Migrating conjur data to new cojur instance (secrets sourced from PAM Vault)

[senko (senkothan)]

Hey Everyone - looking for some general ideas on how the current Conjur data can be migrated to a new Conjur instance with a new instance of PAM ?

To be more clear, let’s say customer A has a older PAM version with Conjur syncing the secrets from the PAM. Customer decides to spin up a new PAM vault with same data from old PAM with a new instance of conjur and replicate the secrets to conjur. I am convinced that the secrets can be easily synced through the Vault synchronizer to the new Conjur instance, however how do we solve the below challenges ?

How to replicate the authenticators ?
How to replicate the policies ?
How to replicate the workloads ?

[ECD (Eli)]

@senko,

Consider the following:

Q1: How to replicate the authenticators ?
A1: Consider preforming a (e.g., docker/podman exec evoke backup), followed by a restore on the newest version (may have to follow upgrade guidelines for Conjur Enterprise - do do an upgrade to each version in between current and future state), this should* contain all the variable data. You will then need to enable the authenticators (e.g., via conjur.yml)

Q2: How to replicate the policies ?
A2: Same as above.

Q3: How to replicate the workloads ?
A3: @senko - please explain.

Hope this helps,
E