enterprise

HashiCorp Vault Enterprise (HVE) is the next version up from the open source version. HVE is the solution for secrets management when an organization has to manage secrets across the organization – locally, regionally, or globally. This version also added functionality that is needed to ensure management of secrets on a larger scale. Functionality like Performance and DR Replication, Sentinel, and Performance Standby are just a few examples. In order to use the HVE, an organization has to procure a license that will enable all of the enterprise features. This license can be obtained from an HashiCorp partner (ah hmmm…..RheoData) or from the HashiCorp sales teams. Like many other vendors, the licenses that are provided typically have a expiration date on them. The expiration date corresponds to the terms of the license agreement and may expire is agreements are not renewed on a timely basis. This post is intended to show you how easy it is to update the license for HVE once obtained. Messages As the license counts down the days remaining, the HashiCorp Vault administrator may start seeing messages in their console or logs that reference when the license will expire. These messages look something like this: 2021-01-30T23:48:41.428Z [WARN] core.licensing: core: licensing warning: expiration_time=”2021-01-31 00:00:00 +0000 UTC” time_left=11m19s 2021-01-31T01:49:31.928Z [ERROR] core.licensing: core: licensing error: error=”invalid license or license is expired” 2021-01-31T01:49:31.928Z [INFO] core: marked as sealed 2021-01-31T01:49:31.929Z [INFO] core: pre-seal teardown starting 2021-01-31T01:49:31.929Z [INFO] core: stopping replication 2021-01-31T01:49:31.929Z [INFO] core: closed sync connection 2021-01-31T01:49:31.930Z [INFO] core: replication stopped 2021-01-31T01:49:31.930Z [INFO] rollback: stopping rollback manager 2021-01-31T01:49:31.931Z [INFO] secrets.database.database_560ae076: stopping periodic ticker 2021-01-31T01:49:31.931Z [INFO] core: pre-seal teardown complete 2021-01-31T01:49:32.432Z [INFO] core: stopping cluster listeners 2021-01-31T01:49:32.432Z [INFO] core.cluster-listener: forwarding rpc listeners stopped 2021-01-31T01:49:32.834Z [INFO] core.cluster-listener: rpc listeners successfully shut down 2021-01-31T01:49:32.835Z [INFO] core: cluster listeners successfully shut down 2021-01-31T01:49:32.835Z [INFO] core: vault is sealed If your license happens to expire, you will not be able to use the enterprise functionality and preventing you from logging into the HashiCorp Vault Cluster. Updating License Before the license expires, it is a good idea to renew your agreement and obtain a new license. Once obtained, the HashiCorp Vault Cluster needs to be updated. By logging into either the primary or standby cluster the license can be updated by using the vault write command. vault write /sys/license text={license key} This writes the license to the cluster and allows for continued operations. What to do if license expires? In the messages above, you will notice that the license expired. This prevented us form unsealing the HashiCorp Vault when wanting to work with it. In order to get around this and apply the new license, the following steps needed to be done: 1. Stop Vault kill -9 2. Restart Vault /opt/app/hashicorp/bin/vault server -config=/opt/app/hashicorp/config/vault.hcl & 3. Unseal Vault vault operator unseal 4. Apply new license key vault write /sys/license text={license key} Validate the License There are two ways to validate the license has been successfully applied. The first way is via the command line and the second is within the UI provide by vault. 1. Check via command line. From the command line run a vault read command and provide the directory path for the license. vault read /sys/license The resulting output will show the status of the license. The expiration date is what you want to look at (this has been highlighted) [vault@vault16 ~]$ vault read /sys/license Key Value --- ----- expiration_time 2021-07-31T00:00:00Z features [HSM Performance Replication DR Replication MFA Sentinel Seal Wrapping Control Groups Performance Standby Namespaces KMIP Entropy Augmentation Transform Secrets Engine Lease Count Quotas Key Management Secrets Engine] license_id 69629a66-32d0-4b6f-92a7-c5f4ebaadea6 performance_standby_count 9999 start_time 2021-01-29T00:00:00Z 2. Check via UI Within the UI, in the far right-hand corner is a “status” menu. Under this menu, there is an option for License. This will bring up the License page. This page will show you the License ID and Valid From information. You can also update the license from this page if needed. The image below shows you what this looks like. Enjoy!!! @dbasolved

enterprise

Updating HashiCorp Vault Enterprise Licensing

Recent Posts

The Bowl Is Broken: A CEO's Note on Mental Health Month and Tech Team Burnout

Migration vs. Replication with Oracle GoldenGate: One Tool, Two Very Different Jobs

Why Run Oracle Workloads on Google Cloud Compute?

Posts by Tag

Links