+
This commit is contained in:
@ -1,361 +1,361 @@
|
||||
# Установка HashiCorp Vault на Ubuntu
|
||||
|
||||
Vault — это инструмент от HashiCorp для безопасного хранения секретов и управления ими.
|
||||
|
||||
## 1. Установка Vault
|
||||
|
||||
Открываю нужный сервер
|
||||
```sh
|
||||
wsl
|
||||
```
|
||||
Похоже vault из Москвы недоступен:
|
||||
```sh
|
||||
ssh root@45.144.64.218 -p 2200
|
||||
```
|
||||
|
||||
### 1.1. Добавление репозитория HashiCorp
|
||||
|
||||
1. Установите необходимые пакеты:
|
||||
```sh
|
||||
sudo apt update && sudo apt install -y gnupg software-properties-common curl
|
||||
```
|
||||
|
||||
2. Добавьте официальный GPG-ключ HashiCorp:
|
||||
```sh
|
||||
curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
|
||||
```
|
||||
|
||||
3. Добавьте репозиторий HashiCorp в систему:
|
||||
```sh
|
||||
sudo mcedit /etc/apt/sources.list.d/hashicorp.list
|
||||
```
|
||||
|
||||
Заменяем на:
|
||||
```text
|
||||
deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com noble main
|
||||
```
|
||||
Где noble это кодовое имя Ubuntu 24.04
|
||||
|
||||
|
||||
4. Обновите списки пакетов:
|
||||
```sh
|
||||
sudo apt update
|
||||
```
|
||||
|
||||
5. Установите Vault:
|
||||
```sh
|
||||
sudo apt install -y vault
|
||||
```
|
||||
|
||||
6. Проверьте, что Vault установлен правильно:
|
||||
```sh
|
||||
vault --version
|
||||
```
|
||||
Выдало: Vault v1.18.5 (2cb3755273dbd63f5b0f8ec50089b57ffd3fa330), built 2025-02-24T09:40:28Z
|
||||
|
||||
|
||||
## 2. Запуск Vault
|
||||
|
||||
### 2.1. Запуск в Dev-режиме (только для тестирования)
|
||||
|
||||
If work stop it:
|
||||
```sh
|
||||
sudo pkill vault
|
||||
```
|
||||
If need delete old data:
|
||||
```sh
|
||||
sudo rm -rf ~/.vault-token ~/.vault/
|
||||
```
|
||||
For find where stored data read file:
|
||||
```sh
|
||||
sudo mcedit /etc/vault/config.hcl
|
||||
```
|
||||
In config file find this path: /opt/vault/data
|
||||
|
||||
После удаления базы нужно инициализировать Vault заново:
|
||||
```sh
|
||||
sudo vault operator init
|
||||
```
|
||||
|
||||
Run in developer mode (in dev mode data stored in RAM):
|
||||
```sh
|
||||
vault server -dev
|
||||
```
|
||||
|
||||
```text
|
||||
WARNING! dev mode is enabled! In this mode, Vault runs entirely in-memory
|
||||
and starts unsealed with a single unseal key. The root token is already
|
||||
authenticated to the CLI, so you can immediately begin using Vault.
|
||||
|
||||
You may need to set the following environment variables:
|
||||
|
||||
$ export VAULT_ADDR='http://127.0.0.1:8200'
|
||||
|
||||
The unseal key and root token are displayed below in case you want to
|
||||
seal/unseal the Vault or re-authenticate.
|
||||
|
||||
Unseal Key: TMb6A3QI3wJ9kaEeTYo5wEviP23lugJ3Asek2la6V4s=
|
||||
Root Token: hvs.GsWHRR7ne7gMTZhuPgZdh91w
|
||||
|
||||
Development mode should NOT be used in production installations!
|
||||
```
|
||||
|
||||
Теперь Vault работает по адресу:
|
||||
```sh
|
||||
start http://127.0.0.1:8200
|
||||
```
|
||||
Останавливаю нажатием Ctrl + C
|
||||
|
||||
|
||||
### 2.2. Настройка Vault в режиме сервера
|
||||
|
||||
1. Создайте конфигурационный файл:
|
||||
```sh
|
||||
sudo mkdir -p /etc/vault &&
|
||||
sudo mcedit /etc/vault/config.hcl
|
||||
```
|
||||
|
||||
2. Добавьте следующий конфиг:
|
||||
```text
|
||||
storage "file" {
|
||||
path = "/opt/vault/data"
|
||||
}
|
||||
|
||||
listener "tcp" {
|
||||
address = "127.0.0.1:8200"
|
||||
tls_disable = 1
|
||||
}
|
||||
|
||||
disable_mlock = true
|
||||
ui = true
|
||||
```
|
||||
|
||||
3. Создайте папку для хранения данных:
|
||||
```sh
|
||||
sudo mkdir -p /opt/vault/data &&
|
||||
sudo chown vault:vault /opt/vault/data
|
||||
```
|
||||
|
||||
4. Создайте systemd-сервис для Vault:
|
||||
```sh
|
||||
sudo tee /etc/systemd/system/vault.service > /dev/null <<EOF
|
||||
[Unit]
|
||||
Description=HashiCorp Vault
|
||||
After=network-online.target
|
||||
Requires=network-online.target
|
||||
|
||||
[Service]
|
||||
User=vault
|
||||
Group=vault
|
||||
ExecStart=/usr/bin/vault server -config=/etc/vault/config.hcl
|
||||
ExecReload=/bin/kill --signal HUP \$MAINPID
|
||||
KillSignal=SIGTERM
|
||||
Restart=on-failure
|
||||
LimitMEMLOCK=infinity
|
||||
ProtectSystem=full
|
||||
CapabilityBoundingSet=CAP_IPC_LOCK CAP_SETGID CAP_SETUID CAP_SYSLOG CAP_CHOWN
|
||||
NoNewPrivileges=yes
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
```
|
||||
Проверяем всё ли записалось:
|
||||
```sh
|
||||
sudo mcedit /etc/systemd/system/vault.service
|
||||
```
|
||||
|
||||
5. Перезапустите systemd и включите Vault:
|
||||
```sh
|
||||
sudo systemctl daemon-reload &&
|
||||
sudo systemctl enable vault &&
|
||||
sudo systemctl start vault
|
||||
```
|
||||
|
||||
7. Проверьте статус:
|
||||
```sh
|
||||
sudo systemctl status vault
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 3. Инициализация и разлочка Vault
|
||||
|
||||
1. Экспортируйте переменную окружения:
|
||||
```sh
|
||||
export VAULT_ADDR='http://127.0.0.1:8200'
|
||||
```
|
||||
|
||||
2. Инициализируйте хранилище (сохраните ключи!):
|
||||
```sh
|
||||
vault operator init
|
||||
```
|
||||
|
||||
Выдало:
|
||||
```text
|
||||
Unseal Key 1: lQlJsb9RI8rSzLrc5iPnx1qJkWZbbXIkrEgnQGe5R6uO
|
||||
Unseal Key 2: 0qJJXRo570jlH/0Qs/wodXHNI2SF5VgL4jE04JawSPSB
|
||||
Unseal Key 3: VuYkOkQ8qmwofDmjqsTRQoMqGAH3Jv+nqQylL7Uibbtp
|
||||
Unseal Key 4: JJJ8Nqj00qzS9u5wNtTtExL/jWlJF9fgaBsiuaf0kFxC
|
||||
Unseal Key 5: L6lZMp/l7s24EZJAFnWS4Py5jsWOuMioC41g5LhUJKWL
|
||||
|
||||
Initial Root Token: hvs.o07DY7tnSPcufxk60pjCXDzn
|
||||
|
||||
Vault initialized with 5 key shares and a key threshold of 3. Please securely
|
||||
distribute the key shares printed above. When the Vault is re-sealed,
|
||||
restarted, or stopped, you must supply at least 3 of these keys to unseal it
|
||||
before it can start servicing requests.
|
||||
|
||||
Vault does not store the generated root key. Without at least 3 keys to
|
||||
reconstruct the root key, Vault will remain permanently sealed!
|
||||
|
||||
It is possible to generate new unseal keys, provided you have a quorum of
|
||||
existing unseal keys shares. See "vault operator rekey" for more information.
|
||||
```
|
||||
|
||||
3. Разблокируйте Vault, используя один из ключей (потом ещё 3 раза выполнить эту команду):
|
||||
```sh
|
||||
vault operator unseal
|
||||
```
|
||||
|
||||
4. Авторизуйтесь с root-токеном:
|
||||
```sh
|
||||
vault login hvs.MTFV72PjKXCVh5ZL6yCVE3Yw
|
||||
```
|
||||
|
||||
5. Создаём(включаем) новое хранилище ключ-значение через ssh
|
||||
```sh
|
||||
vault secrets enable -path=org-ccalm kv-v2
|
||||
```
|
||||
|
||||
|
||||
|
||||
5. Writing to the kv storage (добавил префикс vault. чтобы значения самому подставлять в нужные места в spring)
|
||||
|
||||
Заменит(создаст) значение:
|
||||
```sh
|
||||
vault kv put org-ccalm/jwt vault.server.ssl.key-store-password=MFNX344yh4
|
||||
```
|
||||
Добавит (обновит):
|
||||
```sh
|
||||
vault kv patch org-ccalm/jwt vault.test=test2
|
||||
```
|
||||
```sh
|
||||
vault kv put org-ccalm/public vault.personal_data.key=7dd2Nek1
|
||||
```
|
||||
|
||||
6. Read data from the kv
|
||||
```sh
|
||||
vault kv get org-ccalm/jwt
|
||||
```
|
||||
|
||||
Должно вывести:
|
||||
```text
|
||||
Key Value
|
||||
--- -----
|
||||
server.ssl.key-store-password M4yh4
|
||||
```
|
||||
|
||||
6. Включаем AppRole для доступа из приложения
|
||||
```sh
|
||||
vault auth enable approle
|
||||
```
|
||||
|
||||
7. Добавляем политики потом создаём ключ для этой политикиполитики
|
||||
|
||||
Создаю файл политик
|
||||
```sh
|
||||
cd ~ &&
|
||||
sudo tee jwt-policy.hcl > /dev/null <<EOF
|
||||
path "org-ccalm/data/jwt" {
|
||||
capabilities = ["create", "read", "update", "delete", "list"]
|
||||
}
|
||||
path "org-ccalm/data/public" {
|
||||
capabilities = ["read", "list"]
|
||||
}
|
||||
EOF
|
||||
```
|
||||
Apply and delete configiration file:
|
||||
```sh
|
||||
vault policy write jwt-policy ~/jwt-policy.hcl &&
|
||||
rm -f jwt-policy.hcl
|
||||
```
|
||||
|
||||
Создаём AppRole (на 10 лет)
|
||||
```sh
|
||||
vault write auth/approle/role/org-ccalm-jwt \
|
||||
secret_id_ttl=0 \
|
||||
token_ttl=87600h \
|
||||
token_max_ttl=87600h \
|
||||
policies="jwt-policy,another-policy,third-policy"
|
||||
```
|
||||
|
||||
Получаем role_id и secret_id
|
||||
```sh
|
||||
vault read auth/approle/role/org-ccalm-jwt/role-id
|
||||
```
|
||||
Выдало
|
||||
```text
|
||||
Key Value
|
||||
--- -----
|
||||
role_id c0064fe2-8f0e-b317-7fe7-66f7405b45a1
|
||||
```
|
||||
На команду
|
||||
```sh
|
||||
vault write -f auth/approle/role/org-ccalm-jwt/secret-id
|
||||
```
|
||||
Выдало:
|
||||
```text
|
||||
Key Value
|
||||
--- -----
|
||||
secret_id 24f31c88-7185-0d93-9a51-e221c2925265
|
||||
secret_id_accessor 22fa68e3-fc73-2008-0a34-3506630b6693
|
||||
secret_id_num_uses 0
|
||||
secret_id_ttl 0s
|
||||
```
|
||||
Сохрани role_id и secret_id, они понадобятся Spring Boot.
|
||||
|
||||
Хранить ключи лучьше в переменных окружения
|
||||
```sh
|
||||
export VAULT_ROLE_ID="your-role-id" &&
|
||||
export VAULT_SECRET_ID="your-secret-id"
|
||||
```
|
||||
|
||||
|
||||
Проверяем не больше какого значения можно задать время жизни кокена:
|
||||
```sh
|
||||
vault read sys/mounts/auth/token/tune
|
||||
```
|
||||
По умолчанию max_lease_ttl равен 32 дня!
|
||||
|
||||
На год можно увеличить так:
|
||||
```sh
|
||||
vault write sys/mounts/auth/token/tune max_lease_ttl=8760h
|
||||
```
|
||||
|
||||
Create data access token with set politics:
|
||||
```sh
|
||||
vault token create -policy=jwt-policy -ttl=0
|
||||
```
|
||||
|
||||
Продлевать токен можно так:
|
||||
```sh
|
||||
vault token renew <твой-токен>
|
||||
```
|
||||
|
||||
Проверяем зранятся ли токены в хранилище а не в памяти
|
||||
```sh
|
||||
vault read sys/auth/token/tune
|
||||
```
|
||||
token_type = default-service, значит Vault не хранит токены
|
||||
|
||||
Включаем хранение токенов:
|
||||
```sh
|
||||
vault write sys/auth/token/tune token_type=service
|
||||
```
|
||||
|
||||
|
||||
|
||||
---
|
||||
Теперь HashiCorp Vault установлен и готов к использованию! 🚀
|
||||
|
||||
# Установка HashiCorp Vault на Ubuntu
|
||||
|
||||
Vault — это инструмент от HashiCorp для безопасного хранения секретов и управления ими.
|
||||
|
||||
## 1. Установка Vault
|
||||
|
||||
Открываю нужный сервер
|
||||
```sh
|
||||
wsl
|
||||
```
|
||||
Похоже vault из Москвы недоступен:
|
||||
```sh
|
||||
ssh root@45.144.64.218 -p 2200
|
||||
```
|
||||
|
||||
### 1.1. Добавление репозитория HashiCorp
|
||||
|
||||
1. Установите необходимые пакеты:
|
||||
```sh
|
||||
sudo apt update && sudo apt install -y gnupg software-properties-common curl
|
||||
```
|
||||
|
||||
2. Добавьте официальный GPG-ключ HashiCorp:
|
||||
```sh
|
||||
curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
|
||||
```
|
||||
|
||||
3. Добавьте репозиторий HashiCorp в систему:
|
||||
```sh
|
||||
sudo mcedit /etc/apt/sources.list.d/hashicorp.list
|
||||
```
|
||||
|
||||
Заменяем на:
|
||||
```text
|
||||
deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com noble main
|
||||
```
|
||||
Где noble это кодовое имя Ubuntu 24.04
|
||||
|
||||
|
||||
4. Обновите списки пакетов:
|
||||
```sh
|
||||
sudo apt update
|
||||
```
|
||||
|
||||
5. Установите Vault:
|
||||
```sh
|
||||
sudo apt install -y vault
|
||||
```
|
||||
|
||||
6. Проверьте, что Vault установлен правильно:
|
||||
```sh
|
||||
vault --version
|
||||
```
|
||||
Выдало: Vault v1.18.5 (2cb3755273dbd63f5b0f8ec50089b57ffd3fa330), built 2025-02-24T09:40:28Z
|
||||
|
||||
|
||||
## 2. Запуск Vault
|
||||
|
||||
### 2.1. Запуск в Dev-режиме (только для тестирования)
|
||||
|
||||
If work stop it:
|
||||
```sh
|
||||
sudo pkill vault
|
||||
```
|
||||
If need delete old data:
|
||||
```sh
|
||||
sudo rm -rf ~/.vault-token ~/.vault/
|
||||
```
|
||||
For find where stored data read file:
|
||||
```sh
|
||||
sudo mcedit /etc/vault/config.hcl
|
||||
```
|
||||
In config file find this path: /opt/vault/data
|
||||
|
||||
После удаления базы нужно инициализировать Vault заново:
|
||||
```sh
|
||||
sudo vault operator init
|
||||
```
|
||||
|
||||
Run in developer mode (in dev mode data stored in RAM):
|
||||
```sh
|
||||
vault server -dev
|
||||
```
|
||||
|
||||
```text
|
||||
WARNING! dev mode is enabled! In this mode, Vault runs entirely in-memory
|
||||
and starts unsealed with a single unseal key. The root token is already
|
||||
authenticated to the CLI, so you can immediately begin using Vault.
|
||||
|
||||
You may need to set the following environment variables:
|
||||
|
||||
$ export VAULT_ADDR='http://127.0.0.1:8200'
|
||||
|
||||
The unseal key and root token are displayed below in case you want to
|
||||
seal/unseal the Vault or re-authenticate.
|
||||
|
||||
Unseal Key: TMb6A3QI3wJ9kaEeTYo5wEviP23lugJ3Asek2la6V4s=
|
||||
Root Token: hvs.GsWHRR7ne7gMTZhuPgZdh91w
|
||||
|
||||
Development mode should NOT be used in production installations!
|
||||
```
|
||||
|
||||
Теперь Vault работает по адресу:
|
||||
```sh
|
||||
start http://127.0.0.1:8200
|
||||
```
|
||||
Останавливаю нажатием Ctrl + C
|
||||
|
||||
|
||||
### 2.2. Настройка Vault в режиме сервера
|
||||
|
||||
1. Создайте конфигурационный файл:
|
||||
```sh
|
||||
sudo mkdir -p /etc/vault &&
|
||||
sudo mcedit /etc/vault/config.hcl
|
||||
```
|
||||
|
||||
2. Добавьте следующий конфиг:
|
||||
```text
|
||||
storage "file" {
|
||||
path = "/opt/vault/data"
|
||||
}
|
||||
|
||||
listener "tcp" {
|
||||
address = "127.0.0.1:8200"
|
||||
tls_disable = 1
|
||||
}
|
||||
|
||||
disable_mlock = true
|
||||
ui = true
|
||||
```
|
||||
|
||||
3. Создайте папку для хранения данных:
|
||||
```sh
|
||||
sudo mkdir -p /opt/vault/data &&
|
||||
sudo chown vault:vault /opt/vault/data
|
||||
```
|
||||
|
||||
4. Создайте systemd-сервис для Vault:
|
||||
```sh
|
||||
sudo tee /etc/systemd/system/vault.service > /dev/null <<'EOF'
|
||||
[Unit]
|
||||
Description=HashiCorp Vault
|
||||
After=network-online.target
|
||||
Requires=network-online.target
|
||||
|
||||
[Service]
|
||||
User=vault
|
||||
Group=vault
|
||||
ExecStart=/usr/bin/vault server -config=/etc/vault/config.hcl
|
||||
ExecReload=/bin/kill --signal HUP \$MAINPID
|
||||
KillSignal=SIGTERM
|
||||
Restart=on-failure
|
||||
LimitMEMLOCK=infinity
|
||||
ProtectSystem=full
|
||||
CapabilityBoundingSet=CAP_IPC_LOCK CAP_SETGID CAP_SETUID CAP_SYSLOG CAP_CHOWN
|
||||
NoNewPrivileges=yes
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
```
|
||||
Проверяем всё ли записалось:
|
||||
```sh
|
||||
sudo mcedit /etc/systemd/system/vault.service
|
||||
```
|
||||
|
||||
5. Перезапустите systemd и включите Vault:
|
||||
```sh
|
||||
sudo systemctl daemon-reload &&
|
||||
sudo systemctl enable vault &&
|
||||
sudo systemctl start vault
|
||||
```
|
||||
|
||||
7. Проверьте статус:
|
||||
```sh
|
||||
sudo systemctl status vault
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 3. Инициализация и разлочка Vault
|
||||
|
||||
1. Экспортируйте переменную окружения:
|
||||
```sh
|
||||
export VAULT_ADDR='http://127.0.0.1:8200'
|
||||
```
|
||||
|
||||
2. Инициализируйте хранилище (сохраните ключи!):
|
||||
```sh
|
||||
vault operator init
|
||||
```
|
||||
|
||||
Выдало:
|
||||
```text
|
||||
Unseal Key 1: lQlJsb9RI8rSzLrc5iPnx1qJkWZbbXIkrEgnQGe5R6uO
|
||||
Unseal Key 2: 0qJJXRo570jlH/0Qs/wodXHNI2SF5VgL4jE04JawSPSB
|
||||
Unseal Key 3: VuYkOkQ8qmwofDmjqsTRQoMqGAH3Jv+nqQylL7Uibbtp
|
||||
Unseal Key 4: JJJ8Nqj00qzS9u5wNtTtExL/jWlJF9fgaBsiuaf0kFxC
|
||||
Unseal Key 5: L6lZMp/l7s24EZJAFnWS4Py5jsWOuMioC41g5LhUJKWL
|
||||
|
||||
Initial Root Token: hvs.o07DY7tnSPcufxk60pjCXDzn
|
||||
|
||||
Vault initialized with 5 key shares and a key threshold of 3. Please securely
|
||||
distribute the key shares printed above. When the Vault is re-sealed,
|
||||
restarted, or stopped, you must supply at least 3 of these keys to unseal it
|
||||
before it can start servicing requests.
|
||||
|
||||
Vault does not store the generated root key. Without at least 3 keys to
|
||||
reconstruct the root key, Vault will remain permanently sealed!
|
||||
|
||||
It is possible to generate new unseal keys, provided you have a quorum of
|
||||
existing unseal keys shares. See "vault operator rekey" for more information.
|
||||
```
|
||||
|
||||
3. Разблокируйте Vault, используя один из ключей (потом ещё 3 раза выполнить эту команду):
|
||||
```sh
|
||||
vault operator unseal
|
||||
```
|
||||
|
||||
4. Авторизуйтесь с root-токеном:
|
||||
```sh
|
||||
vault login hvs.MTFV72PjKXCVh5ZL6yCVE3Yw
|
||||
```
|
||||
|
||||
5. Создаём(включаем) новое хранилище ключ-значение через ssh
|
||||
```sh
|
||||
vault secrets enable -path=org-ccalm kv-v2
|
||||
```
|
||||
|
||||
|
||||
|
||||
5. Writing to the kv storage (добавил префикс vault. чтобы значения самому подставлять в нужные места в spring)
|
||||
|
||||
Заменит(создаст) значение:
|
||||
```sh
|
||||
vault kv put org-ccalm/jwt vault.server.ssl.key-store-password=MFNX344yh4
|
||||
```
|
||||
Добавит (обновит):
|
||||
```sh
|
||||
vault kv patch org-ccalm/jwt vault.test=test2
|
||||
```
|
||||
```sh
|
||||
vault kv put org-ccalm/public vault.personal_data.key=7dd2Nek1
|
||||
```
|
||||
|
||||
6. Read data from the kv
|
||||
```sh
|
||||
vault kv get org-ccalm/jwt
|
||||
```
|
||||
|
||||
Должно вывести:
|
||||
```text
|
||||
Key Value
|
||||
--- -----
|
||||
server.ssl.key-store-password M4yh4
|
||||
```
|
||||
|
||||
6. Включаем AppRole для доступа из приложения
|
||||
```sh
|
||||
vault auth enable approle
|
||||
```
|
||||
|
||||
7. Добавляем политики потом создаём ключ для этой политикиполитики
|
||||
|
||||
Создаю файл политик
|
||||
```sh
|
||||
cd ~ &&
|
||||
sudo tee jwt-policy.hcl > /dev/null <<'EOF'
|
||||
path "org-ccalm/data/jwt" {
|
||||
capabilities = ["create", "read", "update", "delete", "list"]
|
||||
}
|
||||
path "org-ccalm/data/public" {
|
||||
capabilities = ["read", "list"]
|
||||
}
|
||||
EOF
|
||||
```
|
||||
Apply and delete configiration file:
|
||||
```sh
|
||||
vault policy write jwt-policy ~/jwt-policy.hcl &&
|
||||
rm -f jwt-policy.hcl
|
||||
```
|
||||
|
||||
Создаём AppRole (на 10 лет)
|
||||
```sh
|
||||
vault write auth/approle/role/org-ccalm-jwt \
|
||||
secret_id_ttl=0 \
|
||||
token_ttl=87600h \
|
||||
token_max_ttl=87600h \
|
||||
policies="jwt-policy,another-policy,third-policy"
|
||||
```
|
||||
|
||||
Получаем role_id и secret_id
|
||||
```sh
|
||||
vault read auth/approle/role/org-ccalm-jwt/role-id
|
||||
```
|
||||
Выдало
|
||||
```text
|
||||
Key Value
|
||||
--- -----
|
||||
role_id c0064fe2-8f0e-b317-7fe7-66f7405b45a1
|
||||
```
|
||||
На команду
|
||||
```sh
|
||||
vault write -f auth/approle/role/org-ccalm-jwt/secret-id
|
||||
```
|
||||
Выдало:
|
||||
```text
|
||||
Key Value
|
||||
--- -----
|
||||
secret_id 24f31c88-7185-0d93-9a51-e221c2925265
|
||||
secret_id_accessor 22fa68e3-fc73-2008-0a34-3506630b6693
|
||||
secret_id_num_uses 0
|
||||
secret_id_ttl 0s
|
||||
```
|
||||
Сохрани role_id и secret_id, они понадобятся Spring Boot.
|
||||
|
||||
Хранить ключи лучьше в переменных окружения
|
||||
```sh
|
||||
export VAULT_ROLE_ID="your-role-id" &&
|
||||
export VAULT_SECRET_ID="your-secret-id"
|
||||
```
|
||||
|
||||
|
||||
Проверяем не больше какого значения можно задать время жизни кокена:
|
||||
```sh
|
||||
vault read sys/mounts/auth/token/tune
|
||||
```
|
||||
По умолчанию max_lease_ttl равен 32 дня!
|
||||
|
||||
На год можно увеличить так:
|
||||
```sh
|
||||
vault write sys/mounts/auth/token/tune max_lease_ttl=8760h
|
||||
```
|
||||
|
||||
Create data access token with set politics:
|
||||
```sh
|
||||
vault token create -policy=jwt-policy -ttl=0
|
||||
```
|
||||
|
||||
Продлевать токен можно так:
|
||||
```sh
|
||||
vault token renew <твой-токен>
|
||||
```
|
||||
|
||||
Проверяем зранятся ли токены в хранилище а не в памяти
|
||||
```sh
|
||||
vault read sys/auth/token/tune
|
||||
```
|
||||
token_type = default-service, значит Vault не хранит токены
|
||||
|
||||
Включаем хранение токенов:
|
||||
```sh
|
||||
vault write sys/auth/token/tune token_type=service
|
||||
```
|
||||
|
||||
|
||||
|
||||
---
|
||||
Теперь HashiCorp Vault установлен и готов к использованию! 🚀
|
||||
|
||||
|
||||
Reference in New Issue
Block a user