# Using Hashicorp Vault with TiDB

Vault can be used to manage database access for TiDB database. This uses the [MySQL/MariaDB Database Secrets Engine](https://www.vaultproject.io/docs/secrets/databases/mysql-maria).

## Tutorial

Start a TiDB Playground

```
tiup playground --tiflash 0 --without-monitor v6.1.0
```

Download Vault. I used v1.10.4.

Start a dev server

```
vault server -dev
```

Enable the database engine

```
vault secrets enable database
```

Create the config

```
vault write database/config/my-tidb-database plugin_name=mysql-database-plugin connection_url="{{username}}@tcp(127.0.0.1:4000)/" allowed_roles="my-role" username="root"
```

Create the role

```
vault write database/roles/my-role db_name=my-tidb-database creation_statements="CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}'"
```

Read the credentials

```
vault read database/creds/my-role
```

### Example

This is with the vault dev server already running.

```
[dvaneeden@dve-carbon vault]$ ./vault secrets enable database
Success! Enabled the database secrets engine at: database/
[dvaneeden@dve-carbon vault]$ ./vault write database/config/my-tidb-database plugin_name=mysql-database-plugin connection_url="{{username}}@tcp(127.0.0.1:4000)/" allowed_roles="my-role" username="root"
Success! Data written to: database/config/my-tidb-database
[dvaneeden@dve-carbon vault]$ ./vault write database/roles/my-role db_name=my-tidb-database creation_statements="CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}'"
Success! Data written to: database/roles/my-role
[dvaneeden@dve-carbon vault]$ ./vault read database/creds/my-role
Key                Value
---                -----
lease_id           database/creds/my-role/jyjEs5l94kipuMjyqSUSHiT2
lease_duration     768h
lease_renewable    true
password           -4HLRonSS-lmDxLDuXcs
username           v-root-my-role-naBOcDkWQOlcbwa7F
[dvaneeden@dve-carbon vault]$ mysql -h 127.0.0.1 -u v-root-my-role-naBOcDkWQOlcbwa7F -P 4000 -p'-4HLRonSS-lmDxLDuXcs'
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 413
Server version: 5.7.25-TiDB-v6.1.0 TiDB Server (Apache License 2.0) Community Edition, MySQL 5.7 compatible

Copyright (c) 2000, 2022, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> SELECT USER(), CURRENT_USER();
+--------------------------------------------+------------------------------------+
| USER()                                     | CURRENT_USER()                     |
+--------------------------------------------+------------------------------------+
| v-root-my-role-naBOcDkWQOlcbwa7F@127.0.0.1 | v-root-my-role-naBOcDkWQOlcbwa7F@% |
+--------------------------------------------+------------------------------------+
1 row in set (0.00 sec)

mysql> ^DBye
```

## Production deployments

For production setups it is advisded to use a shorter lease duration and configure X509 client certificates for authentication.