Hashicorp Vault Prerequisites

Catalyst Blockchain Platform supports storing identities in Hashicorp Vault instead of Kubernetes secrets.

1

Deploy Hashicorp Vault

Installation guide: https://www.vaultproject.io/docs/install

2

Create a set of policies

Create a policy file (e.g., catalyst.hcl) with the following rules:

path "{{PATH_PREFIX}}/*" {
    capabilities = ["read", "delete", "list", "create", "update"]
}

path "auth/approle/role/*" {
    capabilities = ["read"]
}

path "auth/token/lookup-self" {
    capabilities = ["read"]
}

path "auth/approle/role/+/secret-id" {
    capabilities = ["update"]
}

path "auth/token/renew-self" {
    capabilities = ["update"]
}

path "auth/token/create" {
    capabilities = ["update"]
}

Where {{PATH_PREFIX}} refers to the folder where all secrets of this role will be stored.

Apply the policy:

vault policy write $POLICIES_NAME ./catalyst.hcl

3

Enable the AppRole auth method

Catalyst Blockchain Platform must authenticate into Vault for managing secrets and mounting them into pods. Only AppRole is supported in the current version.

vault auth approle enable

4

Create an AppRole

vault write auth/approle/role/{{ROLE_NAME}} \
  token_policies={{POLICIES_NAME}} \
  token_ttl=5m \
  token_max_ttl=10m \
  token_no_default_policy=true

Where:

• {{POLICIES_NAME}} — the policy set created in step 2

• {{ROLE_NAME}} — any name you choose

5

Read the ID of the created role

vault read auth/approle/role/{{ROLE_NAME}}/role-id

Save the role_id value — it will be needed for the Helm chart configuration.

6

Create a Secret ID

vault write -f auth/approle/role/{{ROLE_NAME}}/secret-id

Save the secret_id value — it will be needed for the Helm chart configuration.

7

Put the Vault TLS certificate to the Kubernetes secret

Put your Vault TLS certificate with the trust chain to the Kubernetes secret called “vault-tls”. The Kubernetes secret name is specified in the helm chart values.