Free hashicorp limitations

Vault
1

Hi,

I would like to use hashicorp free (on-premise) in this context:

  • we have 2 sites,
  • the only keys to store are mariadb encryption keys (encryption at rest, one key per cluster), mainly on galera clusters,
  • the keys are never modified, they are just stored at cluster creation time,
  • there would be one vault per site,
  • the same key needs to be stored “manually” on each site (in each vault) at cluster installation time, there is no need to automatically “sync” the vaults of each site,
  • key is read only when one mariadb server starts (so just in case of reboot/upgrade/network outage/power outage),
  • keys have to be stored on-premise, no cloud communication at all,
  • key write/create: ~50 keys/year, key reads ~2000/year.

Could hashicorp free work (and be sufficient) in this case?

Thanks.

2

The community edition should work for this. TBH, however, it might be a bit overkill to maintain unless this is more of a phase 1 into introducing Vault in your environment.

To back up some, what is your environment? You may already have a secret solution in your platform.

3

We have several subnets, some have mariadb and some have HSM’s… but not all. We have more than 100 mariadb servers, some of them use encryption, and we use the file plugin… which is not a security as encryption key is just a file on the server.

Looking for a better solution, supported, ideally free and not complex to achieve (secure) TDE. It has to work on-premise, mariadb servers are not connected to the internet. The aim would be to script once the hashicorp free solution using ansible, and to reuse it eazily for each server needing encryption.