DEV Community

How to "Reset" a HashiCorp Vault back to Zero State using Consul

πŸ¦„N BπŸ›‘ on January 18, 2019

There are two different methods to clear a Vault cluster in an emergency. This assumes that your Vault Cluster already uses Consul as its Storage...
Collapse
 
dmitrykankalovich profile image
Dmitry Kankalovich • Edited

If you go with the default Helm installation of Vault then you should be aware that it seems like Vault caches its init state, even though you've deleted it in Consul.

What helped me:

  • Delete init state in Consul: ssh to Consul server pod and run consul kv delete -recurse vault/
  • Delete Vault pods: kubectl delete pods -l app.kubernetes.io/instance=vault -n your_namespace
  • Observe Vault pods are re-created
  • Initialize Vault
  • Unseal Vault
Collapse
 
bartdzkan profile image
Bart D.

The command to delete vault should be updated to :
consul kv delete -recurse vault/

Otherwise it doesn't delete vault/, even though it says it's successful.

Collapse
 
v6 profile image
πŸ¦„N BπŸ›‘

// , Updated, thanks for testing it, @bartdzkan .

Collapse
 
sysnasri profile image
Alireza Nasri

what if the storage backend is mysql?
how can I delete that?

Collapse
 
sysnasri profile image
Alireza Nasri

in case your storage backend is mysql with juju , you can connect to mysql database through mysqlclient and drop the table.