vault

Wat het doet

Zo schrijf je het

vault COMMAND [OPTIONS] [PATH] [KEY=VALUE ...]
export VAULT_ADDR=https://vault.lab.local:8200

Belangrijkste delen

Commands

status

Sealed? HA mode? Version.

operator init / unseal / seal

Start, unlock and lock Vault.

login [-method=M]

Log in.

kv put|get|list|delete|metadata PATH

Static secrets (KV v2).

read / write / list / delete PATH

Any path of any engine.

secrets enable|list ENGINE

Turn on secrets engines.

auth enable|list METHOD

Turn on auth methods.

policy write|read|list NAME

Access policies.

token create|lookup|revoke

Tokens.

lease renew|revoke

Leases of dynamic secrets.

audit enable file

Turn on the audit log.

operator raft snapshot save

Back up integrated storage.

Meest gebruikt

Niets past bij dit filter.

$ als gewone gebruiker# als root (of met sudo)

1. 1Start a dev server to learn

   $vault server -dev -dev-root-token-id=root &
   $export VAULT_ADDR=http://127.0.0.1:8200 VAULT_TOKEN=root
   $vault status

2. 2Initialize and unseal a real server

   $vault operator init -key-shares=5 -key-threshold=3
   $vault operator unseal
   $vault status | grep Sealed

3. 3Store and read a static secret

   $vault secrets enable -path=secret kv-v2
   $vault kv put -mount=secret shop/db username=shop password='S3cr3t!x'
   $vault kv get -mount=secret shop/db
   $vault kv get -mount=secret -field=password shop/db

4. 4See versions and roll back

   $vault kv metadata get -mount=secret shop/db
   $vault kv rollback -mount=secret -version=1 shop/db

5. 5Write a least-privilege policy

   $cat shop-read.hcl
   path "secret/data/shop/*" {
     capabilities = ["read"]
   }
   $vault policy write shop-read shop-read.hcl

6. 6Let Kubernetes pods log in with their service account

   $vault auth enable kubernetes
   $vault write auth/kubernetes/config kubernetes_host=https://kubernetes.default.svc:443
   $vault write auth/kubernetes/role/shop bound_service_account_names=shop bound_service_account_namespaces=shop policies=shop-read ttl=1h

7. 7Dynamic database users (short lived)

   $vault secrets enable database
   $vault write database/config/shop plugin_name=postgresql-database-plugin connection_url="postgresql://{{username}}:{{password}}@db1:5432/shop" allowed_roles=shop-app username=vaultadmin password='ChangeMe!'
   $vault write database/roles/shop-app db_name=shop default_ttl=1h max_ttl=24h creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";"
   $vault read database/creds/shop-app

8. 8Encrypt data without storing it (transit)

   $vault secrets enable transit
   $vault write -f transit/keys/shop
   $vault write transit/encrypt/shop plaintext=$(echo -n "4111-1111" | base64)

9. 9Turn on the audit log

   $vault audit enable file file_path=/var/log/vault/audit.log

10. 10Back up Vault (Raft storage)

    $vault operator raft snapshot save vault-$(date +%F).snap

Niets past bij dit filter.

Bestanden

/etc/vault.d/vault.hcl

Server configuration.

~/.vault-token

Your token after vault login.

Exitcodes