storage other than raft

[jmls]

I must be getting old or going senile. I thought I'd read somewhere that OpenBao had removed all storage options except for raft - then I stumble across the docs

https://openbao.org/docs/configuration/storage/postgresql/

so the answer to the obvious question is

a) yes, I;m getting old. It was deprecated. Nothing to see here, move along ..
b) we did deprecate postgres but changed our minds and brought it back
c) postgres never left the building

[cipherboy]

\o hey @jmls

I'll going to assume you're not a day over your $DESIRED_YOUTHFUL_AGE... ;-)

...but the answer is b -- we removed it, added transactions to Raft, and then decided to bring back Postgres with the hope of releasing it with transactional support in a v2.1.0 update. This was partly discussed in #270 and #296 and various other places (live community calls, which you're more than welcome to participate in!). But we feel we can adequately support Postgres's transactions and improve the quality of the backend implementation a bit enough to justify it, unlike the other proprietary databases.

The issue we have, though, is that our documentation website that you've linked lacks versioned docs... So we end up getting pre-release docs as well. Perhaps we need to mark these as pre-release until they land in a release, but we've not yet figured out how to do that without incurring a lot of work for ourselves.... :-)

So this isn't yet ready, but you can build main and try it out!

[jmls]

oh, thank god for that. On a number of levels ;) a) I'm not going mad and b) postgres is back :)

We currently use vault with postgres and I was wanting to make the switch but couldn't face the migration tasks to raft

I will indeed build main and play. thanks !

[cipherboy]

@jmls v2.1.0 is out now, with full-featured PostgreSQL support back :-)

The warning still applies; I think we definitely have a scalability problem with PostgreSQL but we'll get there.

#651 also discusses an external storage interface for the remaining non-Raft, community supported backends so they are not part of Core and not beholden to the stability / release process of such.

---

Edit: I guess you replied to #20 before I commented here. :-D

[greenmapc]

Hello,

I hope you don't mind me reaching out here, but I have a question that I've been curious about and haven’t been able to find any discussions on, even in HashiCorp resources.

Could you please explain why there are plugins for secret engines, but the storage backends themselves aren’t pluggable?

[cipherboy]

\o hey @greenmapc

This is on our roadmap as something we want to do: #569 (see item 15: "Allow external storage plugins for parity with auth and secrets plugins. (community)").

I think there's probably two answers:

1. Vault had plenty of existing builtin plugins and few additional DBs were necessary. Once you chose a backend, you'd almost never change it out without a huge migration.
2. You might take a bit of a performance hit, by going over GRPC and so might not get much value out of it, relative to the performance cost.

That said, we definitely want to explore this. If you want to contribute, happy to work with you!