💡 핵심 요약 (Executive Summary)
본 가이드는 vault 핵심 가이드 및 실전 아키텍처의 핵심 개념, 실전 구성 명령어 및 아키텍처 베스트 프랙티스를 다룹니다. 클라우드 네이티브 및 인프라 엔지니어링 실무에 즉시 활용 가능하도록 체계적으로 정리했습니다.
📑 Table of Contents
Installation
운영
인증 관리
policy 등록
bash
k exec -it -n portal-system sts/vault -- sh
### START IN CONTAINER
vault login
policy_name=admin-policy
cat > /tmp/${policy_name}.hcl <<EOF
path "*" {
capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}
EOF
vault policy write ${policy_name} /tmp/${policy_name}.hclauth: userpass 활성화
bash
k exec -it -n portal-system sts/vault -- sh
### START IN CONTAINER
vault login
if vault auth list | grep -q "userpass/"; then
echo "[SKIP] userpass already enabled"
else
vault auth enable userpass
vault auth tune -listing-visibility=unauth userpass/
fi- User 추가
bash
user_name=admin
user_password=
policy_name=admin-policy
vault write auth/userpass/users/${user_name} \
password="${user_password}" \
policies="${policy_name}"auth: kubernetes 활성화
bash
k exec -it -n portal-system sts/vault -- sh
### START IN CONTAINER
vault login
vault auth enable kubernetes
vault write auth/kubernetes/config \
token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
kubernetes_host="https://$KUBERNETES_PORT_443_TCP_ADDR:443" \
kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt- Role 추가
- Audience 확인:
bash
test_pod=lovely-octopus
TOKEN=$(kubectl exec -n deploy-system $test_pod -c vault-agent-init -- cat /var/run/secrets/kubernetes.io/serviceaccount/token)
echo $TOKEN | cut -d'.' -f2 | base64 -d 2>/dev/null | jq .
bash
k exec -it -n portal-system sts/vault -- sh
### START IN CONTAINER
vault login
role_name=deploy-admin-role
policy_name=admin-policy
kube_sa=deploy-admin
kube_sa_ns=deploy-system
vault write auth/kubernetes/role/${role_name} \
bound_service_account_names=${kube_sa} \
bound_service_account_namespaces=${kube_sa_ns} \
policies=${policy_name} \
ttl=24h \
audience="https://kubernetes.default.svc.cluster.local"Sidecar Injector 사용
Required
- auth: kubernetes 활성화
-
Helm chart
values.yaml:.injector.enabled = ture
Deployments Annotation
yaml
spec:
template:
metadata:
annotations:
labels:
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/role: "deploy-admin-role"
vault.hashicorp.com/agent-inject-secret-common: "secret/mgt/pipelines/common"
vault.hashicorp.com/agent-inject-template-common: |
{{- with secret "secret/mgt/pipelines/common" -}}
export image_registry_id="{{ .Data.data.username }}"
export image_registry_pw="{{ .Data.data.password }}"
{{- end -}}
vault.hashicorp.com/agent-inject-secret-exception: "secret/mgt/pipelines/build1"
vault.hashicorp.com/agent-inject-template-exception: |
{{- with secret "secret/mgt/pipelines/build1" -}}
export NPM_VERSION="{{ .Data.data.version }}"
{{- end -}}Exec
bash
source /vault/secrets/common
source /vault/secrets/exceptionFeatures
Vault SA토큰 얻기
bash
k exec -it -n portal-system sts/vault -- cat /var/run/secrets/kubernetes.io/serviceaccount/token
Old
k8s환경 Token 확인 (OLD)
1. safe 등록됨
bash
#k8s cluster
safe env2. kubectl exec (컨테이너 내부 스토리지)
bash
kubectl exec -n vault sva-vault-manager-0 -- cat /mnt/data/cluster_keys.json | grep -oP --color=never '(?<="root_token":")[^"]*'3. kubectl get
bash
k get secrets -n vault vault-init -o jsonpath="{.data.VAULT_INIT_JSON}" | base64 -d
>>>
# root_token
{
"unseal_keys_b64": [
"KFaqIfd2hMZu/3Av9992M7C8/V6Bo51m/hrdXR4yRktb",
"Ys6aCMwmiYBbUoaI4/wKJwsAyWXz6JGaHuTFIAHO7q7T",
"R55MSYKIaGSiqZUduy1n5hkCeNlN9q5JIFTZn52Rihdm",
"zNuOvfN0dGd2dxeaODziMKXFv8I85pqxtIiL5OQ1vd0N",
"s1834/4Kxp3GPbf3rEMuNmlt1g9lhRlvBKLd3121U16v"
],
"unseal_keys_hex": [
"2856aa21f77684c66eff702ff7df7633b0bcfd5e81a39d66fe1add5d1e32464b5b",
"62ce9a08cc2689805b528688e3fc0a270b00c965f3e8919a1ee4c52001ceeeaed3",
"479e4c4982886864a2a9951dbb2d67e6190278d94df6ae492054d99f9d918a1766",
"ccdb8ebdf37474677677179a383ce230a5c5bfc23ce69ab1b4888be4e435bddd0d",
"b35f37e3fe0ac69dc63db7f7ac432e36696dd60f6585196f04a2dddf5db5535eaf"
],
"unseal_shares": 5,
"unseal_threshold": 3,
"recovery_keys_b64": [],<<<
"recovery_keys_hex": [],
"recovery_keys_shares": 0,
"recovery_keys_threshold": 0,
"root_token": "hvs.IlRy460I1duY0mEDJPiBzgfK"
}
<<<CLI
Leave a Reply