启动vault Server

vault server -dev
export VAULT_ADDR='http://127.0.0.1:8200'
export VAULT_TOKEN="s.XmpNPoi9sRhYtdKHaQhkHP6x"

启用kv机密机密引擎

vault secrets enable -path=kv
#支持多版本
 （1）vault secrets enable -path=kv kv-v2
 （2）vault kv enable-versioning kv/

查看机密引擎列表

➜  ~ vault secrets list
Path          Type         Accessor              Description
----          ----         --------              -----------
cubbyhole/    cubbyhole    cubbyhole_b6b3c999    per-token private secret storage
identity/     identity     identity_cd676d4a     identity store
kv/           kv           kv_b591ce58           n/a
secret/       kv           kv_e95dfadc           key/value secret storage
sys/          system       system_69354e39       system endpoints used for control, policy and debugging

写数据KV

➜  ~ vault kv put kv/data/rsa/public/card key=333
Key              Value
---              -----
created_time     2021-03-18T09:31:09.268356Z
deletion_time    n/a
destroyed        false
version          1

读数据KV

➜  ~ vault kv get kv/data/rsa/public/card
====== Metadata ======
Key              Value
---              -----
created_time     2021-03-18T09:31:09.268356Z
deletion_time    n/a
destroyed        false
version          1

=== Data ===
Key    Value
---    -----

创建 ACL Policy

#本地文件读取policy配置文件
➜ ~ vault policy write guardplus ~/tmp/guardplus.hcl

查看policy list

➜  ~ vault policy list
default
guardplus
registryplus
swaggerplus
root

查看policy 详情

➜  ~ vault policy read swaggerplus
path "kv/data/rsa/private/swaggerplus" {
  capabilities=["read"]
}
➜  ~

基于policy创建token

➜  ~ vault token create -policy=guardplus
Key                  Value
---                  -----
token                s.PvPiW1awHXpdoqMbnaLpmyzw
token_accessor       IpUqjNnbggTe71nKozPda7zK
token_duration       768h
token_renewable      true
token_policies       ["default" "guardplus"]
identity_policies    []
policies             ["default" "guardplus"]
# 通过token写数据
➜  ~ VAULT_TOKEN=s.PvPiW1awHXpdoqMbnaLpmyzw> 
vault kv put kv/creds password="my-long-password"

查看auth method 列表

➜  ~ vault auth list
Path        Type       Accessor                 Description
----        ----       --------                 -----------
approle/    approle    auth_approle_aecb2c85    n/a
token/      token      auth_token_ead59e09      token based credentials
➜  ~

启用approle引擎

➜ ~ vault auth enable approle

为应用创建role

#role_name为应用名
➜  ~ vault write auth/approle/role/guardplus \
bind_secret_id=true \
secret_id_num_uses=0 \
token_num_uses=100 \
token_ttl=10m \
token_max_ttl=10m \
policies=guardplus
Success! Data written to: auth/approle/role/guardplus

查询roleId

➜  ~ vault read auth/approle/role/guardplus/role-id
Key        Value
---        -----
role_id    9dd81570-7e2d-9cd3-8352-217316ac8b17

创建secretId

# role必须存在，否则报错
➜  ~ vault write -f auth/approle/role/guardplus/secret-id

Key                   Value
---                   -----
secret_id             6423ddff-59c8-0852-8e8b-b5589c7f6b59
secret_id_accessor    e9f2dfa8-18c1-e4e5-730b-f357dc642e8c

将roleId和sercretId写入环境变量

➜ ~ export ROLE_ID="$(vault read -field=role_id auth/approle/role/guardplus/role-id)"

➜ ~ export SECRET_ID="$(vault write -f -field=secret_id auth/approle/role/guardplus/secret-id)"

# 添加到login中
➜ ~ vault write auth/approle/login role_id="$ROLE_ID" secret_id="$SECRET_ID"

查看vault token的 默认过期时间

➜  ~ vault read sys/auth/token/tune
Key                  Value
---                  -----
default_lease_ttl    768h
description          token based credentials
force_no_cache       false
max_lease_ttl        768h
token_type           default-service

默认32天，可以被覆盖。

➜  ~ vault write sys/auth/token/tune default_lease_ttl=700h max_lease_ttl=720h

Success! Data written to: sys/auth/token/tune
➜  ~ vault read sys/auth/token/tune
Key                  Value
---                  -----
default_lease_ttl    700h
description          token based credentials
force_no_cache       false
max_lease_ttl        720h
token_type           default-service
➜  ~

统计token数量

vault read sys/internal/counters/tokens

父令牌和子令牌的区别：

每个令牌都有自己的生命周期，如父令牌1h，子令牌3h，这时，父令牌在1个小时候过期，子令牌也会被过期，尽管它还有2个小时。

token TTL和Max TTL区别

token若支持续签，则续签的时间最大允许超过max ttl。若超过则无法继续续签