Что такое HashiCorp Vault?

 1# Установка через пакетный менеджер
 2# Ubuntu/Debian
 3curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo apt-key add -
 4sudo apt-add-repository "deb [arch=amd64] https://apt.releases.hashicorp.com $(lsb_release -cs) main"
 5sudo apt-get update && sudo apt-get install vault
 6
 7# CentOS/RHEL
 8sudo yum install -y yum-utils
 9sudo yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
10sudo yum -y install vault
11
12# Или скачать бинарник
13wget https://releases.hashicorp.com/vault/1.15.0/vault_1.15.0_linux_amd64.zip
14unzip vault_1.15.0_linux_amd64.zip
15sudo mv vault /usr/local/bin/

1# Запуск development сервера
2vault server -dev
3
4# В другом терминале
5export VAULT_ADDR='http://127.0.0.1:8200'
6export VAULT_TOKEN="hvs.example-token"
7
8# Проверка статуса
9vault status

 1# Запись секрета
 2vault kv put secret/myapp username=admin password=secret123
 3
 4# Чтение секрета
 5vault kv get secret/myapp
 6
 7# Получение в JSON формате
 8vault kv get -format=json secret/myapp
 9
10# Удаление секрета
11vault kv delete secret/myapp

 1# vault.hcl
 2storage "consul" {
 3  address = "127.0.0.1:8500"
 4  path    = "vault/"
 5}
 6
 7listener "tcp" {
 8  address     = "0.0.0.0:8200"
 9  tls_cert_file = "/path/to/cert.pem"
10  tls_key_file  = "/path/to/key.pem"
11}
12
13seal "awskms" {
14  region     = "us-east-1"
15  kms_key_id = "alias/vault-key"
16}
17
18ui = true
19log_level = "INFO"
20cluster_name = "vault-cluster"

 1# Инициализация Vault
 2vault operator init
 3
 4# Распечатка Vault (требуется несколько ключей)
 5vault operator unseal <unseal-key-1>
 6vault operator unseal <unseal-key-2>
 7vault operator unseal <unseal-key-3>
 8
 9# Аутентификация
10vault auth <root-token>

 1# Включение LDAP аутентификации
 2vault auth enable ldap
 3
 4# Настройка LDAP
 5vault write auth/ldap/config \
 6    url="ldap://ldap.example.com" \
 7    userdn="ou=Users,dc=example,dc=com" \
 8    groupdn="ou=Groups,dc=example,dc=com" \
 9    userattr=uid \
10    groupattr=cn
11
12# Включение Kubernetes аутентификации
13vault auth enable kubernetes
14
15# Настройка Kubernetes auth
16vault write auth/kubernetes/config \
17    token_reviewer_jwt="<service-account-jwt>" \
18    kubernetes_host="https://kubernetes.example.com" \
19    kubernetes_ca_cert=@ca.crt

 1# Включение database secrets engine
 2vault secrets enable database
 3
 4# Настройка подключения к PostgreSQL
 5vault write database/config/my-postgresql-database \
 6    plugin_name=postgresql-database-plugin \
 7    connection_url="postgresql://{{username}}:{{password}}@localhost:5432/postgres" \
 8    allowed_roles="my-role" \
 9    username="vault" \
10    password="mypassword"
11
12# Создание роли
13vault write database/roles/my-role \
14    db_name=my-postgresql-database \
15    creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
16        GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
17    default_ttl="1h" \
18    max_ttl="24h"
19
20# Получение динамических credentials
21vault read database/creds/my-role

 1# Включение PKI engine
 2vault secrets enable pki
 3
 4# Настройка TTL
 5vault secrets tune -max-lease-ttl=87600h pki
 6
 7# Генерация root CA
 8vault write -field=certificate pki/root/generate/internal \
 9    common_name="example.com" \
10    ttl=87600h > CA_cert.crt
11
12# Создание роли
13vault write pki/roles/example-dot-com \
14    allowed_domains="example.com" \
15    allow_subdomains=true \
16    max_ttl="720h"
17
18# Выпуск сертификата
19vault write pki/issue/example-dot-com common_name="test.example.com"

 1# Python клиент
 2import hvac
 3
 4# Подключение к Vault
 5client = hvac.Client(url='https://vault.example.com:8200')
 6client.token = 'your-vault-token'
 7
 8# Чтение секрета
 9response = client.secrets.kv.v2.read_secret_version(path='myapp')
10username = response['data']['data']['username']
11password = response['data']['data']['password']
12
13# Запись секрета
14client.secrets.kv.v2.create_or_update_secret(
15    path='myapp',
16    secret=dict(username='admin', password='newpass')
17)

 1# vault-agent.hcl
 2exit_after_auth = true
 3pid_file = "./pidfile"
 4
 5auto_auth {
 6  method "kubernetes" {
 7    mount_path = "auth/kubernetes"
 8    config = {
 9      role = "demo"
10    }
11  }
12
13  sink "file" {
14    config = {
15      path = "/home/vault/.vault-token"
16    }
17  }
18}
19
20template {
21  source      = "/etc/vault/db.tpl"
22  destination = "/etc/app/db.conf"
23}