OCI object storage storage backend

The OCI Object Storage backend is used to persist Vault's data in OCI Object Storage.

High Availability – the OCI Object Storage backend supports high availability.
Community Supported – the OCI Object Storage backend is supported by the community. While it has undergone review by HashiCorp employees, they may not be as knowledgeable about the technology. If you encounter problems with them, you may be referred to the original author.

storage "oci" {
   region = "<oci_region>"
   namespace_name = "<object_storage_namespace_name>"
   bucket_name = "<vault_data_bucket_name>"
   ha_enabled = "<boolean true/false>"
   lock_bucket_name = "<leader_lock_bucket_name>"
   auth_type_api_key = "<boolean setting for using api-key instead of instance principals>"
}

For more information on OCI Object Storage, please see the Oracle's OCI Object Storage documentation.

`oci` setup

To use the OCI Object Storage Vault storage backend, you must have a OCI account. Either using the API or web interface, create the data bucket and lock bucket if enabling high availability.

The OCI Object Storage backend does not support creating the buckets automatically at this time.

`oci` authentication

The OCI Object Storage Vault storage backend uses the official OCI Golang SDK. This means it supports the common ways of providing credentials to OCI.

For more information on service accounts, please see the OCI Identity documentation.

`oci` parameters

region (string: <optional>) - Specifies the OCI region where Vault should look for object storage buckets. If not specified the OCI Storage Backend will use the region specified in your OCI credentials configuration.
namespace_name (string: <required>) – Specifies the name of the OCI Object Storage namespaces containing the data bucket and the lock bucket.
bucket_name (string: <required>) - Specifies the name of the bucket that will be used to store the Vault data.

High availability parameters

ha_enabled (string: "<required>") - Specifies if high availability mode is enabled. This is a boolean value, but it is specified as a string like "true" or "false".
lock_bucket_name (string: "<required>") - Specifies the name of the bucket that will be used to store the node lease data.

`oci` examples

Standalone Vault instance

This example shows configuring OCI Object Storage as a standalone instance.

storage "oci" {
    namespace_name = "MyNamespace"
    bucket_name = "DataBucket"
}

High availability

This example shows configuring OCI Object Storage with high availability enabled.

storage "oci" {
   namespace_name = "MyNamespace"
   bucket_name = "DataBucket"
   ha_enabled = "true"
   lock_bucket_name = "LockBucket"
}

OCI object storage storage backend

oci setup

oci authentication

oci parameters