{{tag>Brouillon Sécurité PKI MDP Vault}} # Notes Hashicorp Vault Hashicorp Vault Voir : * https://www.youtube.com/watch?v=I4Xu3DGfk60&list=PLCFwfUlM-doNzjCQDDU9jvZ57tNWX03xy & suite * https://github.com/mehdilaruelle/vault-youtube/blob/master/vault_auth_demonstration.sh Voir aussi (alternatives) : * Akeyless * OpenBao Voir aussi : * [[Notes SOPS]] Source : https://www.youtube.com/watch?v=vOf0afZP9gE ~~~bash docker run --cap-add=IPC_LOCK -d -p 8200:8200 --name=dev-vault vault ~~~ ~~~ docker logs dev-vault WARNING! dev mode is enabled! In this mode, Vault runs entirely in-memory and starts unsealed with a single unseal key. The root token is already authenticated to the CLI, so you can immediately begin using Vault. You may need to set the following environment variables: $ export VAULT_ADDR='http://0.0.0.0:8200' The unseal key and root token are displayed below in case you want to seal/unseal the Vault or re-authenticate. Unseal Key: fjLp7NUP5GfHPE8fv0UxMM+D1s0xuumy4Xljs6l7Eks= Root Token: hvs.pSSg3pM9pfk5Ih6HdCi784un Development mode should NOT be used in production installations! ~~~ ~~~bash vault server -dev ~~~ ~~~bash VAULT_SKIP_VERIFY=true ~~~ ~~~bash curl 127.0.0.1:8200/v1/sys/health | jq . ~~~ ~~~bash #vault(){ docker exec -ti -e VAULT_ADDR='http://127.0.0.1:8200' -e VAULT_TOKEN=hvs.pSSg3pM9pfk5Ih6HdCi784un dev-vault vault $@ ;} vault(){ podman run --cap-add IPC_LOCK --rm -v /etc/ssl/certs/:/etc/ssl/certs/:ro -e VAULT_ADDR='https://vault.acme.local' -e VAULT_TOKEN='hvs.CAESxxxxxxxxx' docker.io/library/vault:0.11.6 vault $@ ;} vault --version vault status vault token lookup ~~~ ~~~ # vault kv list kv/ Keys ---- plop ~~~ ~~~bash vault kv get -format=json -field=data kv/plop ~~~ ## Ansible ~~~bash export VAULT_TOKEN=hvs.CAESIxxxxxxxxxxx ~~~~ ~~~yaml #! /usr/bin/env ansible-playbook --- - name: Test Vault hosts: localhost gather_facts: false tasks: - name: Get Vault community.hashi_vault.vault_kv2_get: url: https://vault.acme.local ca_cert: /etc/ssl/certs/ engine_mount_point: acme path: plop register: hv_plop - name: Test - afficher MDP ansible.builtin.debug: msg: "user: {{ plop_user }} ; pass {{ plop_pass }}" vars: plop_user: "{{ (hv_plop.secret.keys() | list)[0] }}" plop_pass: "{{ (hv_plop.secret.values() | list)[0] }}" ~~~ ## Autres ~~~bash vault auth enable userpass vault write auth/userpass/users/jean password='P@ssw0rd' policies=admins vault login -method=userpass username=jean password='P@ssw0rd' vault auth enable -path="custom" approle vault write auth/approle/role/my-app \ secret_id_ttl=10m \ token_num_uses=0 \ token_ttl=120m \ token_max_ttl=300m \ secret_id_num_uses=1 \ token_policies="app_read" ~~~ ~~~ path "secrets/secret/show/ploppath" { capabilities = ["read", "create", "update", "delete"] } ~~~