Vault Basic Setup

Consul

• Consul выступает в качестве бекенда
• Базовая установка Consul https://noname.com.ua/mediawiki/index.php/Consul_Basic_Setup

Базовая настойка Vault

Устновка

curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo apt-key add -
sudo apt-add-repository "deb [arch=amd64] https://apt.releases.hashicorp.com $(lsb_release -cs) main"
sudo apt-get update && sudo apt-get install vault

Подготовка Consul

Есть разные способы - тут привожу пример с использованием терраформ

• Требуется токен (получение токена - https://noname.com.ua/mediawiki/index.php/Consul_Basic_Setup#management_token )
• токен приведен для примера

export CONSUL_TOKEN="4f6037ed-5f62-5463-d165-cbb984791ef1"

• Установить терраформ (если не установлен)

apt install terraform

• Файл с описанием ACL cat acl.tf

variable "consul_datacenter" {
    type = string
    default = "kilda-fred"
}
provider "consul" {
  address    = "http://127.0.0.1:8500"
  datacenter = var.consul_datacenter
}
resource "consul_acl_policy" "vault_policy" {
  name        = "vault_policy"
  datacenters = [var.consul_datacenter]
  rules       = <<-RULE
    {
        "key_prefix": {
            "kilda-fred-vault/": {
                "policy": "write"
            }
        },
        "node_prefix": {
            "": {
              "policy": "write"
            }
        },
        "service": {
            "vault": {
                "policy": "write"
            }
        },
        "agent_prefix": {
            "": {
                "policy": "write"
            }
        },
        "session_prefix": {
            "": {
                "policy": "write"
            }
        }
    }
    RULE
}

resource "consul_acl_role" "vault_role" {
    name = "vault_role"
    description = "Role assignet to the Hasicorp Vault service"
    policies = [
        consul_acl_policy.vault_policy.id
    ]
    service_identities {
        service_name = "vault"
    }
}
resource "consul_acl_token" "vault_token" {
    description = "Token for Vault Server"
    roles = [
        consul_acl_role.vault_role.name
    ]
    local = true
}

data "consul_acl_token_secret_id" "vault_token" {
    accessor_id = consul_acl_token.vault_token.accessor_id
}

output "consul_acl_token_secret_id" {
    value = data.consul_acl_token_secret_id.vault_token.secret_id
    sensitive = true
}

output "consul_token_for_vault_server_accessor_id" {
    value = consul_acl_token.vault_token.accessor_id
    sensitive = true
}

* Инициализировать терраформ и применить ACL
<PRE>
terraform init

terraform apply -auto-approve

• Вывод (все токены для примера)

Changes to Outputs:
  + consul_acl_token_secret_id                = (sensitive value)
  + consul_token_for_vault_server_accessor_id = (sensitive value)
consul_acl_policy.vault_policy: Creating...
consul_acl_policy.vault_policy: Creation complete after 0s [id=6746941f-5928-65e9-76f1-9653b294ccac]
consul_acl_role.vault_role: Creating...
consul_acl_role.vault_role: Creation complete after 0s [id=5e56be99-8a8a-865e-50cc-dfa512051d03]
consul_acl_token.vault_token: Creating...
consul_acl_token.vault_token: Creation complete after 0s [id=5a4ae5cd-8391-f735-e067-4404d859448b]
data.consul_acl_token_secret_id.vault_token: Reading...
data.consul_acl_token_secret_id.vault_token: Read complete after 0s [id=5a4ae5cd-8391-f735-e067-4404d859448b]

Apply complete! Resources: 3 added, 0 changed, 0 destroyed.

Outputs:

Посмотреть спрятанные "секретные" значения можно terraform output -json, для дальнейшей работы нужен токен 8ea89f62-e928-06e8-379b-9b1eebb92a67

{
  "consul_acl_token_secret_id": {
    "sensitive": true,
    "type": "string",
    "value": "8ea89f62-e928-06e8-379b-9b1eebb92a67"
  },
  "consul_token_for_vault_server_accessor_id": {
    "sensitive": true,
    "type": "string",
    "value": "5a4ae5cd-8391-f735-e067-4404d859448b"
  }
}

Конфигурация Vault

• /etc/vault.d/vault.hcl
• Токен 5a4ae5cd-8391-f735-e067-4404d859448b получен на предыдущем шаге

storage "consul" {
    address     = "127.0.0.1:8500"
    path        = "kilda-vault/"
    token       = "8ea89f62-e928-06e8-379b-9b1eebb92a67"
    # Register the service at Consul
    service     = "vault"
    service_tags = "home"
}

telemetry {
  statsite_address = "127.0.0.1:8125"
  disable_hostname = true
}

disable_mlock   = true
ui = true
#mlock = true
#disable_mlock = true

#}

# HTTPS listener
listener "tcp" {
  address       = "0.0.0.0:8200"
  tls_cert_file = "/opt/vault/tls/tls.crt"
  tls_key_file  = "/opt/vault/tls/tls.key"
}