Configuring
Suggest editsImplementing Hashicorp Vault with EDB Postgres Advanced Server version 15.2 and later or EDB Postgres Extended Server version 15.2 and later requires the following components:
- EDB Postgres distribution (15.2 or later)
- Hashicorp Vault v1.13.3
Note
We refer to EDB Postgres Advanced Server version 15.2 and later and EDB Postgres Extended Server version 15.2 and later as the EDB Postgres distribution. The specific distribution type depends on your needs and preferences.
Prerequisites
- A running EDB Postgres distribution
- Hashicorp Vault installed and deployed per your VM environment
Enable Hashicorp Vault transit secrets engine
Note
You must set your environment variable with Hashicorp Vault. If you receive the error message “Get "https://127.0.0.1:8200/v1/sys/seal-status": http: server gave HTTP response to HTTPS client”, you need to issue this command at your command line: export VAULT_ADDR="http://127.0.0.1:8200
.
After you install and deploy your Hashicorp Vault configuration per the guidelines in the Hashicorp documentation, you must then enable the transit secrets engine.
Assume root user.
Set your two variables, your API address, and the token you receieved during installation and setup:
- Before you enable the transit secrets engine, you can check your Vault server status using
vault status
:
- Enter
vault secrets enable transit
:
- Create your encryption key with an identifiable name, for example:
vault write -f transit/keys/pg-tde-master-1
Your encryption key is now set and you are ready to export your WRAP and UNWRAP commands and initialize your database.
Could this page be better? Report a problem or suggest an addition!