fa9c5dc67c
* docs: Update Database Capabilities to include username customization * add operator/diagnose to the index file
142 lines
4.7 KiB
Plaintext
142 lines
4.7 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Couchbase - Database - Secrets Engines
|
|
description: |-
|
|
Couchbase is one of the supported plugins for the database secrets engine.
|
|
This plugin generates database credentials dynamically based on configured
|
|
roles for the Couchbase database.
|
|
---
|
|
|
|
# Couchbase Database Secrets Engine
|
|
|
|
Couchbase is one of the supported plugins for the database secrets engine. This
|
|
plugin generates database credentials dynamically based on configured roles for
|
|
the Couchbase database.
|
|
|
|
See the [database secrets engine](/docs/secrets/databases) docs for
|
|
more information about setting up the database secrets engine.
|
|
|
|
## Capabilities
|
|
|
|
| Plugin Name | Root Credential Rotation | Dynamic Roles | Static Roles | Username Customization |
|
|
| --------------------------- | ------------------------ | ------------- | ------------ | ---------------------- |
|
|
| `couchbase-database-plugin` | Yes | Yes | Yes | Yes (1.7+) |
|
|
|
|
## Setup
|
|
|
|
1. Enable the database secrets engine if it is not already enabled:
|
|
|
|
```bash
|
|
$ vault secrets enable database
|
|
Success! Enabled the database secrets engine at: database/
|
|
```
|
|
|
|
By default, the secrets engine will enable at the name of the engine. To
|
|
enable the secrets engine at a different path, use the `-path` argument.
|
|
|
|
1. Configure Vault with the proper plugin and connection configuration:
|
|
|
|
```bash
|
|
$ vault write database/config/my-couchbase-database \
|
|
plugin_name="couchbase-database-plugin" \
|
|
hosts="couchbases://127.0.0.1" \
|
|
tls=true \
|
|
base64pem="${BASE64PEM}" \
|
|
username="vaultuser" \
|
|
password="vaultpass" \
|
|
allowed_roles="my-*-role"
|
|
```
|
|
|
|
Where `${BASE64PEM}` is the server's root certificate authority in PEM
|
|
format, encoded as a base64 string with no new lines.
|
|
|
|
To connect to clusters prior to version 6.5.0, a `bucket_name` must also
|
|
be configured:
|
|
|
|
```bash
|
|
$ vault write database/config/my-couchbase-database \
|
|
plugin_name="couchbase-database-plugin" \
|
|
hosts="couchbases://127.0.0.1" \
|
|
tls=true \
|
|
base64pem="${BASE64PEM}" \
|
|
username="vaultuser" \
|
|
password="vaultpass" \
|
|
allowed_roles="my-*-role" \
|
|
bucket_name="travel-sample"
|
|
```
|
|
|
|
1. You should consider rotating the admin password. Note that if you do, the
|
|
new password will never be made available through Vault, so you should
|
|
create a Vault-specific database admin user for this.
|
|
|
|
```bash
|
|
vault write -force database/rotate-root/my-couchbase-database
|
|
```
|
|
|
|
## Usage
|
|
|
|
After the secrets engine is configured, configure dynamic and static roles
|
|
to enable generating credentials.
|
|
|
|
### Dynamic roles
|
|
|
|
1. Configure a dynamic role that maps a name in Vault to a JSON string
|
|
specifying a Couchbase RBAC role. The default value for
|
|
`creation_statements` is a read-only admin role:
|
|
`{"Roles": [{"role":"ro_admin"}]}`.
|
|
|
|
```bash
|
|
$ vault write database/roles/my-dynamic-role \
|
|
db_name="my-couchbase-database" \
|
|
creation_statements='{"Roles": [{"role":"ro_admin"}]}' \
|
|
default_ttl="5m" \
|
|
max_ttl="1h"
|
|
```
|
|
|
|
Note that any groups specified in the creation statement must already exist.
|
|
|
|
1. Generate a new credential by reading from the `/creds` endpoint with the name
|
|
of the role:
|
|
|
|
```bash
|
|
$ vault read database/creds/my-dynamic-role
|
|
Key Value
|
|
--- -----
|
|
lease_id database/creds/my-dynamic-role/wiLNQjtcvCOT1VnN3qnUJnBz
|
|
lease_duration 5m
|
|
lease_renewable true
|
|
password mhyM-Gs7IpmOPnSqXEDe
|
|
username v-root-my-dynamic-role-eXnVr4gm55dpM1EVgTYz-1596815027
|
|
```
|
|
|
|
### Static roles
|
|
|
|
1. Configure a static role that maps a name in Vault to an existing couchbase
|
|
user.
|
|
|
|
```bash
|
|
$ vault write database/static-roles/my-static-role \
|
|
db_name="my-couchbase-database" \
|
|
username="my-existing-couchbase-user" \
|
|
rotation_period=5m
|
|
```
|
|
|
|
1. Retrieve the credentials from the `/static-creds` endpoint:
|
|
|
|
```bash
|
|
$ vault read database/static-creds/my-static-role
|
|
Key Value
|
|
--- -----
|
|
last_vault_rotation 2020-08-07T16:50:48.393354+01:00
|
|
password Z4-KH8F-VK5VJc0hSkXQ
|
|
rotation_period 5m
|
|
ttl 4m39s
|
|
username my-existing-couchbase-user
|
|
```
|
|
|
|
## API
|
|
|
|
The full list of configurable options can be seen in the [Couchbase database plugin API](/api-docs/secret/databases/couchbase) page.
|
|
|
|
For more information on the database secrets engine's HTTP API please see the [Database secret secrets engine API](/api-docs/secret/databases) page.
|