Apache Ignite database plugin HTTP API

The Apache Ignite database plugin is one of the supported plugins for the database secrets engine. This plugin generates database credentials dynamically based on configured roles against an Apache Ignite cluster's thin client binary protocol.

Configure connection

In addition to the parameters defined by the Database Secrets Engine, this plugin has a number of parameters to further configure a connection.

Method	Path
POST	/database/config/:name

Parameters

• url (string: <required>) – Specifies the Ignite thin client target, e.g. tcp://ignite.example.com:10800. Only the host and port are used; the scheme is ignored, so URLs written for earlier REST-based versions of this plugin keep working. The thin client port defaults to 10800.

• host (string: "") – Explicit thin client host; overrides whatever url provides.

• port (int: 10800) – Explicit thin client port; overrides whatever url provides.

• username (string: <required>) – Specifies the root credential username, sent during the binary protocol handshake.

• password (string: <required>) – Specifies the root credential password corresponding to username, sent during the binary protocol handshake.

• ca_cert (string: "") – Specifies a PEM-encoded CA certificate (or bundle) to use when validating the Ignite server's TLS certificate.

• ca_path (string: "") – Specifies a filesystem path to a PEM-encoded CA certificate (or bundle) to use when validating the Ignite server's TLS certificate.

• client_cert (string: "") – Specifies a PEM-encoded client certificate to present for mTLS. Must be set together with client_key.

• client_key (string: "") – Specifies the PEM-encoded private key corresponding to client_cert. Must be set together with client_cert.

• insecure (bool: false) – Skips TLS certificate verification when connecting to the Ignite server. Intended for development only.

• username_template (string) - Template describing how dynamic usernames are generated. The generated username is uppercased and has any - converted to _ before use, and is rejected if it still contains ", ', ;, or `.

Default Username Template

{{ printf "v_%s_%s_%s" (.DisplayName | truncate 8) (.RoleName | truncate 8) (random 8) | replace "-" "_" | uppercase | truncate 32 }}

Example Usernames:

Example
DisplayName	token
RoleName	myrolename
Username	V_TOKEN_MYROLENA_USZT1N4C

Sample payload

{
  "plugin_name": "ignite-database-plugin",
  "allowed_roles": "reader",
  "url": "tcp://ignite.example.com:10800",
  "username": "ignite",
  "password": "ignite"
}

Sample request

$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/database/config/ignite

Statements

Ignite's CREATE USER / ALTER USER / DROP USER DDL does not accept parameters, so statements are rendered by substituting {{name}} (or {{username}}) and {{password}} directly into the SQL text, after the plugin validates the rendered username and password against a safe character set. For more information on configuring roles see the Role API in the database secrets engine docs.

The following are the statements used by this plugin. If not mentioned in this list the plugin does not support that statement type.

• creation_statements (list: []) – Specifies the database statements executed to create a user. Must be a semicolon-separated string, a base64-encoded semicolon-separated string, a serialized JSON string array, or a base64-encoded serialized JSON string array. The {{name}} (or {{username}}) and {{password}} values will be substituted. There is no built-in default; a role without creation_statements fails to issue credentials.

  CREATE USER "{{name}}" WITH PASSWORD '{{password}}';

• revocation_statements (list: []) – Specifies the database statements executed to revoke a user. Must be a semicolon-separated string, a base64-encoded semicolon-separated string, a serialized JSON string array, or a base64-encoded serialized JSON string array. The {{name}} (or {{username}}) value will be substituted. If not provided, defaults to DROP USER "<name>".

rollback_statements and root_rotation_statements are accepted by the database secrets engine framework but are not used by this plugin. There is no rollback step for a failed user creation, and password rotation for static roles always issues:

ALTER USER "<name>" WITH PASSWORD '<password>'

regardless of any root_rotation_statements supplied on database/config/:name.

Errors reported by the Ignite server over the thin client protocol are surfaced verbatim on every statement above.

Static roles

Static roles rotate the password of an existing Ignite user on a schedule, via the same ALTER USER ... WITH PASSWORD ... statement:

$ bao write database/static-roles/svc \
    db_name=ignite \
    username=svc \
    rotation_period=24h