Set up Hashicorp Vault

Set environment variable
export PATH=$PATH:/opt/vault/bin this is so that vault can be run without using absolute path, you can also write this export to ~/.bashrc so that the variable exists together with your user account and is permanent.
My lab server bashrc file looks like this:

export PATH=/usr/lib64/qt-3.3/bin:/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/bin:/sbin:/home/cyruslab/.local/bin:/home/cyruslab/bin:/opt/vault/bin

complete -C /opt/vault/bin/vault vault
export VAULT_ADDR='https://127.0.0.1:8200'

Initialize the vault
The initialization will generate 5 keys and 1 token and store these into /opt/vault/data, you will notice there are two sub directories which are /opt/vault/data/core and /opt/vault/data/sys.

The command line to initialize vault is vault operator init, it will generate something similar like this:

Unseal Key 1: IEVavcw7mn8IhrkGGzo8Y5i0b0WXTkkMTsvRhjOkfw4+
Unseal Key 2: BheaaU05hOlggQ/tOXtzPYQJPpDjF7y1Ct6dSvbk1kbL
Unseal Key 3: UmZGIH1FVJ4HEWYpeGVAW9nfU8e5CBODbNkqorp9j/Li
Unseal Key 4: RMWLrJ97+BrvCxAg0Ai6mQTTcT039wWbxmWGamVDVUNR
Unseal Key 5: Cu6/tTzNBKXT1E3DimigYslSBgFE+VrAWlWOgF6R/YAN

Initial Root Token: s.eVc51pONg2lrOvQ1MwVHlFSC

Vault initialized with 5 key shares and a key threshold of 3. Please securely
distribute the key shares printed above. When the Vault is re-sealed,
restarted, or stopped, you must supply at least 3 of these keys to unseal it
before it can start servicing requests.

Vault does not store the generated master key. Without at least 3 key to
reconstruct the master key, Vault will remain permanently sealed!

It is possible to generate new unseal keys, provided you have a quorum of
existing unseal keys shares. See "vault operator rekey" for more information.

This output is one time as each vault init can only be generated once, so store the keys and token somewhere. I wrote a simple python to do just this, which includes keys and token storage to an encrypted file.

init_vault.py
This script generates a symmetric key from fernet, then check if the vault is initialize or not if not initialize the vault and store the dictionary to the variable, then use the symmetric key to encrypt the variable and store into a file.

from hvac import Client
from os.path import exists
from cryptography.fernet import Fernet
import json
'''
hvac is the python module for Hashicorp vault api
Because after initialization the vault returns a dictionary
and dictionary does not have encode method hence i json is used
to convert the dictionary into a string by using the dumps method.
The string then needs to be encoded into utf-8 as bytes,
then encrypt the data in bytes.
'''

# Client class parameter verify=False because the ssl cert cannot
# validate the ip address, there is no hostname vault.cyruslab.local yet.
client = Client(url='https://127.0.0.1:8200', verify=False)

# if the vault has not been initialized, initialize now.
if not client.is_initialized():
    shares = 5 # generate 5 key shares
    threshold = 3 # require 3 keys to unseal the vault.
    result = client.sys.initialize(shares, threshold)

# if symmetric key is not available generate one.
# save the key as a file for future use.
if not exists('enc.key'):
    key = Fernet.generate_key()
    with open('enc.key', 'wb') as file:
        file.write(key)

# use the symmetric key
with open('enc.key', 'rb') as file:
    sym_key = file.read()

fernet = Fernet(sym_key)
# encrypt the result delivered by initialization.
cipher_result = fernet.encrypt(json.dumps(result).encode('utf-8'))
# save the result into a file.
with open('result.enc', 'wb') as file:
    file.write(cipher_result)

get_vault_result.py
this script is a test code to open the key and token file, decrypt it and use the keys in the file to unseal the vault, the token is for login to vault.

from cryptography.fernet import Fernet
from pprint import pprint

with open('result.enc', 'rb') as file:
    cipher_result = file.read()

with open('enc.key', 'rb') as file:
    key = file.read()

fernet = Fernet(key)
plaintext_result = fernet.decrypt(cipher_result).decode('utf-8')
pprint(plaintext_result)