Setup Vault in HA with MySQL backend in 10 minutes | Hashicorp | Tutorial | Tharun
Tags: devops, security, tutorial, beginners
Published: 2022-01-16 05:35:10

## How to set up Vault in High Availability ( HA mode ) with MySQL as storage backend

In this tutorial we will look at how we can use MySQL as a backend to Vault. This setup will involve end to end TLS. We have already seen how to setup Vault with TLS frontend. We also saw how we can setup MySQL with TLS frontend. In this tutorial, we will look at how we can use TLS Enabled MySQL as a storage backend to Vault. This is a complete secure production setup.

Tutorial on how to setup Vault Dev & Production mode:

{% link https://dev.to/developertharun/hashicorp-vault-dev-and-prod-server-setup-unseal-policies-tls-setup-48mo %}

Tutorial on how to setup TLS/SSL enabled MySQL/MariaDB:

{% link https://dev.to/developertharun/easiest-way-to-setup-mysqlmariadb-with-tlsssl-in-10-minutes-v105-any-os-ubuntu-focal-developer-tharun-4okc %}

## Create Vault user in MySQL

The Vault service needs credentials to login into MySQL server in order to store data and metadata in a backend. We will create this user in MySQL now.

```bash
mysql -uroot -p --ssl-ca=/etc/mysql/certs/ca.pem
<Enter password>
```

```sql
# create user
CREATE USER '<vault-mysql-username>'@'%' IDENTIFIED BY '<vault-mysql-password>';

# grant privileges
GRANT ALL PRIVILEGES ON vault.* TO '<vault-mysql-username>'@'%';
```

## MySQL Bind Address

When setting up Vault, I came across difficulties bringing up the Vault server. I have listed the challenges and solution at the end of this post. One point I would like to address is the MySQL Bind address. This configuration of MySQL defines to which network interface the MySQL process binds to / listens on. The other clients such as Vault will be able to access MySQL by sending requests to this particular interface only.

We have seen where to set this in the below tutorial

{% link https://dev.to/developertharun/easiest-way-to-setup-mysqlmariadb-with-tlsssl-in-10-minutes-v105-any-os-ubuntu-focal-developer-tharun-4okc %}

## MySQL CA Pem file

Vault server needs the CA.pem of the MySQL server that we used in the MySQL TLS setup tutorial. Copy that to a  directory that vault can access

```bash
cp ~/certs/ca.pem /opt/vault/tls/mysql-ca.pem

chown -R vault: /opt/vault/tls
```

## Vault config

In the above tutorials we have setup Vault, now let us configure it to use MySQL Backend. 

`/etc/vault.d/vault.hcl`:

```yaml
ui = true ## or false

# MySQL backend config
storage "mysql" {
  ha_enabled = "true"
  address = "<mySQL-hostname>:3306"
  username = "<vault-mysql-username>"
  password = "<vault-mysql-password>"
  database = "<vault-mysql-database>"
  #plaintext_connection_allowed = "true" #non-TLS mysql
  #path to CA.pem to verify MySQL SSL
  tls_ca_file = "<path-to-mysql-ca-pem>" 
}

# Vault server listen configuration
listener "tcp" {
  address       = "<vault-hostname/IP>:8200"
  tls_cert_file = "<path-to-vault-tls-cert>"
  tls_key_file  = "<path-to-vault-tls-key>"
}

# the address to advertise for HA purpose
api_addr="https://<vault-hostname>:8200"
```

## Restart Vault

Now we can go ahead export the Vault variables and restart the vault server

```bash
export VAULT_ADDR="https://<vault-server>:8200"
export VAULT_CACERT="<path-to-vault-tls-cert>"

# make sure MySQL is running and listening

# now restart / start Vault
service vault start 

# or
service vault restart

# check Vault server logs
journalctl -u vault.service 

# check Vault status
vault status
```

We have successfully setup Vault with TLS frontend, TLS MySQL backend, thereby securing Vault end to end making it a perfect Production setup.

Although there are 18 ways in which a Hashicorp Vault server can be attacked, and I have covered it in the below Video

{% youtube 3ikQlRQAso4 %}

# Thank you for reading, This is Tharun Shiv a.k.a Developer Tharun

![Tharun Shiv](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xtxq6bdms36fmn62450h.png)

You can find more articles here: https://dev.to/developertharun

_Roadrunners is a series that is aimed at delivering concepts as precisely as possible. Here, a roadrunner is referred to as a person who does things super fast & efficiently. Are you a roadrunner?_

Thank you