Free hashicorp limitations

Vault
1

Hi,

I would like to use hashicorp free (on-premise) in this context:

  • we have 2 sites,
  • the only keys to store are mariadb encryption keys (encryption at rest, one key per cluster), mainly on galera clusters,
  • the keys are never modified, they are just stored at cluster creation time,
  • there would be one vault per site,
  • the same key needs to be stored “manually” on each site (in each vault) at cluster installation time, there is no need to automatically “sync” the vaults of each site,
  • key is read only when one mariadb server starts (so just in case of reboot/upgrade/network outage/power outage),
  • keys have to be stored on-premise, no cloud communication at all,
  • key write/create: ~50 keys/year, key reads ~2000/year.

Could hashicorp free work (and be sufficient) in this case?

Thanks.

2

The community edition should work for this. TBH, however, it might be a bit overkill to maintain unless this is more of a phase 1 into introducing Vault in your environment.

To back up some, what is your environment? You may already have a secret solution in your platform.

3

We have several subnets, some have mariadb and some have HSM’s… but not all. We have more than 100 mariadb servers, some of them use encryption, and we use the file plugin… which is not a security as encryption key is just a file on the server.

Looking for a better solution, supported, ideally free and not complex to achieve (secure) TDE. It has to work on-premise, mariadb servers are not connected to the internet. The aim would be to script once the hashicorp free solution using ansible, and to reuse it eazily for each server needing encryption.

4

Probably good solution for an air-gapped environment if whatever you run the servers on doesnt provide a good enough secrets solution (k8s secrets for example).

Just be aware that Vault itself also needs to be maintained - version updates, backups, log shipping, etc. I would not recommend a single Vault node if you’re using it to store encryption keys that your entire DB fleet relies on.

I’d also recommend some sort of offline Vault node (like a offline root CA) like an older laptop/mac mini you can encrypt and bring online for emergencies if your Vault cluster(s) have an issue. Keep that system encrypted, offline, and locked away.

5

I guess that:

  • if we put the same encryption keys into one differentvault on each site,
  • each vault vm has backups and snapshots,

we are safe… Unless if a power outage resets vault content (which happens with some HSM’s)?

I guess restoring a snapshot wouldn’t break vault content?