Encrypt vault_keys.json file
The vault_keys.json is created when you install IA Cloud Enterprise. The file stores credentials, including the root token for accessing the Vault.
Encrypt vault keys
Since storing credentials as cleartext in the file system is not secure, you can encrypt the vault_keys.json file.
To do so, on the INT server (INT1 for the high-availability mode), where the installer is located, execute the following script:
INSTALLER_DIR= # specify the directory where the installer is located
INSTALL_DIR= # specify the target installation directory where the installed product is located
export PATH=$INSTALLER_DIR/ansible/bin:$PATH
export PYTHONPATH=$INSTALLER_DIR/ansible/lib
echo '<SPECIFY_ENCRYPTION_PASSWORD>' | ansible-vault encrypt --vault-password-file=/bin/cat $INSTALL_DIR/vault/keys/vault_keys.json
caution
Remember the password for vault_keys.json. If the file is lost and the ZooKeeper node, also storing its content, is corrupted, it is impossible to restore the Vault or perform the upgrade procedure.
Decrypt vault keys for upgrade
The upgrade from 10.1.6.x to any version below 10.1.6.2 requires this file to be in the unencrypted clear-text form, otherwise the procedure fails.
To decrypt the file, execute the following script:
INSTALLER_DIR= # specify the directory where the installer is located
INSTALL_DIR= # specify the target installation directory where the installed product is located
export PATH=$INSTALLER_DIR/ansible/bin:$PATH
export PYTHONPATH=$INSTALLER_DIR/ansible/lib
echo '<SPECIFY_ENCRYPTION_PASSWORD>' | ansible-vault decrypt --vault-password-file=/bin/cat $INSTALL_DIR/vault/keys/vault_keys.json