2.3. Enabling cluster-wide encryption with KMS using the Token authentication method

Procedure

1. Enable the Key/Value (KV) backend path in the vault.

   For vault KV secret engine API, version 1:

   $ vault secrets enable -path=odf kv

   For vault KV secret engine API, version 2:

   $ vault secrets enable -path=odf kv-v2

2. Create a policy to restrict the users to perform a write or delete operation on the secret:

   echo '
   path "odf/*" {
     capabilities = ["create", "read", "update", "delete", "list"]
   }
   path "sys/mounts" {
   capabilities = ["read"]
   }'| vault policy write odf -

3. Create a token that matches the above policy:

   $ vault token create -policy=odf -format json