Obfuscating MySQL passwords with Hashicorp Vault - Setup

vault-setup

1. Start Consul server. It is used by Vault for persisting secrets.
   $ consul agent -server -bootstrap-expect 1 -data-dir /tmp/consul -bind 127.0.0.1

2. Start Vault
   $ vault server -config=vault.conf
   $ cat vault.conf        
    --------Start : vault.conf --------------------
    backend "consul" {
      address = "127.0.0.1:8500"
      path = "vault"
    }
    listener "tcp" {
      address = "127.0.0.1:8200"
      tls_cert_file = "prod.cert.pem"
      tls_key_file  = "prod.key.pem"
    }
    --------End : vault.conf --------------------

3. Initialize Vault 
   $ vault init -key-shares=3 -key-threshold=5

4. Unseal Vault
   $ vault unseal key1 [ key2, key3 ]