Secret migration to Vault

Adelya Zvyagintseva

When switching from the filesystem (FilesystemBackend) to Vault (VaultBackend), you should migrate existing secrets to Vault. To do this, use the load command of the manage_secrets.py script, which transfers secrets from the secrets_v2.json file to Vault.

IMPORTANT
Reverse migration of secrets from Vault to the filesystem is not supported.

The load command reads secrets from a file (the default is /adcm/data/var/secrets_v2.json) and uploads them to the configured Vault instance.

The command also supports the following flags:

  • --force — allows overwriting existing secrets in Vault.

  • --file <file_path> — defines the path to the secrets file.

To migrate secrets from local storage to Vault, perform the following steps:

NOTE
First, save the token to a file on the host (for example, in /opt/adcm/token), as this file will later be specified in the VAULT_TOKEN_FILE environment variable.

  1. Stop and remove the ADCM container:

    $ sudo docker rm -f adcm
    IMPORTANT
    Do not delete the adcm-data named volume because it contains the secrets file.

  2. Start the ADCM container in MAINTENANCE_MODE, specifying the Vault connection settings without specifying a value for the SECRET_BACKEND variable:

    $ docker run -d -it \
    --name adcm \
    -p 8000:8000 \
    -v adcm-data:/adcm/data \
    -v /opt/adcm/conf/ssl:/etc/ssl/certs \
    -v /opt/adcm/token:/adcm/token \
    -e DB_HOST="<DB_HOST>" \
    -e DB_PORT="<DB_PORT>" \
    -e DB_USER="<DB_USER>" \
    -e DB_NAME="<DB_NAME>" \
    -e DB_PASS="<DB_PASSWORD>" \
    -e VAULT_URL="<VAULT_URL>" \
    -e VAULT_MOUNT_POINT="<VAULT_MOUNT_POINT>" \
    -e VAULT_TOKEN_FILE="/adcm/token" \
    -e MAINTENANCE_MODE=1 \
    hub.arenadata.io/adcm/adcm:<version>

    where <version> is the desired ADCM image version in one of the following formats:

    • <major>.<minor>.<patch> — if you need a specific ADCM patch. For example, 2.0.0.

    • <major>.<minor> — if you need the last patch within the selected ADCM version. For example, 2.0.

    NOTE
    Before ADCM 3.0.0, the MIGRATION_MODE environment variable was used to start the container in maintenance mode.

  3. Upload the secrets to Vault:

    $ docker exec -it adcm /adcm/.venv/bin/python3 /adcm/python/manage_secrets.py load
    NOTE

    In ADCM 2.12.0, use the following command:

    $ docker exec -it adcm python3 /adcm/python/manage_secrets.py load

    Expected command output:

    Secrets were loaded

  4. Stop and remove the ADCM container:

    $ sudo docker rm -f adcm

  5. Start ADCM in normal mode using the SECRET_BACKEND="VaultBackend" variable:

    $ docker run -d \
    --name adcm \
    -p 8000:8000 \
    -v adcm-data:/adcm/data \
    -v /opt/adcm/conf/ssl:/etc/ssl/certs \
    -v /opt/adcm/token:/adcm/token \
    -e DB_HOST="<DB_HOST>" \
    -e DB_PORT="<DB_PORT>" \
    -e DB_USER="<DB_USER>" \
    -e DB_NAME="<DB_NAME>" \
    -e DB_PASS="<DB_PASSWORD>" \
    -e SECRET_BACKEND="VaultBackend" \
    -e VAULT_URL="<VAULT_URL>" \
    -e VAULT_MOUNT_POINT="<VAULT_MOUNT_POINT>" \
    -e VAULT_TOKEN_FILE="/adcm/token" \
    -e VAULT_CA_FILE="<CA_CERT_PATH>" \
    -e VAULT_CLIENT_CERT_FILE="<CLIENT_CERT_PATH>" \
    -e VAULT_CLIENT_KEY_FILE="<CLIENT_KEY_PATH>" \
    hub.arenadata.io/adcm/adcm:<version>

  6. After starting ADCM in normal mode, ensure that:

    • The ADCM web interface is accessible and functioning correctly.

    • Secret entries were successfully created in the Vault interface at the path specified in the VAULT_MOUNT_POINT variable.

Found a mistake? Seleсt text and press Ctrl+Enter to report it