The article demonstrates the behavior of Vault's namespace lock feature within a Performance Replication setup. We explore how locking a namespace in the Performance Primary cluster not only affects that cluster but also replicates its impact to the corresponding namespace in the Performance Secondary cluster.
Prerequisites:
- Performance Replication setup
- Familiarity with Vault namespaces
Procedures:
1. Setup and initial configuration
-
In the Performance Primary cluster, create a namespace (ns1) and a child namespace (
ns1/ns2):
$ vault namespace create ns1/
Key Value
--- -----
custom_metadata map[]
id cpBbE
path ns1/
$ export VAULT_NAMESPACE=ns1
$ vault namespace create ns2/
Key Value
--- -----
custom_metadata map[]
id RULiI
path ns1/ns2/
-
Enable the
kv-v2secrets engine and write a secret:
/ $ vault secrets enable kv-v2
Success! Enabled the kv-v2 secrets engine at: kv-v2/
$ vault kv put -mount=kv-v2 my-secret foo=a bar=b
==== Secret Path ====
kv-v2/data/my-secret
======= Metadata =======
Key Value
--- -----
created_time 2024-01-26T04:00:38.025692553Z
custom_metadata <nil>
deletion_time n/a
destroyed false
version 1
2. Locking the Namespace
- Lock the ns1 namespace. Make an attempt to read the secret:
$ vault namespace lock
Key Value
--- -----
unlock_key q86NQonU3GII4Cbvxd7os2vP
$ vault kv get -mount=kv-v2 my-secret
Error reading kv-v2/data/my-secret: Error making API request.
Namespace: ns1/
URL: GET http://127.0.0.1:8200/v1/kv-v2/data/my-secret
Code: 503. Errors:
* 1 error occurred:
* API access to this namespace has been locked by an administrator - "ns1/" must be unlocked to gain access.
3. Replication verification on the Performance Secondary cluster:
- Switch to the Performance Secondary cluster, and verify the lock status of the namespace has been replicated:
export VAULT_NAMESPACE=ns1
$ vault kv get -mount=kv-v2 my-secret
Error reading kv-v2/data/my-secret: Error making API request.
Namespace: ns1/
URL: GET http://127.0.0.1:8200/v1/kv-v2/data/my-secret
Code: 503. Errors:
* 1 error occurred:
* API access to this namespace has been locked by an administrator - "ns1/" must be unlocked to gain access.
4. Unlocking the Namespace
- Back on the Performance Primary, unlock ns1:
$ vault namespace unlock -unlock-key q86NQonU3GII4Cbvxd7os2vP
- Verify the namespace is now unlocked and the secret can be read from both clusters:
$ vault kv get -mount=kv-v2 my-secret
==== Secret Path ====
kv-v2/data/my-secret
======= Metadata =======
Key Value
--- -----
created_time 2024-01-26T04:00:38.025692553Z
custom_metadata <nil>
deletion_time n/a
destroyed false
version 1
=== Data ===
Key Value
--- -----
bar b
foo a
- Namespace locking is an important feature for access control. Locking a namespace in the Primary replicates the lock to the Secondary, ensuring consistent security policies across clusters.