interactively (everything you can do in the CLI can be done via API).

You may also use the REST API to login non-interactively (everything you can do in the CLI can be done via API)

One of the nice benefits of running containerized Vault is that you can run multiple instances simultaneously in developer mode simply by using different IPs of containers.

# using pod ip
docker inspect zen_chatterjee | grep IPAddress
            "SecondaryIPAddresses": null,
            "IPAddress": "172.17.0.2",
                    "IPAddress": "172.17.0.2",
$ sudo ifconfig lo0 alias 172.17.0.2
$ sudo vi /etc/hosts
$ cat /etc/hosts | grep vault.local
172.17.0.2	vault.local

$ vault login -address=http://vault.local:8200
Token (will be hidden): 
Success! You are now authenticated. The token information displayed below
is already stored in the token helper. You do NOT need to run "vault login"
again. Future Vault requests will automatically use this token.

Key Value
--- -----
token 5l8v34FMhOVBozD9IAAkHREj
token_accessor 5g5IJ5WZtfIrQ7KpWhFBWELq

Vault binaries are built for a variety of platforms. While our examples above are using Mac and Linux, Windows works just as well:

D:\Vault>vault server -dev
==> Vault server configuration:

             Api Address: http://127.0.0.1:8200
                     Cgo: disabled
         Cluster Address: https://127.0.0.1:8201
              Listener 1: tcp (addr: "127.0.0.1:8200", cluster address: "127.0.0.1:8201", max_request_duration: "1m30s", max_request_size: "33554432", tls: "disabled")
               Log Level: (not set)
                   Mlock: supported: false, enabled: false
                 Storage: inmem
                 Version: Vault v1.0.1
             Version Sha: 08df121c8b9adcc2b8fd55fc8506c3f9714c7e61

WARNING! dev mode is enabled! In this mode, Vault runs entirely in-memory
and starts unsealed with a single unseal key. The root token is already
authenticated to the CLI, so you can immediately begin using Vault.

You may need to set the following environment variable:

    $ set VAULT_ADDR=http://127.0.0.1:8200

Using the Windows Subsystem for Linux in Windows 10, you can use the linux binary as well.

You can see various server configurations here: https://www.vaultproject.io/docs/configuration/

One can now also install Vault into Kubernetes. This requires first a running consul instance (which also now has a helm chart as well):

Consul Helm Chart: https://github.com/helm/charts/tree/master/stable/consul
Vault Helm Chart: https://github.com/helm/charts/tree/master/incubator/vault

Hopefully this short guide helps get you going with launching a local Hashi Vault instance. Next time we’ll cover Vault Usage.