Hello,
We have low memory platforms where memory usage is a concern and we want to use vault for storing some secrets and query using telegraf
We are using simple file storage as shown below
storage “file” {
path = “/var/lib/vault/”
}
With this, we are seeing ~190MB memory usage, and with mlock disabled I am seeing ~56MB.
/usr/local/bin/vault server -config=/etc/vault_config.hcl
Address           Kbytes     RSS   Dirty Mode  Mapping
0000000000400000   36700   36700       0 r-x-- vault
00000000027d7000   49768   49768       0 r---- vault
0000000005871000     568     568     568 rw— vault
00000000058ff000     196     196     196 rw—   [ anon ]
000000c000000000   65536   65536   65536 rw—   [ anon ]
0000146789a8c000   37316   37316   37316 rw—   [ anon ]
00007ffd37067000     132     132     132 rw—   [ stack ]
00007ffd3717a000      12       0       0 r----   [ anon ]
00007ffd3717d000       8       8       0 r-x--   [ anon ]
ffffffffff600000       4       0       0 r-x--   [ anon ]
---------------- ------- ------- -------
total kB          190240  190224  103748
with mlock disabled
Address           Kbytes     RSS   Dirty Mode  Mapping
0000000000400000   36700   23196       0 r-x-- vault
00000000027d7000   49752   22436       0 r---- vault
000000000586d000     568     504      92 rw— vault
00000000058fb000     196     116     116 rw—   [ anon ]
000000c000000000   65536    8304    8304 rw—   [ anon ]
000014a6059d5000   37316     596     596 rw—   [ anon ]
00007fffe67bf000     132      12      12 rw—   [ stack ]
00007fffe67f0000      12       0       0 r----   [ anon ]
00007fffe67f3000       8       4       0 r-x--   [ anon ]
ffffffffff600000       4       0       0 r-x--   [ anon ]
---------------- ------- ------- -------
total kB          190224   55168    9120
as per documentation mlock disable is not recommended as swap on our systems is NOT encrypted, but disk may be encrypted.
So, I want to understand how I can reduce the memory used by Vault in above scenario where some how I configure to minimum possible values and lock only few pages instead ~100MB seen.
Also on the code front, can I reduce further size of vault by removing any optional modules possible (No HA, No Replication, No Consul, No integrated memory etc. which are not used for above simple configuration?)
Please do let me know if there are any other ways possible apart from file storage option (but that should not result in adding more modules etc. which will in turn increase memory usage ultimately)
Thanks,
VT