How do I setup multiple mount points that use different paths in the same consul for their storage?

[Mike Peck]

I'm using the open-source vault (v0.10.1).

I currently have a secret engine defined in vault.hcl like this:

backend "consul" {

  address = "127.0.0.1:8500"

  path    = "vaultha/"

}

and it is used via the default mount point "secret/"

I now need to add a second mount point.  I can't use the same "vaultha" path inside consul, which seems to be a problem?

How do I do that?

/sys/mounts/<mount point> seems like it's close, but it doesn't let me specify a different consul path (or the address show above)

https://www.vaultproject.io/api/system/mounts.html#enable-secrets-engine

Mike

[mic...@hashicorp.com]

Hi Mike,

the backend which you have defined in your configuration file is also known as the Storage Backend. This is the place where Vault stores all it's encrypted data and only one storage backend can be configured per Vault instance/cluster.

A Secret Engine is responsible for managing secrets and has no direct connection to the Storage Backend. Vault supports several secret engines which can be mounted multiple times with a unique mount point path.

https://www.vaultproject.io/docs/internals/architecture.html#high-level-overview

If you want to enable another secret engine of type kv at another mount point, you have to run the following command:

vault secrets enable -version=2 -path=new-mount-point kv

https://www.vaultproject.io/docs/secrets/kv/kv-v2.html#setup

This will mount a secret engine of type kv (v2) at the new-mount-point/ path.

You can verify that by running the following command:

$ vault secrets list
Path                Type         Accessor              Description
----                ----         --------              -----------
cubbyhole/          cubbyhole    cubbyhole_ec4836c2    per-token private secret storage
identity/           identity     identity_5896cf67     identity store
new-mount-point/    kv           kv_2634873c           n/a
secret/             kv           kv_c5d54e80           key/value secret storage
sys/                system       system_e07d1ea4       system endpoints used for control, policy and debugging

Cheers,

Michel