Skip to main content

Encrypt vault_keys.json file

The vault_keys.json is created when you install Work.AI. The file stores credentials, including the root token for accessing the Vault.

Encrypt vault keys​

Since storing credentials as cleartext in the file system is not secure, you can encrypt the vault_keys.json file.

To do so, on the Master server (MASTER1 for the high-availability mode) where the installer is located, execute the following script:

INSTALLER_DIR= # specify the directory where the installer is located
INSTALL_DIR= # specify the target installation directory where the installed product is located

python_version=$(ls $INSTALLER_DIR/ansible/lib | grep '^python')

export PATH=$INSTALLER_DIR/ansible/bin:$PATH
export PYTHONPATH=$INSTALLER_DIR/ansible/lib/$python_version:$INSTALLER_DIR/ansible/lib/$python_version/site-packages:$PYTHONPATH
export PYTHONHOME=$INSTALLER_DIR/ansible

echo '<SPECIFY_ENCRYPTION_PASSWORD>' | ansible-vault encrypt --vault-password-file=/bin/cat $INSTALL_DIR/vault/keys/vault_keys.json
caution

Remember the password for vault_keys.json. If the file is lost and the ZooKeeper node storing its content is corrupted, it is impossible to restore the Vault or perform the upgrade procedure.