Encrypt vault_keys.json file
he vault_keys.json is created when you install IA Cloud Enterprise. The file stores credentials, including the root token for accessing the Vault.
Encrypt vault keys
Since storing credentials as cleartext in the file system is not secure, you can encrypt the vault_keys.json file.
To do so, on the MASTER server (MASTER1 for the high-availability mode), where the installer is located, execute the following script:
INSTALLER_DIR= # specify the directory where the installer is located
INSTALL_DIR= # specify the target installation directory where the installed product is located
python_version=$(ls $INSTALLER_DIR/ansible/lib | grep '^python')
export PATH=$INSTALLER_DIR/ansible/bin:$PATH
export PYTHONPATH=$INSTALLER_DIR/ansible/lib/$python_version:$INSTALLER_DIR/ansible/lib/$python_version/site-packages:$PYTHONPATH
export PYTHONHOME=$INSTALLER_DIR/ansible
echo '<SPECIFY_ENCRYPTION_PASSWORD>' | ansible-vault encrypt --vault-password-file=/bin/cat $INSTALL_DIR/vault/keys/vault_keys.json
caution
Remember the password for this file. If vault_keys.json is lost and a Zookeeper node, which also stores content of this file, is corrupted, it is impossible to restore Vault or perform the upgrade procedure.
Decrypt vault keys for upgrade
The upgrade to any version below 10.2.2 requires this file to be in the unencrypted clear-text form, otherwise the procedure fails.
To decrypt the file, execute the following script:
INSTALLER_DIR= # specify the directory where the installer is located
INSTALL_DIR= # specify the target installation directory where the installed product is located
python_version=$(ls $INSTALLER_DIR/ansible/lib | grep '^python')
export PATH=$INSTALLER_DIR/ansible/bin:$PATH
export PYTHONPATH=$INSTALLER_DIR/ansible/lib/$python_version:$INSTALLER_DIR/ansible/lib/$python_version/site-packages:$PYTHONPATH
export PYTHONHOME=$INSTALLER_DIR/ansible
echo '<SPECIFY_ENCRYPTION_PASSWORD>' | ansible-vault decrypt --vault-password-file=/bin/cat $INSTALL_DIR/vault/keys/vault_keys.json