PostgreSQL storage backend
The PostgreSQL storage backend is used to persist Vault's data in a PostgreSQL server or cluster.
High Availability – the PostgreSQL storage backend supports high availability. Requires PostgreSQL 9.5 or later.
Community Supported – the PostgreSQL storage backend is supported by the community. While it has undergone review by HashiCorp employees, they may not be as knowledgeable about the technology. If you encounter problems with them, you may be referred to the original author.
Note: The PostgreSQL storage backend plugin will attempt to use SSL
when connecting to the database. If SSL is not enabled the connection_url
will need to be configured to disable SSL. See the documentation below
to disable SSL.
The PostgreSQL storage backend does not automatically create the table. Here is some sample SQL to create the schema and indexes.
Store for HAEnabled backend
If you're using a version of PostgreSQL prior to 9.5, create the following function:
postgresql
parameters
connection_url
(string: <required>)
– Specifies the connection string to use to authenticate and connect to PostgreSQL. The connection URL can also be set using theVAULT_PG_CONNECTION_URL
environment variable. A full list of supported parameters can be found in the pgx library and PostgreSQL connection string documentation. For example connection string URLs, see the examples section below.table
(string: "vault_kv_store")
– Specifies the name of the table in which to write Vault data. This table must already exist (Vault will not attempt to create it).max_idle_connections
(int)
- Default not set. Sets the maximum number of connections in the idle connection pool. See golang docs on SetMaxIdleConns for more information. Requires 1.2 or later.max_parallel
(string: "128")
– Specifies the maximum number of concurrent requests to PostgreSQL.ha_enabled
(string: "true|false")
– Default not enabled, requires 9.5 or later.ha_table
(string: "vault_ha_locks")
– Specifies the name of the table to use for storing high availability information. This table must already exist (Vault will not attempt to create it).
postgresql
examples
Custom SSL verification
This example shows connecting to a PostgreSQL cluster using full SSL verification (recommended).
To disable SSL verification (not recommended), replace verify-full
with
disable
: