{"type":"doc","content":[{"type":"heading","attrs":{"level":1},"content":[{"text":"Migration of Server Config Credentials to Vault","type":"text"}]},{"type":"paragraph"},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"In order to store all application credential in secret way, now store your server config inside vault which is backup by postgres. Application also provide facility to update all configuration using UI.","type":"text"}]},{"type":"paragraph"},{"type":"heading","attrs":{"level":2},"content":[{"text":"Application side configuration ","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Installing fresh Insights application ","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"With Vault ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Configure Vault with Storage Engine as postgres, all configuration steps mention in Annexure A","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add following minimum configuration inside Insights INSIGHTS_HOME\\.InSights\\server-config.json","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"{","type":"text"}]},{"type":"paragraph","content":[{"text":"\"vault\": {","type":"text"}]},{"type":"paragraph","content":[{"text":"\"isVaultEnable\": true,","type":"text"}]},{"type":"paragraph","content":[{"text":"\"vaultEndPoint\": \"http://10.10.90.42:8200/v1\",","type":"text"}]},{"type":"paragraph","content":[{"text":"\"secretEngine\": \"database-insights\",","type":"text"}]},{"type":"paragraph","content":[{"text":"\"vaultToken\": \"\"","type":"text"}]},{"type":"paragraph","content":[{"text":"},","type":"text"}]},{"type":"paragraph","content":[{"text":"\"grafana\":{","type":"text"}]},{"type":"paragraph","content":[{"text":"\"grafanaEndpoint\":\"http://localhost:3000\"","type":"text"}]},{"type":"paragraph","content":[{"text":"},","type":"text"}]},{"type":"paragraph","content":[{"text":"\"trustedHosts\":[","type":"text"}]},{"type":"paragraph","content":[{"text":"\"localhost\"","type":"text"}]},{"type":"paragraph","content":[{"text":"]","type":"text"}]},{"type":"paragraph","content":[{"text":"}","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make sure that isVaultEnable = true with correct vault token, Vault is started and unsealed ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Start Tomcat application ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Login Insights UI with basic grafana credential using user ‘admin’ most probably password is ‘admin’","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"On successful login, It will load server configuration on UI, do the respective changes ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the changes, It will store all your configuration in vault in encrypted format","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If you want to edit any field in server configuration then use Insights UI","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"With Native Grafana authentication there is no need to restart tomcat, it automatically loads server config changes.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In case of SSO, initial login will be with initial grafana credential, do respective changes and restart tomcat.","type":"text"}]}]}]},{"type":"paragraph"},{"type":"heading","attrs":{"level":4},"content":[{"text":"Without Vault ","type":"text"}]},{"type":"paragraph","content":[{"text":"Either configuration start with minimum configuration mention below ","type":"text"}]},{"type":"paragraph","content":[{"text":"{","type":"text"}]},{"type":"paragraph","content":[{"text":"\"vault\": {","type":"text"}]},{"type":"paragraph","content":[{"text":"\"isVaultEnable\": false,","type":"text"}]},{"type":"paragraph","content":[{"text":"\"vaultEndPoint\": \"\",","type":"text"}]},{"type":"paragraph","content":[{"text":"\"secretEngine\": \"\",","type":"text"}]},{"type":"paragraph","content":[{"text":"\"vaultToken\": \"\"","type":"text"}]},{"type":"paragraph","content":[{"text":"},","type":"text"}]},{"type":"paragraph","content":[{"text":"\"grafana\":{","type":"text"}]},{"type":"paragraph","content":[{"text":"\"grafanaEndpoint\":\"http://localhost:3000\"","type":"text"}]},{"type":"paragraph","content":[{"text":"},","type":"text"}]},{"type":"paragraph","content":[{"text":"\"trustedHosts\":[","type":"text"}]},{"type":"paragraph","content":[{"text":"\"localhost\"","type":"text"}]},{"type":"paragraph","content":[{"text":"]","type":"text"}]},{"type":"paragraph","content":[{"text":"}","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Start Tomcat application ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Login Insights UI with basic grafana credential using user ‘admin’ most probably password is ‘admin’","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"On successful login, It will load server configuration on UI, do the respective changes ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Server config changes store in file system with unencrypted format ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"With Native Grafana authentication there is no need to restart tomcat, it automatically loads server config changes.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In case of SSO, initial login will be with initial grafana credential, do respective changes and restart tomcat.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Another way is to configure server config directly on file system INSIGHTS_HOME\\.InSights\\server-config.json and restart tomcat ","type":"text"}]}]}]},{"type":"paragraph"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Upgrade Insights Application ","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"With Vault ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Configure Vault with Storage Engine as “postgres” all configuration steps mention in Annexure A","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Backup your existing server config json file","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add following minimum configuration inside Insights INSIGHTS_HOME\\.InSights\\server-config.json","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"{","type":"text"}]},{"type":"paragraph","content":[{"text":"\"vault\": {","type":"text"}]},{"type":"paragraph","content":[{"text":"\"isVaultEnable\": true,","type":"text"}]},{"type":"paragraph","content":[{"text":"\"vaultEndPoint\": \"http://10.10.90.42:8200/v1\",","type":"text"}]},{"type":"paragraph","content":[{"text":"\"secretEngine\": \"database-insights\",","type":"text"}]},{"type":"paragraph","content":[{"text":"\"vaultToken\": \"\"","type":"text"}]},{"type":"paragraph","content":[{"text":"},","type":"text"}]},{"type":"paragraph","content":[{"text":"\"grafana\":{","type":"text"}]},{"type":"paragraph","content":[{"text":"\"grafanaEndpoint\":\"http://localhost:3000\"","type":"text"}]},{"type":"paragraph","content":[{"text":"},","type":"text"}]},{"type":"paragraph","content":[{"text":"\"trustedHosts\":[","type":"text"}]},{"type":"paragraph","content":[{"text":"\"localhost\"","type":"text"}]},{"type":"paragraph","content":[{"text":"]","type":"text"}]},{"type":"paragraph","content":[{"text":"}","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make sure that isVaultEnable = true with correct vault token, Vault is started and unsealed ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Start Tomcat application ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Login Insights UI with basic grafana credential using user ‘admin’ most probably password is ‘admin’","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"On successful login, It will load server configuration on UI, do the respective changes copy detai from your backup server config ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the changes, It will store all your configuration in vault in encrypted format","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If you want to edit any field in server configuration then use Insights UI","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"With Native Grafana authentication there is no need to restart tomcat, it automatically loads server config changes.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In case of SSO, initial login will be with initial grafana credential, do respective changes and restart tomcat.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Agent Changes with Vault ","type":"text"}]},{"type":"paragraph","content":[{"text":"If existing application have agent configured with vault then it is mandatory to upgrade it using following steps ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Login to Insights UI , go to Agent Configuration ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Changes Agent version >= 7.3","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Update all your secret again so that it will store in new vault ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Restart agent","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"New Agent Registration will affect with these changes ","type":"text"}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Without Vault configuration ","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"Upgrade to version >= 7.3 without vault, It will not affect anything, It is routine update.","type":"text"}]},{"type":"paragraph"},{"type":"paragraph"},{"type":"paragraph"},{"type":"paragraph"},{"type":"paragraph"},{"type":"paragraph"},{"type":"paragraph"},{"type":"paragraph"},{"type":"heading","attrs":{"level":1},"content":[{"text":"Annexure A ","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Vault Changes With postgres DB connection ","type":"text"}]},{"type":"paragraph","content":[{"text":" To configure vault with storage as “postgresql” and search engine as “database” do the following configuration. ","type":"text"}]},{"type":"paragraph","content":[{"text":"Create new ","type":"text"},{"text":"vault_config.hcl","type":"text","marks":[{"type":"strong"}]},{"text":" add following configuration in it ","type":"text"}]},{"type":"paragraph","content":[{"text":"storage \"postgresql\" {","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":2}}],"content":[{"text":"connection_url = \"postgresql://grafana:grafana@localhost:5432/insightsvault?sslmode=disable\"","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"}","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"ui = true","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"log_level=\"trace\"","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"plugin_directory=\"C:\\\\Insights\\\\vault_1.5.5_windows_amd64\\\\plugins\"","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"listener \"tcp\" {","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":" address = \"10.10.90.42:8200\"","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":" tls_disable = 1","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"}","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"api_addr = \"http://127.0.0.1:8200\"","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"cluster_addr = \"http://10.10.90.42:8201\"","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"raw_storage_endpoint=true","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create one ","type":"text"},{"text":"plugins ","type":"text","marks":[{"type":"strong"}]},{"text":"directory inside vault and mention “plugin_directory” path inside vault_config.hcl","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Download latest plugin from ","type":"text"},{"text":"https://github.com/hashicorp/vault/tree/master/plugins/database/postgresql","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/hashicorp/vault/tree/master/plugins/database/postgresql"}}]},{"text":" and store ","type":"text"},{"text":"\\ postgresql-database-plugin ","type":"text","marks":[{"type":"strong"}]},{"text":"folder inside plugin_directory path ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Run following command from command prompt to install plugin in vault","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"vault plugin register -sha256=d3f0a8be02f6c074cf38c9c99d4d04c9c6466249 auth postgresql-database-plugin","type":"text","marks":[{"type":"em"},{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Enable database Secrets Engine plugins:","type":"text"}]},{"type":"paragraph","content":[{"text":"vault secrets enable database ","type":"text","marks":[{"type":"em"},{"type":"strong"}]}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Default path is “database” If you want to change path then run following command ","type":"text"}]},{"type":"paragraph","content":[{"text":"vault secrets enable -path=client1/database","type":"text","marks":[{"type":"em"},{"type":"strong"}]}]},{"type":"paragraph"},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create new Database in vault name as “","type":"text"},{"text":"insightsvault","type":"text","marks":[{"type":"strong"}]},{"text":"”","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add following date table inside new database ","type":"text"}]}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"CREATE TABLE vault_kv_store (","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":" parent_path TEXT COLLATE \"C\" NOT NULL,","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":" path TEXT COLLATE \"C\",","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":" key TEXT COLLATE \"C\",","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":" value BYTEA,","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":" CONSTRAINT pkey PRIMARY KEY (path, key)","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":");","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"CREATE INDEX parent_path_idx ON vault_kv_store (parent_path);","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"CREATE TABLE vault_ha_locks (","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":" ha_key TEXT COLLATE \"C\" NOT NULL,","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":" ha_identity TEXT COLLATE \"C\" NOT NULL,","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":" ha_value TEXT COLLATE \"C\",","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":" valid_until TIMESTAMP WITH TIME ZONE NOT NULL,","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":" CONSTRAINT ha_key PRIMARY KEY (ha_key)","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":");","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph"},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Configure Vault with the proper plugin and connection information","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"vault write database/config/insightsvault plugin_name=postgresql-database-plugin allowed_roles=\"*\" connection_url=\"postgresql://{{username}}:{{password}}@localhost:5432?sslmode=disable\" username=\"grafana\" password=\"grafana\"","type":"text","marks":[{"type":"em"},{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Configure a role that maps a name in Vault to an SQL statement to execute to create the database credential","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"vault write database/roles/insightsvaultrole db_name=insightsvault creation_statements=\"CREATE ROLE \\\"{{name}}\\\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; GRANT SELECT ON ALL TABLES IN SCHEMA public TO \\\"{{name}}\\\";\" default_ttl=\"1h\" max_ttl=\"24h\"","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"make sure that your db_name and database/config/ will be same ","type":"text"}]},{"type":"paragraph","content":[{"text":"Call following ","type":"text"},{"text":"POST","type":"text","marks":[{"type":"strong"}]},{"text":" API store data ","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"http://:/v1/sys/raw/// serverConfig","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"Ex:","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"http://","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"http://10.224.90.42:8200/v1/sys/raw/database/local/serverConfig"}}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"This API need two header X-Vault-Token and host, X-Vault-Token is root token ","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}]},{"type":"paragraph","content":[{"text":"Call following ","type":"text"},{"text":"GET","type":"text","marks":[{"type":"strong"}]},{"text":" API to fetch data from vault ","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"http://:/v1/sys/raw/// serverConfig","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"Ex:","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"http://","type":"text","marks":[{"type":"link","attrs":{"href":"http://10.224.90.42:8200/v1/sys/raw/database/local/serverConfig"}}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"This API need two header X-Vault-Token and host, X-Vault-Token is root token ","type":"text"}]},{"type":"paragraph","content":[{"text":"Create new user name and password to login to vault API rather then using root token","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}]}],"version":1}

Browser not supported