Hashicorp vault使用

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

[root@prometheus-bak policy]# vault auth enable ldap
Success! Enabled ldap auth method at: ldap/

[root@prometheus-bak policy]# bash ldap.sh
Success! Data written to: auth/ldap/config
[root@prometheus-bak policy]# cat ldap.sh 
vault write auth/ldap/config \
    url="ldap://ldap.xxx.com" \
    userdn="ou=People,dc=xxx,dc=com" \
    groupdn="ou=People,dc=xxx,dc=com" \
    groupfilter="(&(objectClass=group)(member={{.UserDN}}))"
    groupattr="cn" \
    upndomain="xxx.com" \
    insecure_tls=true \
    starttls=false

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

[root@prometheus-bak policy]# vault write auth/ldap/groups/sre policies=policy-sre
Success! Data written to: auth/ldap/groups/sre
[root@prometheus-bak policy]# vault write auth/ldap/users/lqx groups=sre policies=policy-lqx
Success! Data written to: auth/ldap/users/lqx

[root@prometheus-bak policy]# vault login -method=ldap username=lqx
Password (will be hidden): 
Success! You are now authenticated. The token information displayed below
is already stored in the token helper. You do NOT need to run "vault login"
again. Future Vault requests will automatically use this token.

WARNING! The following warnings were returned from Vault:

Key                    Value
---                    -----
token                  hvs.xxx
token_accessor         yyy
token_duration         768h
token_renewable        true
token_policies         ["default" "policy-lqx" "policy-sre"]
identity_policies      []
policies               ["default" "policy-lqx" "policy-sre"]
token_meta_username    lqx

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

{
  "Statement": [
    {
      "Action": [
        "ram:CreateAccessKey",
        "ram:DeleteAccessKey",
        "ram:CreatePolicy",
        "ram:DeletePolicy",
        "ram:AttachPolicyToUser",
        "ram:DetachPolicyFromUser",
        "ram:CreateUser",
        "ram:DeleteUser",
        "sts:AssumeRole"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ],
  "Version": "1"
}

1
2

[root@prometheus-bak ~]# vault secrets tune -default-lease-ttl=86400 alicloud-xxx/config
Success! Tuned the secrets engine at: alicloud-xxx/config/

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

[root@prometheus-bak policy]# cat create_policy.sh 
vault write alicloud-publiccloud/role/policy-lqx  remote_policies='name:AliyunOSSReadOnlyAccess,type:System' \
    inline_policies=-<<EOF
[
    {
      "Statement": [
        {
          "Action": "rds:Describe*",
          "Effect": "Allow",
          "Resource": "*"
        }
      ],
      "Version": "1"
    }
]
EOF

1
2
3
4

[root@prometheus-bak policy]# cat policy-sre.hcl 
path "alicloud-publiccloud/creds/policy-lqx" {
  capabilities = [ "read" ]
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

[root@prometheus-bak policy]# vault login --method=ldap username=lqx
Password (will be hidden): 
Success! You are now authenticated. The token information displayed below
Key                    Value
---                    -----
token                  hvs.CAESICX25V_4dFgh6KZT0KRQA3fSVxaemHUsLjLbaE6opWeXGh4KHGh2cy4yNlhSOGFWQnZUYjNoOEJOV056WkNYcHI
token_accessor         LCJ7IGfKHu3anpyc4DjN4lqR
token_duration         768h
token_renewable        true
token_policies         ["default" "policy-lqx" "policy-sre"]
identity_policies      []
policies               ["default" "policy-lqx" "policy-sre"]
token_meta_username    lqx

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

[root@prometheus-bak policy]# curl --header "X-Vault-Token: hvs.CAESICX25V_4dFgh6KZT0KRQA3fSVxaemHUsLjLbaE6opWeXGh4KHGh2cy4yNlhSOGFWQnZUYjNoOEJOV056WkNYcHI" https://vault.ssjj2.com/v1/alicloud-publiccloud/creds/policy-lqx
{
  "request_id": "4dd31dbf-c23b-a294-1455-78ac58019e50",
  "lease_id": "alicloud-publiccloud/creds/policy-lqx/rvL0sbAoXuDW971mkvP2CC6m",
  "renewable": true,
  "lease_duration": 600,
  "data": {
    "access_key": "xxx",
    "secret_key": "yyy"
  },
  "wrap_info": null,
  "warnings": null,
  "auth": null
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

git clone https://github.com/tencentcloudstack/vault-plugin-secrets-tencentcloud
yum -y install go
cd vault-plugin-secrets-tencentcloud
go env -w GOPROXY=https://goproxy.cn
go build -o vault/plugins/vault-plugin-secrets-tencentcloud ./cmd/vault-plugin-secrets-tencentcloud/main.go

提示go get就go get提示go mod就go mod

# scp plugin to 73,75,76 /etc/vault.d/plugins
# add plugin_directory to vault.hcl
plugin_directory = "/etc/vault.d/plugins"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

[root@prometheus-bak ~]# SHA256=$(sha256sum /etc/vault.d/plugins/vault-plugin-secrets-tencentcloud | cut -d ' ' -f1)

# 依次重启各个vault，建议一个一个升级
[root@prometheus-bak ~]# vault plugin register -sha256=$SHA256 secret vault-plugin-secrets-tencentcloud
Success! Registered plugin: vault-plugin-secrets-tencentcloud
[root@prometheus-bak ~]# vault plugin info secret vault-plugin-secrets-tencentcloud
Key                   Value
---                   -----
args                  []
builtin               false
command               vault-plugin-secrets-tencentcloud
deprecation_status    n/a
name                  vault-plugin-secrets-tencentcloud
sha256                eea1003a64e4e753c2cbb08f378cdebbe612be0b0bdd2f84ea8f6b70d85f6972
version               n/a

# add tencentcloud path for test
[root@prometheus-bak ~]# vault secrets enable -path=tencentcloud vault-plugin-secrets-tencentcloud
Success! Enabled the vault-plugin-secrets-tencentcloud secrets engine at: tencentcloud/

1
2

[root@prometheus-bak ~]# vault secrets enable -path=tencentcloud-publiccloud vault-plugin-secrets-tencentcloud
Success! Enabled the vault-plugin-secrets-tencentcloud secrets engine at: tencentcloud-publiccloud/

1
2

[root@prometheus-bak ~]#  vault write tencentcloud-publiccloud/config secret_id="xxx" secret_key="xxx"
Success! Data written to: tencentcloud-publiccloud/config

1
2

[root@prometheus-bak policy]# vault write tencentcloud-publiccloud/role/policy-lqx remote_policies='policy_name:ReadOnlyAccess,scope:All'
Success! Data written to: tencentcloud-publiccloud/role/policy-lqx

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

[root@prometheus-bak policy]# cat policy-sre.hcl 
path "alicloud-publiccloud/creds/policy-lqx" {
  capabilities = [ "read" ]
}

path "tencentcloud-publiccloud/creds/policy-lqx" {
  capabilities = [ "read" ]
}

# 修改下之前的policy，重新write下
[root@prometheus-bak policy]# vault policy write policy-sre policy-sre.hcl
Success! Uploaded policy: policy-sre

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

[root@prometheus-bak policy]# curl --header "X-Vault-Token: hvs.CAESICX25V_4dFgh6KZT0KRQA3fSVxaemHUsLjLbaE6opWeXGh4KHGh2cy4yNlhSOGFWQnZUYjNoOEJOV056WkNYcHI" https://vault.xxx.com/v1/tencentcloud-publiccloud/creds/policy-lqx
{
  "request_id": "5a78e694-ef03-f0ba-bee5-6a1e4580e26d",
  "lease_id": "tencentcloud-publiccloud/creds/policy-lqx/UHU2BW0OWWpvAPxEr4tFOyQa",
  "renewable": true,
  "lease_duration": 2764800,
  "data": {
    "secret_id": "xxx",
    "secret_key": "yyy"
  },
  "wrap_info": null,
  "warnings": null,
  "auth": null
}

1
2

[root@prometheus-bak policy]# vault lease revoke tencentcloud-publiccloud/creds/policy-lqx/UHU2BW0OWWpvAPxEr4tFOyQa
All revocation operations queued successfully!

1
2
3
4
5
6
7

[root@vault vault-agent-test]# cat vault-role-test-policy.hcl 
path "vault-role-test/*" {
  capabilities = [ "read","list","create","delete" ]
}
path "vault-role-test/data/*" {
  capabilities = [ "read","list", "create", "delete" ]
}

1
2

[root@vault vault-agent-test]# vault write auth/approle/role/vault-role-test-api policies="vault-role-test" token_ttl=10m  token_max_ttl=30m
Success! Data written to: auth/approle/role/vault-role-test-api

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

[root@vault vault-agent-test]# vault read auth/approle/role/vault-role-test-api/role-id
Key        Value
---        -----
role_id    5fa00538-e960-dd8f-f075-72313776bf98
[root@vault vault-agent-test]# vault write -force auth/approle/role/vault-role-test-api/secret-id
Key                   Value
---                   -----
secret_id             xxx-xxx-xxx
secret_id_accessor    62d1318d-d288-0962-ac5a-52ef3807857b
secret_id_num_uses    0
secret_id_ttl         0s

1
2

[root@vault vault-agent-test]# vault secrets enable -path=vault-role-test kv-v1
Success! Enabled the kv-v1 secrets engine at: vault-role-test/

1
2

[root@vault vault-agent-test]# curl     --request POST     --data '{"role_id":"5fa00538-e960-dd8f-f075-72313776bf98","secret_id":"xxx"}' https://vault.xxx.com/v1/auth/approle/login
{"request_id":"47185b1c-681a-9512-8827-f37e0ea64913","lease_id":"","renewable":false,"lease_duration":0,"data":null,"wrap_info":null,"warnings":null,"auth":{"client_token":"hvs.CAESIG8CjFhqPONJ4nWrCx9a5oXJlNH-OpGqXtsA4tNV3yNNGh4KHGh2cy5wS210MHdRUVdQZ0x4RklLbzNjRnlHNzM","accessor":"eixuOlY6u2RNRPh0FG8w3ObZ","policies":["default","vault-role-test"],"token_policies":["default","vault-role-test"],"metadata":{"role_name":"vault-role-test-api"},"lease_duration":600,"renewable":true,"entity_id":"ba8a55d2-47c4-e057-0347-398fa493405c","token_type":"service","orphan":true,"mfa_requirement":null,"num_uses":0}}

1
2
3
4
5
6
7
8
9

[root@vault vault-agent-test]# export VAULT_TOKEN="hvs.CAESIG8CjFhqPONJ4nWrCx9a5oXJlNH-OpGqXtsA4tNV3yNNGh4KHGh2cy5wS210MHdRUVdQZ0x4RklLbzNjRnlHNzM"
[root@vault vault-agent-test]# vault kv put vault-role-test/x x-username="apple" x-password="orange"
Success! Data written to: vault-role-test/x
[root@vault vault-agent-test]# vault kv get vault-role-test/x
======= Data =======
Key           Value
---           -----
x-password    orange
x-username    apple

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

[root@vault vault-agent-test]# cat agent.hcl 
auto_auth {
  method {
    type = "approle"

    config = {
      role_id_file_path = "/etc/vault/roleid"
      secret_id_file_path = "/etc/vault/secretid"
    }
  }

  sinks {
    sink {
      type = "file"

      config = {
        path = "/tmp/vault-role-test"
      }
    }
  }
}


[root@vault vault-agent-test]# vault agent -config=agent.hcl
==> Vault agent started! Log data will stream in below:

==> Vault agent configuration:

                     Cgo: disabled
               Log Level: info
                 Version: Vault v1.12.2, built 2022-11-23T12:53:46Z
             Version Sha: 415e1fe3118eebd5df6cb60d13defdc01aa17b03

2023-08-02T15:22:20.548+0800 [INFO]  sink.file: creating file sink
2023-08-02T15:22:20.548+0800 [INFO]  sink.file: file sink configured: path=/tmp/vault-role-test mode=-rw-r-----
2023-08-02T15:22:20.550+0800 [INFO]  template.server: starting template server
2023-08-02T15:22:20.550+0800 [INFO]  template.server: no templates found
2023-08-02T15:22:20.550+0800 [INFO]  auth.handler: starting auth handler
2023-08-02T15:22:20.550+0800 [INFO]  auth.handler: authenticating
2023-08-02T15:22:20.550+0800 [INFO]  sink.server: starting sink server
2023-08-02T15:22:20.591+0800 [INFO]  auth.handler: authentication successful, sending token to sinks
2023-08-02T15:22:20.591+0800 [INFO]  auth.handler: starting renewal process
2023-08-02T15:22:20.591+0800 [INFO]  sink.file: token written: path=/tmp/vault-role-test
2023-08-02T15:22:20.601+0800 [INFO]  auth.handler: renewed auth token

[root@vault ~]# cat /tmp/vault-role-test
hvs.CAESIOyTVeDW2CCfQchEzV_uDh1qzNd9f0eZqvIBEWgdVFj9Gh4KHGh2cy41WGJqYVhrdjRnU3U0NklGd3B1dVlwYTA

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

auto_auth {
  method {
    type = "approle"

    config = {
      role_id_file_path = "/etc/vault/roleid"
      secret_id_file_path = "/etc/vault/secretid"
    }
  }

  sinks {
    sink {
      type = "file"

      config = {
        path = "/tmp/vault-role-test"
      }
    }
  }
}

template_config {
  static_secret_render_interval = "5m"
  exit_on_retry_failure         = true
}

vault {
  address = "https://vault.xxx.com"
}

template  {
  contents             = "{{ with secret \"vault-role-test/x\" }}{\"username\": \"{{ .Data.x_username }}\", \"password\": \"{{ .Data.x_password}}\"}{{ end }}"
  destination          = "/secrets/app-x/identity.json"
  error_on_missing_key = true
}

exec {
  command                   = ["./test.sh"]
  restart_on_secret_changes = "always"
  restart_stop_signal       = "SIGTERM"
}

1
2

[root@vault vault-agent-test]# cat /secrets/app-x/identity.json 
{"username": "apple", "password": "orange"}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

[root@vault vault-agent-test]# cat aliyun-role-ak.hcl 
auto_auth {
  method {
    type = "approle"

    config = {
      role_id_file_path = "/etc/vault/lqx_test-roleid"
      secret_id_file_path = "/etc/vault/lqx_test-secretid"
      remove_secret_id_file_after_reading = false
    }
  }
}

template_config {
  static_secret_render_interval = "5m"
  exit_on_retry_failure         = true
}

vault {
  address = "https://vault.xxx.com"
}

template  {
  contents             = "{{ with secret \"alicloud-xxx/creds/lqx_test\" }}{\"access_key\": \"{{ .Data.access_key }}\", \"secret_key\": \"{{ .Data.secret_key}}\"}{{ end }}"
  destination          = "/secrets/app-x/identity.json"
  error_on_missing_key = true
}

1

vault write alicloud-xxx/role/lqx_test   credential_ttl=300 remote_policies='name:AliyunECSReadOnlyAccess,type:System'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

[root@prometheus-bak policy]# touch /var/log/vault.log
[root@prometheus-bak policy]# chown -R vault /var/log/vault.log
[root@prometheus-bak policy]# vault audit enable file file_path=/var/log/vault.log
Success! Enabled the file audit device at: file/
[root@prometheus-bak policy]# tail -f /var/log/vault.log
{
  "time": "2022-12-14T08:50:37.281050158Z",
  "type": "response",
  "auth": {
    "client_token": "hmac-sha256:c59b3c1f9e2982606de36be5fad5a9a0a0f88d3e78496ca5a4b22d44e8c9bba5",
    "accessor": "hmac-sha256:bec550feb46e175c6d017879c1e978a1f8d9bef05acd1075f11f11a283b9ca3b",
    "display_name": "ldap-lqx",
    "policies": [
      "default",
      "policy-lqx",
      "policy-sre"
    ],
    "token_policies": [
      "default",
      "policy-lqx",
      "policy-sre"
    ],
    "policy_results": {
      "allowed": true,
      "granting_policies": [
        {
          "name": "policy-sre",
          "namespace_id": "root",
          "type": "acl"
        }
      ]
    },
    "metadata": {
      "username": "lqx"
    },
    "entity_id": "a5851c83-1ffc-b2b7-ae9f-6af9af3264d3",
    "token_type": "service",
    "token_ttl": 2764800,
    "token_issue_time": "2022-12-14T16:50:28+08:00"
  },
  "request": {
    "id": "5cefe863-d4ba-52c1-7bf5-c0185c252f76",
    "client_id": "a5851c83-1ffc-b2b7-ae9f-6af9af3264d3",
    "operation": "read",
    "mount_type": "alicloud",
    "mount_accessor": "alicloud_e21289d1",
    "client_token": "hmac-sha256:d57d03e207cd0d39f1219c897458a5dd0d45af2dad105cb66542c4de9b3d4f25",
    "client_token_accessor": "hmac-sha256:bec550feb46e175c6d017879c1e978a1f8d9bef05acd1075f11f11a283b9ca3b",
    "namespace": {
      "id": "root"
    },
    "path": "alicloud-publiccloud/creds/policy-lqx",
    "remote_address": "127.0.0.1",
    "remote_port": 60744
  },
  "response": {
    "mount_type": "alicloud",
    "mount_accessor": "alicloud_e21289d1",
    "secret": {
      "lease_id": "alicloud-publiccloud/creds/policy-lqx/lYyx5l0bsfMtDOHDZ273R1nR"
    },
    "data": {
      "access_key": "hmac-sha256:640d607780d126ab8f29a8e28058e247dc3233751bad3922411dba7531d587ad",
      "secret_key": "hmac-sha256:556a23a1fb3d7fe775730f548986e1b56388d9366203876c5e7dbea3f5c5f29d"
    }
  }
}