> For the complete documentation index, see [llms.txt](https://docs.catalyx.solutions/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.catalyx.solutions/catalyx-blockchain-manager/hyperledger-fabric/version-2.4/operations-guide/installation-instructions/hashicorp-vault-prerequisites.md).

# Hashicorp Vault Prerequisites

Catalyst Blockchain Platform supports storing identities in Hashicorp Vault instead of Kubernetes secrets.

{% stepper %}
{% step %}
**Deploy Hashicorp Vault**

Installation guide: <https://www.vaultproject.io/docs/install>
{% endstep %}

{% step %}
**Create a set of policies**

Create a policy file (e.g., `catalyst.hcl`) with the following rules:

```hcl
path "{{PATH_PREFIX}}/*" {
    capabilities = ["read", "delete", "list", "create", "update"]
}

path "auth/approle/role/*" {
    capabilities = ["read"]
}

path "auth/token/lookup-self" {
    capabilities = ["read"]
}

path "auth/approle/role/+/secret-id" {
    capabilities = ["update"]
}

path "auth/token/renew-self" {
    capabilities = ["update"]
}

path "auth/token/create" {
    capabilities = ["update"]
}
```

Where `{{PATH_PREFIX}}` refers to the folder where all secrets of this role will be stored.

Apply the policy:

```bash
vault policy write $POLICIES_NAME ./catalyst.hcl
```

{% endstep %}

{% step %}
**Enable the AppRole auth method**

Catalyst Blockchain Platform must authenticate into Vault for managing secrets and mounting them into pods. Only [AppRole](https://www.vaultproject.io/docs/auth/approle) is supported in the current version.

```bash
vault auth approle enable
```

{% endstep %}

{% step %}
**Create an AppRole**

```bash
vault write auth/approle/role/{{ROLE_NAME}} \
  token_policies={{POLICIES_NAME}} \
  token_ttl=5m \
  token_max_ttl=10m \
  token_no_default_policy=true
```

Where:

* `{{POLICIES_NAME}}` — the policy set created in step 2
* `{{ROLE_NAME}}` — any name you choose
  {% endstep %}

{% step %}
**Read the ID of the created role**

```bash
vault read auth/approle/role/{{ROLE_NAME}}/role-id
```

Save the `role_id` value — it will be needed for the Helm chart configuration.
{% endstep %}

{% step %}
**Create a Secret ID**

```bash
vault write -f auth/approle/role/{{ROLE_NAME}}/secret-id
```

Save the `secret_id` value — it will be needed for the Helm chart configuration.
{% endstep %}

{% step %}

#### Put the Vault TLS certificate to the Kubernetes secret

Put your Vault TLS certificate with the trust chain to the Kubernetes secret called *`“vault-tls”.`* The Kubernetes secret name is specified in the [helm chart values.](https://docs.catalyx.solutions/fabric/2.4/operations-guide/installation-instructions.html#helmChartVals)
{% endstep %}
{% endstepper %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.catalyx.solutions/catalyx-blockchain-manager/hyperledger-fabric/version-2.4/operations-guide/installation-instructions/hashicorp-vault-prerequisites.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.